OIDC SSO
Category: Modules
Subcategory: Authentication
Overview
Use this module to implement single sign-on to your Mendix app using an OpenID Connect (OIDC) compliant identity provider (IDP). It supports ‘normal’ Mendix apps (i.e. responsive browser-based applications) and doesn’t yet support native or hybrid mobile apps. Tested against AWS Cognito, Google, Salesforce, Apple, Okta, Ping, and Microsoft, this module manages the end-to-end SSO workflow when working with an OIDC IDP. The IDP will relieve your app from logging in your end-users and optionally will also decide which roles the user gets assigned in your app, using mechanism from the OAuth protocol.
Simply provide configuration details, decide how you'd like to provision users, and log in!
You can use this module if your app is on Mendix 9 or later. If your app is using a previous Mendix version, you would have to upgrade your app or use the similar “OpenIDConnect Single Sign-on (OIDC, OAuth2, SSO)” module, which has community support. Both modules have similar but not the same features. Please look at release notes and documentation to make the best choice for your app.
Documentation
Please see
OIDC SSO in the Mendix documentation for details.
Releases
Version: 2.1.1
Framework Version: 9.22.0
Release Notes: This version contains the following:
Library Upgrades:
- org.json:json-20220924 to 20230227
Recommendation:
After upgrading to the latest version, there could be a potential issue due to conflicting Java libraries of the old and the new version.
Hence it is recommended that you delete all Java libraries used by the old OIDC SSO module from the userlib folder of the project before upgrading to the latest version.
Version: 2.1.0
Framework Version: 9.22.0
Release Notes: This version contains the following fixes/improvements:
- Upgraded to Mendix Studio Pro v9.22.0
Version: 2.0.0
Framework Version: 9.12.7
Release Notes: This version contains the following enhancements:
-Added support for authorizing access to a Mendix back-end app using access token
-Simplified the structure for access token parsing microflows('ACT_Token_CustomATPRetrieveRoles' and 'Default SAM processing') and web-callback microflow. This is a ‘breaking change’ for customers that have previously created a custom access token parsing microflow.
-Added introspection of Access Tokens and the introspection endpoint field on OIDC configuration screen
-Added two out-of-the-box microflows for access token parsing (i.e. PIB and AzureAD)
This version contains the following fixes/improvements:
-Improved the conditional check of the 'handleAuthorizationCode' microflow(Ticket#170579)
-Fixed issue related to cookies in Mendix studio pro-9.20(Ticket#173282)
Version: 1.1.1
Framework Version: 9.12.5
Release Notes: This version contains the following fixes/improvements:
- Automatic Redirect to login page of the Client if only one OIDC Client is configured
- Added Mendix logo to the error pages
Library Upgrades:
- Replaced org.json with org.json:json-20220924
- com.fasterxml.jackson.core: jackson-core to 2.14.1
- com.fasterxml.jackson.core: jackson-databind to 2.1.4.1 (Ticket #169884, Ticket #171349)
- com.fasterxml.jackson.core: jackson-annotations to 2.14.1
Recommendation:
After upgrading to the latest version, there could be a potential issue due to conflicting Java libraries of the old and the new version.
Hence it is recommended that you delete all Java libraries used by the old OIDC SSO module from the userlib folder of the project before upgrading to the latest version.
Version: 1.1.0
Framework Version: 9.12.5
Release Notes: This version contains the following fixes/improvements/enhancements:
- Added support for ‘client_secret_basic’ client authentication method. This method should be your preferred choice over using ‘client_secret_post’ for security reasons.
- Removed beta implementation of private_key_jwt client authentication.
- Configuration experience for client authentication is improved because it now enforces mandatory fields: client_id and client_secret.
- Added support for OIDC nonce parameter. Usage of nonce mitigates replay attacks, hence enhances the security of your app.
- Removed PKCE configuration from the UI; instead the OIDC SSO module will automatically detect if your IDP supports PKCE through its well-known endpoint. Hence, your app will apply the security best practice to use PKCE whenever possible.
Library Upgrade (Ticket #152019):
- url-parse package to 1.5.10
- querystringify to 2.2.0