OIDC SSO

Category: Modules

Subcategory: Authentication

Overview

Use this module to implement single sign-on to your Mendix app using an OpenID Connect (OIDC) compliant identity provider (IDP). It supports ‘normal’ Mendix apps (i.e. responsive browser-based applications) and doesn’t yet support native or hybrid mobile apps. Tested against AWS Cognito, Google, Salesforce, Apple, Okta, Ping, and Microsoft, this module manages the end-to-end SSO workflow when working with an OIDC IDP. The IDP will relieve your app from logging in your end-users and optionally will also decide which roles the user gets assigned in your app, using mechanism from the OAuth protocol.

Simply provide configuration details, decide how you'd like to provision users, and log in!

You can use this module if your app is on Mendix 9 or later. If your app is using a previous Mendix version, you would have to upgrade your app or use the similar “OpenIDConnect Single Sign-on (OIDC, OAuth2, SSO)” module, which has community support. Both modules have similar but not the same features. Please look at release notes and documentation to make the best choice for your app.

Documentation

Please see OIDC SSO in the Mendix documentation for details.

Releases

Version: 2.1.0

Framework Version: 9.22.0

Release Notes: This version contains the following fixes/improvements: - Upgraded to Mendix Studio Pro v9.22.0

Version: 2.0.0

Framework Version: 9.12.7

Release Notes: This version contains the following enhancements: -Added support for authorizing access to a Mendix back-end app using access token -Simplified the structure for access token parsing microflows('ACT_Token_CustomATPRetrieveRoles' and 'Default SAM processing') and web-callback microflow. This is a ‘breaking change’ for customers that have previously created a custom access token parsing microflow. -Added introspection of Access Tokens and the introspection endpoint field on OIDC configuration screen -Added two out-of-the-box microflows for access token parsing (i.e. PIB and AzureAD) This version contains the following fixes/improvements: -Improved the conditional check of the 'handleAuthorizationCode' microflow(Ticket#170579) -Fixed issue related to cookies in Mendix studio pro-9.20(Ticket#173282)

Version: 1.1.1

Framework Version: 9.12.5

Release Notes: This version contains the following fixes/improvements: - Automatic Redirect to login page of the Client if only one OIDC Client is configured - Added Mendix logo to the error pages Library Upgrades: - Replaced org.json with org.json:json-20220924 - com.fasterxml.jackson.core: jackson-core to 2.14.1 - com.fasterxml.jackson.core: jackson-databind to 2.1.4.1 (Ticket #169884, Ticket #171349) - com.fasterxml.jackson.core: jackson-annotations to 2.14.1 Recommendation: After upgrading to the latest version, there could be a potential issue due to conflicting Java libraries of the old and the new version. Hence it is recommended that you delete all Java libraries used by the old OIDC SSO module from the userlib folder of the project before upgrading to the latest version.

Version: 1.1.0

Framework Version: 9.12.5

Release Notes: This version contains the following fixes/improvements/enhancements: - Added support for ‘client_secret_basic’ client authentication method. This method should be your preferred choice over using ‘client_secret_post’ for security reasons. - Removed beta implementation of private_key_jwt client authentication. - Configuration experience for client authentication is improved because it now enforces mandatory fields: client_id and client_secret. - Added support for OIDC nonce parameter. Usage of nonce mitigates replay attacks, hence enhances the security of your app. - Removed PKCE configuration from the UI; instead the OIDC SSO module will automatically detect if your IDP supports PKCE through its well-known endpoint. Hence, your app will apply the security best practice to use PKCE whenever possible. Library Upgrade (Ticket #152019): - url-parse package to 1.5.10 - querystringify to 2.2.0

Version: 1.0.1

Framework Version: 9.8.1

Release Notes: This version contains the following fixes/improvements: - Fixed unintended behaviour issue w.r.t logout Library Upgrades: - com.fasterxml.jackson.core: jackson-databind to version 2.13.3 (Ticket #150849) - com.fasterxml.jackson.core: jackson- annotations to version 2.13.3 (Ticket #150849) - com.fasterxml.jackson.core: jackson- core to version 2.13.3 (Ticket #150849) Recommendation: After upgrading to the latest version, there could be a potential issue due to conflicting Java libraries of the old and the new version. Hence it is recommended that you delete all Java libraries used by the old “OIDC SSO” module from the userlib folder of the project before upgrading to the latest version.