Name: OIDC: Setting Up OP Initial Steps in SAP Customer Data Cloud
Uploaded: 2019-7-2
Duration: 217 s
Description: In this video you will learn Open ID Provider (OP) setup. Starting with setting up Proxy Page, Login Page, Consent Page, Error Page and then configuration in CDC Console.For more details visit SAP Customer Data Cloud documentation page: https://developers.gigya.com/display/GD/OpenID+Provider+SetupClick here to visit the SAP Customer Data Cloud Community Page.

Share feedback

<p><u><strong>Planned maintenance of Practice Systems</strong></u></p>

Planned maintenance of Practice Systems

Why create an SAP account?

Enhance your learning experience

SAP Learning

Choose your subscription

Manage your subscription

Live Sessions

Hands-on Practice

Certification

My Learning

Ready to start learning?

<div><div><div><div><div><div><div><div><div>In this video you will learn Open ID Provider (OP) setup. Starting with setting up Proxy Page, Login Page, Consent Page, Error Page and then configuration in CDC Console.<br><br>For more details visit SAP Customer Data Cloud documentation page: <br><a href="https://developers.gigya.com/display/GD/OpenID+Provider+Setup" rel="nofollow noopener noreferrer" target="_blank">https://developers.gigya.com/display/GD/OpenID+Provider+Setup</a><br><br>Click <a href="https://www.sap.com/community/topics/customer-data-cloud.html" rel="nofollow noopener noreferrer" target="_blank">here</a> to visit the SAP Customer Data Cloud Community Page.<br></div></div></div></div></div></div></div></div></div>

OIDC: Setting Up OP Initial Steps in SAP Customer Data Cloud

Welcome to the open ID  provider initial setup video. During this session, we will go through the initial setup of CDC as an OP. To start, when an authentication request is triggered, the user is first redirected to the proxy page. The role of the proxy page is to orchestrate the authentication flow  and redirect to the appropriate OP pages as required.  The proxy page loads the OIDC SDK and defines the URLs for the login consent and error pages.  If no session exists at the time the authentication request is triggered,  then the proxy page redirects the user to the login page, where the user will authenticate. First, the login page loads the web SDK in order to orchestrate the login flow, then loads the login and registration forms.  The recommended approach is to use screen sets in order to take advantage of out-of-the-box features.  Alternatively, you can create your own registration and login forms and call to CDC Rest endpoints directly.  Finally, it defines the on login handler and redirects the user to the proxy page once the user has completed the log on.  This completes the authentication flow. Once the user has successfully authenticated, the user needs to authorize the scopes which have been requested by the RP.  This is done via the consent page. The user has the option to select a subset or all of the requested scopes.  The consent page uses the server SDK in order to make the encryption methods available to the page,  then reads the URL parameters such as client ID, scope, and context  in order to generate the consent object and construct the signature.  Finally, on consent approval, the signed consent object is transferred to the proxy page.  Anything leading to an error during the flow, such as a wrongly signed consent or a provider issue, redirects the user to the error page.  Otherwise, the requested tokens are sent back to the RP.  The error page displays the potential error by retrieving the details from the URL parameters.  That completes the configuration of the OP pages.  The next step is to create the OP in CDC via the console.  First, complete the basic configuration by adding the URL to the proxy page.  This is the link to the hosted proxy page created earlier  and optionally add the issuer. If defined, the issuer will be added to the ID token.  Then CDC offers the ability to define custom scopes, which can be requested during the authorization, as well as custom claims which can be added to the user info or ID token based on the granted scopes.  A scope may contain multiple claims. This is a space to limited field. The OP metadata can be retrieved and shared with the RP.  Finally, the RP needs to be defined. Each RP can have their own definition. The client ID and secret needs to be shared with the RP, so the OP token endpoint can be used.  There is the option to control the supported response type, i.e. the token, ID token and code. This allows control over which flows are supported. Auth code, Implicit or hybrid. The subject or user identifier can be either an identifier specific to the RP or shared across all RPs.  The token lifetime can also be defined. Finally, only the URIs defined here are valid Redirect URIs to the authorization endpoint.