Configuring OIDC Single Sign-on

Create OIDC directory in MetaDefender Core

1. Sign in to MetaDefender Core.
2. In the dashboard, click on User Management in the left sidebar.
3. On User Management page, select Directories tab and click Add Directory in the top right corner.

4. In Add Directory page, select OIDC as Directory type, and enter a name for the new directory, such as MDCore-OIDC.
5. Enter Host or IP where MetaDefender Core is hosted, for this example use https://127.0.0.1:8008.
6. Copy the string generated under Login URL and store it as reply_uri.

Create and configure OIDC application in PingOne

1. In the PingOne Overview page, navigate to Connections on the sidebar.

2. Click the plus button to add a new application.

3. Enter the application name, MDCore-OIDC as an example, choose OIDC Web App for Application Type, and click Save.

4. Select Configuration tab, then click Edit button.

5. In Edit Configuration page, navigate to Redirect URIs, paste redirect_uri into the box below, and then click Save.

6. Back in Configuration tab, navigate to OIDC Discovery Endpoint, copy the link below, and save it as metadata_url.

7. Expand General section, navigate to Client ID and Client Secret, and copy and save them as client_id and client_secret, respectively.

8. Select Attribute Mappings tab and click Edit button.

9. In Edit Attribute Mappings page, click Add to create a new mapping.

10. Enter the attribute name, given_name in this example, select the item Given Name in PingOne Mappings, enable Required option , and click Save to complete.

11. Enable the new application in PingOne.

Complete configuration in MetaDefender Core

1. Switch back to MetaDefender Core. Under Identity Provider, click Fetch URL, paste value of metadata_url into the box below, click OK, and wait a moment for MetaDefender Core to check and set PingOne as its IdP.

2. Under Service Provider, paste the values of client_id and client_secret into the boxes labeled Client ID and Client Secret, respectively.
3. Fill in ${given_name} in the box under User Identified By.
4. Select Default role option, choose the appropriate role to assign to users under User Role, and click Add to complete the settings in MetaDefender Core.

5. On User Management page, toggle the new directory, MDCORE-OIDC in this example. A dialog box will appear to confirm the action. Once Enable is clicked, all sessions will expire immediately.

Test the integration

1. On the home screen of MetaDefender Core, click Login; the user is redirected to PingIdentity login page.

2. Sign in using the account registered with PingIdentity.
3. If everything goes well, MetaDefender Core dashboard is displayed with the user identity in the top right corner.

4. Otherwise, access backup login page at <mdcore-host>#/public/backuplogin for trouble shooting.