Using remote authentication
You can create a remote configuration file, cse-configuration, to share your authentication credentials with external collaborators. This file must be in a directory /.well-known/, located at the root of the domain (https://cse.${domain}/.well-known/). It makes it possible to verify the signature of the user's token and indicate which identity providers to use.
The remote file will be looked up if the user_authentication section in the config.json file is not filled in. It is retrieved during authentication via the URL:
https://cse.${domain_from_email_from_token}/.well-known/cse-configuration
This is a fixed URL. Ensure that it can be reached by using the Stormshield KMaaS.
NOTE
For security reasons, the routes privilegedwrap, privilegedunwrap, privilegedprivatekeydecrypt, and wrapprivatekey are not allowed for remote authentication.
For more information, refer to the Google documentation Connect to identity provider for client-side encryption website.
To create the remote authentication file:
- Create a file named cse-configuration. Its contents are as follows:
{
"name": "_IDP_NAME_",
"client_id": "_AUTHENTICATION_AUDIENCE_",
"discovery_uri": "_AUTHENTICATION_OPEN_ID_CONFIGURATION_URL_",
"grant_type": "_GRANT_TYPE_"
}
| Parameter | Description | Type | Authorized values | Optional/ mandatory |
|---|---|---|---|---|
| name | Name of the identity provider. | String | Optional | |
| client_id | OIDC (OpenID Connect) client ID that the client application uses to get a JWT. | String | Mandatory | |
| discovery_uri | OIDC discovery URL, as defined in the OpenID specification. | String | Mandatory | |
| grant_type | OAuth traffic used for OIDC | String | implicit | authorization_code | Optional |
If you use the Google identity provider, the values of the authentication settings are as follows:
{
"name": https://accounts.google.com
"client_id": "37*********",
"discovery_uri": "https://accounts.google.com/.well-known/openid-configuration"
}