OpenID Connect provider

By using the authentication/authorization method, based on the OpenID Connect protocol, (OIDC) ID you can:

  • Manage your accounts from a central location: your identity provider's directory, .
  • Monitor who can access the SNS firewall web administration interface,
  • Monitor which users/user groups are allowed to authenticate over the SNS firewall's captive portal using their identity provider accounts,
  • Monitor which users are allowed to connect to the SSL VPN with their identity provider accounts.

This module allows you to:

  • Configure your firewall through a wizard, to use the OIDC method, based on the settings of your directory with the identity provider.
  • Show/edit the configuration of the OIDC method once it is available on the firewall.

Showing/editing the configuration of the OIDC method

OpenID Connect/Microsoft Entra ID

Domain name

This is the main domain name as shown in the configuration center of your Microsoft Entra ID tenant (e.g., snsdoc.onmicrosoft.com).
Identity provider description

Enter the description of your identity provider. You can, for example, indicate the name of the provider: this string will automatically be added to the title of the configuration window.

EXAMPLE
If you enter "My OIDC Provider" in this field, the title of the window will then become "OpenID Connect/My OIDC Provider".

Information about the SNS application on your Open ID Connect tenant:

URL of the Open ID service (Issuer ID)

This URL has the following format: https://login.microsoftonline.com/<tenant ID>/ v2.0.

The <tenant ID> value can be looked up in the configuration center overview of your Microsoft Entra ID tenant (Identity).
Application ID (client). This value can be viewed in the properties of your SNS application, in the configuration center of your Microsoft Entra ID tenant.
Client secret This secret was defined when creating your SNS application, in the configuration center of your Microsoft Entra ID tenant.
Certification authority Select the certification authority of the identity provider whose certificate you would have retrieved earlier, and that you would have imported into the firewall’s Certificates and PKI module.

Service URL

This box shows the redirection URLs that you need to enter in the configuration of your application with the identity provider.

Captive portal

URL generated from the parameters regarding redirection to the captive portal (Configuration > General configuration tab > Advanced configuration section).
SSL VPN URL generated from the public IP address or FQDN entered in the firewall's SSL VPN configuration (VPN > SSL VPN).
Web administration interface URL generated from the name of the firewall (Configuration > General configuration tab > General configuration section).
Force re-authentication if the provider's session exceeds the following duration:

You can change the duration after which an Entra ID session has to be re-authenticated: this Maximum duration of a Microsoft Entra ID session is expressed in days and hours (default value proposed when configuring Microsoft Entra ID on the firewall: 1 day)

Use the Test the configuration button to check whether the information entered is accurate.