Set up SSO with OIDC - LiveView

Prerequisites

This article describes the technical configuration of OIDC/SSO for an existing LiveView publication site.

The configuration typically requires collaboration between:

• A server administrator responsible for your 2c8 server
• An administrator of your Identity Provider (for example, Entra ID or AD FS)

Before proceeding, ensure that you:

• Have started creating a LiveView publication site
• Have selected OIDC as the access control method
• Have access to the LiveView server configuration
• Have an Identity Provider that supports OpenID Connect (OIDC)

The feature has been tested with:

• Microsoft Entra ID
• Microsoft Active Directory Federation Services (AD FS)

If you have not yet created a LiveView publication site, first follow the article:

• Create a LiveView publication site

Configure OIDC with Microsoft Entra ID

After selecting OIDC as the access control method, the fields required for OIDC configuration will be displayed.

The values are retrieved from the Microsoft Entra Admin Center. These values are typically provided by your Identity Provider administrator, while the server administrator is responsible for entering them in the 2c8 configuration.

The steps below describe how to obtain the required values from Microsoft Entra.

Create an App Registration in Microsoft Entra ID

1. Sign in to the Microsoft Entra Admin center
2. Go to App registrations
3. Click New registration

Configure the Redirect URI

1. Copy the value from the Callback URL field in the LiveView configuration.
2. In Entra ID, paste the address into the Redirect URI field
3. Click Add

Create a Client Secret

1. Go to:
   Certificates & secrets
2. Click New client secret
3. Enter a name and select an expiration period
4. Click Add
5. Copy the value from the Value field

Important: The value is displayed only once.

Retrieve the Client ID

1. Go to Overview
2. Copy:
   • Application (client) ID
   • Directory (tenant) ID

Configure OIDC in LiveView

Enter the following values in the LiveView configuration:

Enter the Discovery URI

In the Discovery URI field, enter:

https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration

Replace:

<tenant-id>

with your Directory (tenant) ID from Entra ID.

Grant API Permissions

1. Go to API permissions
2. Click Grant admin consent

Manage User Access

1. Go to Enterprise applications
2. Open the application registration
3. Go to Properties

Here you can choose whether to allow all users in your organization or restrict access to specific users or groups.
 

Allow All Users

Set:

Assignment required = No

Restrict Access to Specific Users or Groups

1. Set:
   Assignment required = Yes
2. Go to Users and groups
3. Add the users or groups that should have access
4. Click Save

Complete the Configuration

Once all fields have been completed, you can create or update the LiveView publication site.

Configure OIDC with Microsoft AD FS

After selecting OIDC as the access control method, the fields required for OIDC configuration will be displayed.

The values for these fields are retrieved from Microsoft AD FS. These values are typically provided by your Identity Provider administrator, while the server administrator is responsible for entering them in the 2c8 configuration.

The steps below describe how to obtain the required values.

Prerequisites

Before proceeding, ensure that you have:

• Active Directory Federation Services (AD FS) 2016 or later
• Started creating a LiveView publication site
• Selected OIDC as the access control method in the LiveView configuration

Enter the Discovery URI

In the Discovery URI field, enter:

https://customer.2c8.com/adfs/.well-known/openid-configuration

Create an Application Group in AD FS

1. Open AD FS
   
2. Go to Application Groups
3. Click Add Application Group
   

Select the Application Type

1. Enter a name for the application
2. Select:
   Server application accessing a web API
3. Click Next

Configure the Client ID

1. Copy the value from Client Identifier
2. Paste the value into the Client ID field in the LiveView configuration
3. Click Next
   

Configure the Redirect URI

1. Copy the value from the Callback URL field in the LiveView configuration
   
2. Paste the address into the Redirect URI field in AD FS
   
3. Click Add
4. Click Next

Configure the Client Secret

1. Copy the value from Client secret
2. Paste the value into the Client Secret field in the LiveView configuration
   
3. Click Next

Configure the Web API

The Identifier field must contain a value.

1. Enter any valid value
   
2. Click Add
3. Click Next
    

Select an Access Control Policy

1. Choose which Access Control Policy should be used.
   The policy determines which users are allowed to access the publication.
   
2. Click Next

Select Permissions

1. Under Application Permissions, select:
   • email
   • openid
2. Complete the wizard
   

Complete the Configuration

1. Return to the LiveView configuration
2. Verify that all OIDC fields have been completed
3. Click Update

The OIDC/SSO configuration is now complete.