OpenID Connect

FastClose Server supports the OpenID Connect (OIDC) protocol which utilizes OAuth 2.0. If your company uses an external Identity Provider (IDP) such as Microsoft, Google or Okta, then FastClose can also use that IDP to authenticate users.

OIDC Information

FastClose Server uses OIDC just to authenticate users. The FastClose server matches a user based on what is in the the username field. It is matched to the value found in the email claim.

The OIDC flow used is the Authorization Code flow. Response Type requested is code and the scopes should include openid.

Examples of IDP's are:

• Microsoft Entra ID (formerly Azure Active Directory)

• Okta Single sign-on

• Google's OAuth 2.0

Enable OIDC Authentication

On FastClose Server Admin site: Click System → Setup and scroll to the Server Authentication section.

Select External OIDC Provider from the dropdown.

You may visit the Password Override page if you cannot login using SSO Authentication during configuration and setup of new users.

Configure OIDC Authentication

Fill in the following information which will be available from the OIDC Application you created in your IDP.

Authority: Enter the authority URL of your application that provides the OIDC Application. For example, if your well-known endpoint is https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/v2.0/.well-known/openid-configuration then your authority would be

https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/v2.0/

Client ID: The application or client ID of your application.

Client secret: The client secret from your application. This setting is likely required for most IDP's.

Scopes: The OIDC Scopes that are required to access the desired Email Claim. Enter openid email. The openid value is mandatory. The email value is optional; it ensures that the user's email address is automatically available if the username is not the users email address. You can add extra scopes if required here.

Email claim: The name of the Claim to use that holds the users email address (or username). Usually just email . The FastClose server matches the username field to the value in the email claim.

Redirect URL: This value is the Redirect URI that will be used and should be added to your OIDC Provider for your application. It is the external URL (i.e. callback URL) that the IDP will call when returning to FastClose Server after authentication.

Example

Here is an example configuration based on Microsoft Entra ID.

Configuring Microsoft Entra

Below are the example steps required to create an OIDC application in Microsoft Entra ID and configure FastClose Server to use the created application.

Step 1 - Create the Application

Visit Microsoft Entra Admin centre (Microsoft Entra admin center) and select the Enterprise Applications.

Click New application and select Create your own application

Choose a name for your app and select Register an app to integrate with Microsoft Entra ID.

Select Accounts in this organizational directory only and skip the Redirect URI for now.

Click Register.

Select your registered App from the Enterprise Applications page and choose Single sign-on from the menu.

Select go to application.

Note your Client ID as well as your Tenant ID.

Click Endpoints to see your OIDC application endpoints.

Step 2 - Configure the Client Secret and API Permissions

Select App Registrations from the Entra menu. Select All applications. Click on your registered App.

Select Certificate and Secrets from the menu.

Select New client secret

Save the Client Secret Value to a notepad for use later on.

Select API Permissions from the menu.

Update or add to the Microsoft Graph permissions.

You will need to add the permissions: User.Read, email, and openid.

Step 3 - Configure FastClose Server

Visit your FastClose server usually located on port 5101.

Select System → Setup

Under Server Authentication select OIDC Provider and fill in the following information.

Authority: This will be https://login.microsoftonline.com/{Your-Tenant-ID}/v2.0

Client ID: This will be your Application ID

Client Secret: See previous section for value

Scopes: openid email

Email claim: email

Click Test Settings and expect a Success message.

Note down the Redirect URI and click Save.

Step 4 - Add the Redirect URI

In Microsoft Entra ID select your Registered App and click Authentication from the menu.

Click Add a Platform.

Select Web.

Enter the Redirect URI which can be obtained from the previous step.

Select ID tokens and click Configure.

Step 5 - Sign In

Ensure you have a User account configured where the Username field matches the email address scope from Microsoft Entra.

Visit the FastClose Server Admin site and ensure you are logged out. It may be preferable to test this in an Incognito browser window.

Select Sign In

You should be forwarded to https://login.microsoftonline.com/ where you can login to your account.

Enter your credentials to sign in and you should be redirected back to the FastClose Server homepage where you will be signed in.