Configure OAuth 2.0 | Rinami Knowledge Garden

Overview

Use this guide to configure OAuth 2.0 in Cantara.

This page covers the shared OAuth 2.0 setup required when Cantara uses an Identity Provider (IdP) for authentication. Complete these steps to register the application in your IdP and record the OAuth 2.0 values needed for the Cantara setup you are completing.

If you are following another setup guide, complete the steps here first, then return to that guide.

Before you begin

You have access to your IdP administration settings.
You have the required access or information to complete the configuration for your selected Security Provider.
You can register an application and record the OAuth 2.0 values required by Cantara.

Step 1: Register an application in your Identity Provider

Purpose

To register an application in your IdP that allows Cantara to connect with your IdP for user authentication. This process will generate the necessary credentials, such as the Client ID and Client Secret, which are essential for configuring OAuth 2.0 in Cantara.

Procedure

Note: For exact steps on how to register an application in your IdP, see your IdP documentation.

Register a new application in your IdP.
Provide a name for the application.
Set the redirect URL to:
https://console.cantara.cloud/oauth
Save the application. This will generate a Client ID.
Create a Client Secret and store it securely.

Copy and securely store the Client Secret immediately, as it may only be displayed once.

Enable refresh tokens if they are required for your OAuth 2.0 flow.

Step 2: Configure OAuth 2.0 in Cantara

Procedure

To configure OAuth 2.0 in Cantara:

Complete the following fields:

Field	Value / Setting
Authentication Method	Select the authentication method that matches your IdP configuration. Defaults to `client_secret_post`.
Client ID	The OAuth 2.0 client identifier generated by the IdP.
Client Secret	The OAuth 2.0 client secret generated by the IdP.
Authentication URL	The OAuth 2.0 authorisation endpoint.
Access Token URL	The OAuth 2.0 token endpoint.
Redirect URL	Use `https://console.cantara.cloud/oauth`. This must match the redirect URI registered in the IdP application.
JSON Web Key Set URL	The JWKS URL used for token validation.
Username Attribute	Identifies the signed-in user. Cantara can also use this value when logging in to JDE unless the service account settings override it. `preferred_username` or `email` (Needs to be the key for the claim returned from either access or ID token). Recommendation: Use long usernames where the JD Edwards username matches the IdP username (typically email). If short usernames are used, additional token configuration is required in the IdP.
Display Name Attribute	The display name for the logged in user.
Authorisation Grant Type	Defines the OAuth 2.0 flow used to request and receive tokens from the IdP. Select from the drop-down list. Authorization Code Client Credentials

Additional OAuth 2.0 fields

The following fields are supported by Cantara and may be required depending on your IdP configuration. Refer to your IdP settings to determine which fields apply to your setup.

Field	Value / Setting
Issuer URI	The issuer URI for the OAuth 2.0 provider.
User Info URL	The URL used to retrieve user information from the provider.
Secure JWKS URL	Enables the secure URL for the provider's JSON Web Key Set.
Logout URL	The URL used to log users out of the provider.
Resource	The resource identifier requested from the provider.
Audience	The intended audience for issued tokens.
Scopes (spaces or comma separated)	The scopes requested from the provider, separated by spaces or commas.
Provider Display Name	The display name shown for this IdP.
PKCE Enabled	Enables Proof Key for Code Exchange (PKCE) for additional security.

First-Time User Prompt

Users may be prompted to consent to sharing basic profile information during their first login. In some IdPs, administrators can grant consent on behalf of users. This behaviour varies depending on configuration.

What’s next?

After you have completed the OAuth 2.0 configuration, return to the setup guide you were following and continue with the remaining setup steps.