SSO OIDC (OpenID Connect)

The OIDC protocol is the modern authentication standard. Anjana Data allows you to configure multiple providers simultaneously via security.authentication.oidc.

1. Redirect URL (Callback / Redirect URI)

For the integration to work, it is critical to correctly register the return URL in your Identity Provider. This is the address the provider will send the user to after authenticating.

The URL is built following this pattern: https://{dominio-anjana}/gateway/oidc2/sso/{registrationId}

• dominio-anjana: Your public domain (e.g.: app.midominio.com).

• registrationId: The exact key you use in the YAML to define the provider.

Example: If you configure a provider with the key google in the YAML, the URL to register in the Google console will be: https://app.midominio.com/gateway/oidc2/sso/google

2. Configuration properties

Each OIDC provider is configured in security.authentication.oidc.providers.<registrationId>, where <registrationId> is a unique internal name (e.g.: google, okta-corp).

3. Configuration by provider

Below are the steps to obtain credentials and the configuration example for the main providers.

Base YAML structure

security:
  authentication:
    oidc:
      # (Optional) Customize paths if needed
      # authenticate-path: /authenticate 
      # redirection-base-uri: /sso/{registrationId}
      providers:
        # Add the specific providers here

A. AWS Cognito

Use this type if your identity management resides in Amazon Cognito User Pools.

Step 1: Obtaining data in the AWS Console

1. Go to Amazon Cognito > User Pools and select your User Pool.

2. Issuer URI: Format: https://cognito-idp.<region>.amazonaws.com/<user_pool_id>

3. Go to the App integration tab.

4. In App client list, create or select a client. Copy the Client ID and Client Secret.

5. Allowed Callback URLs: Add Anjana's return URL: https://<dominio-anjana>/gateway/oidc2/sso/aws-pool

Step 2: YAML configuration

security:
  authentication:
    oidc:
      providers:
        aws-pool:
          name: AWS Login
          type: AWS
          issuer-uri: https://cognito-idp.eu-west-1.amazonaws.com/eu-west-1_Example
          client-id: "1234567890abcdef"
          client-secret: "secret-key-from-aws..."
          # default scopes for type AWS: [openid, profile]
          # default username-attribute for type AWS: cognito:username

B. Okta

For organizations using Okta Identity Cloud.

Step 1: Obtaining data in Okta Admin

1. Go to Applications > Create App Integration (OIDC - Web Application).

2. Sign-in redirect URIs: Add the URL ending with the provider's key (e.g. okta-corp): https://<dominio-anjana>/gateway/oidc2/sso/okta-corp

3. Copy the Client ID and Client Secret.

4. Issuer URI: Usually https://<su-org>.okta.com.

Step 2: YAML configuration

security:
  authentication:
    oidc:
      providers:
        okta-corp:
          name: Okta Corporate
          type: OKTA
          issuer-uri: https://dev-123456.okta.com
          client-id: "0oa..."
          client-secret: "secret..."
          # default scopes: [openid, profile, email]
          # default username-attribute for type OKTA: preferred_username

C. Auth0

For integrations with Auth0.

Step 1: Obtaining data in the Auth0 Dashboard

1. Create a Regular Web App.

2. Settings: Copy the Domain (this will be your Issuer URI), Client ID, and Client Secret.

3. Allowed Callback URLs: Add the URL ending with the key (e.g. auth0-login): https://<dominio-anjana>/gateway/oidc2/sso/auth0-login

Step 2: YAML configuration

security:
  authentication:
    oidc:
      providers:
        auth0-login:
          name: Auth0 Access
          type: AUTH0
          issuer-uri: https://mi-tenant.eu.auth0.com/
          client-id: "A1b2C3d4..."
          client-secret: "secret..."
          # default scopes: [openid, profile, email]
          # default username-attribute for type AUTH0: email

D. Microsoft Azure AD (Entra ID)

For Microsoft 365 / Azure users.

Step 1: Obtaining data in the Azure Portal

1. App registrations > New registration.

2. Redirect URI (Web): https://<dominio-anjana>/gateway/oidc2/sso/azure-oidc

3. Copy the Application (client) ID and Directory (tenant) ID.

4. Generate a Client secret and copy the value.

5. Issuer URI: https://login.microsoftonline.com/<tenant-id>/v2.0

Step 2: YAML configuration

security:
  authentication:
    oidc:
      providers:
        azure-oidc:
          name: Microsoft Login
          type: AZURE
          issuer-uri: https://login.microsoftonline.com/8888-9999-aaaa-bbbb/v2.0
          client-id: "client-id-uuid"
          client-secret: "client-secret-value"
          # default scopes: [openid, profile, email]
          # default username-attribute for type AZURE: email

E. Google

For Google Workspace or Cloud Identity accounts.

Step 1: Obtaining data in the Google Cloud Console

1. Credentials > OAuth client ID > Web application.

2. Authorized redirect URIs: https://<dominio-anjana>/gateway/oidc2/sso/google

3. Copy the Client ID and Client Secret.

4. Issuer URI: https://accounts.google.com

Step 2: YAML configuration

security:
  authentication:
    oidc:
      providers:
        google:
          name: Google Workspace
          type: GOOGLE
          issuer-uri: https://accounts.google.com
          client-id: "123456-abc.apps.googleusercontent.com"
          client-secret: "GOCSPX-..."
          # default scopes: [openid, profile, email]
          # default username-attribute for type GOOGLE: email

F. Keycloak

For organizations using Keycloak as an identity and access server.

Step 1: Configuration in the Keycloak Admin Console

1. Access Keycloak's Admin Console and select the corresponding realm.

2. In Clients > Create client:

   • Client type: OpenID Connect

   • Client ID: Define a name, e.g. anjana-oidc

3. In the Settings tab:

   • Client authentication: ON (confidential mode, required to obtain the client-secret)

   • Valid redirect URIs: https://<dominio-anjana>/gateway/oidc2/sso/keycloak-corp

4. In the Credentials tab, copy the Client Secret.

5. Issuer URI: https://<keycloak-server>/realms/<realm> (verify that /.well-known/openid-configuration is accessible from Anjana).

Step 2: YAML configuration

security:
  authentication:
    oidc:
      providers:
        keycloak-corp:
          name: Keycloak Login
          type: KEYCLOAK
          issuer-uri: https://sso.mi-dominio.com/realms/mi-realm
          client-id: "anjana-oidc"
          client-secret: "secret-uuid..."
          # default scopes for type KEYCLOAK: [openid, profile, email]
          # default username-attribute for type KEYCLOAK: preferred_username

G. Generic provider (ADFS, Shibboleth, others)

For any other OIDC-compatible provider not listed above (for example: Active Directory Federation Services, Shibboleth, PingFederate).

Step 1: Required data

• Base server URL (Issuer URI) with the /.well-known/openid-configuration endpoint accessible from Anjana.

• Register a confidential OIDC client with the Redirect URI: https://<dominio-anjana>/gateway/oidc2/sso/mi-proveedor

Step 2: YAML configuration

security:
  authentication:
    oidc:
      providers:
        mi-proveedor:
          name: Login Corporativo
          type: OTHER
          issuer-uri: https://sso.mi-empresa.com
          client-id: "anjana-client"
          client-secret: "secret-uuid..."
          # default scopes: [openid, profile, email]
          # default username-attribute for type OTHER: preferred_username