| Id |
A string containing the Keyfactor Command reference GUID for the identity provider. |
| Authentication Scheme |
A string indicating the authentication scheme (name) for the identity provider. This must be a unique value among identity providers. |
| Display Name |
A string indicating the display name for the identity provider. This must be a unique value among identity providers. |
| TypeId |
A string indicating the Keyfactor Command reference GUID for the type of identity provider. Possible values include:
-
DFB94650-E4EB-402A- B807-4F3CC91F712D (Active Directory)
-
F96B6464-11B7-4499- BEA7-B5AA6BA1571D (Generic—select this for Keyfactor Identity Provider)
-
5AA04122-CD7C-48BA- AC11-F39E30AE8720 (Auth0)
|
| Parameters |
An array of objects containing information for each parameter set for the identity provider.  Show parameter details.
Each parameter (Table 453: Identity Provider Parameters) contains the data shown in Table 456: Identity Provider Response Parameter Structure.
Table 455: Identity Provider Parameters
|
OIDC Audience
|
1 - String |
Command- OIDC- Client |
The audience value for the identity provider.
For Keyfactor Identity Provider, this should be set to the same value as the Client Id. For example:
Command- OIDC- Client
This parameter is required.
|
|
Auth0 API URL
|
1 - String |
|
The unique identifier defined in Auth0 or a similar identity provider for the API.
This parameter only appears if Auth0 is selected as the type and is required in that case.
|
| Authority |
1 - String |
https:// my-keyidp-server .keyexample.com /realms /Keyfactor |
The issuer/authority endpoint URL for the identity provider.
For Keyfactor Identity Provider, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation). It is automatically returned by the Discovery Document Endpoint Fetch step. Review it to confirm that it appears correct.
This parameter is required.
Tip: When you add or update an identity provider, the provider’s discovery document is validated based on this authority URL. The discovery document is also validated periodically in the background. The following are validated:
That the discovery document is reachable using the Authority value provided and can be parsed into a valid discovery document. That the Authority URL matches the Issuer returned in the discovery document. That all the URLs on the discovery document are using HTTPS. That the JSONWebKeySetUri value is included on the discovery document. That any endpoint configuration values (Authorization Endpoint, Token Endpoint, UserInfo Endpoint, JSONWebKeySetUri) that have been saved or are being saved match—including case—the values returned in the discovery document. The UserInfo Endpoint is not a required configuration field, but if a value is provided, it must match what’s in the discovery document.
If any of these validation tests fail, any identity provider changes in process will not be saved and an error will be displayed or logged.
|
|
Authorization Endpoint
|
1 - String |
https:// my-keyidp-server .keyexample.com /realms /Keyfactor /protocol /openid-connect /auth |
The authorization endpoint URL for the identity provider.
For Keyfactor Identity Provider, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation). It is automatically returned by the Discovery Document Endpoint Fetch step. Review it to confirm that it appears correct.
This parameter is required.
|
|
Client Id
|
1 - String |
Command- OIDC- Client |
The ID of the client application created in the identity provider for primary application use.
For Keyfactor Identity Provider, this should be:
Command- OIDC- Client
For more information, see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation).
This parameter is required.
|
|
Client Secret
|
2 - Secret |
|
The secret for the client application created in the identity provider for primary application use.
For Keyfactor Identity Provider, see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation for help locating this. It is automatically returned by the Discovery Document Endpoint Fetch step. Review it to confirm that it appears correct.
Supported methods to store secret information are:
-
Store the secret information in the Keyfactor secrets table.
A Keyfactor secret is a user-defined username or password that is encrypted and stored securely in the Keyfactor Command database.
-
Load the secret information from a PAM provider.
See Privileged Access Management (PAM) for more information.
| Secret Value |
A string containing the secret. This parameter is used when PAM is not used as the storage location.
|
| Parameters |
An object indicating the parameters to supply for PAM authentication. These will vary depending on the PAM provider. |
| Provider |
A string indicating the ID of the PAM provider.
Use the GET /PamProviders method (see GET PAM Providers) to retrieve a list of all the PAM providers to determine the ID.
|
For example, a username stored as a Keyfactor secret will look like:
Copy
{
"SecretValue": "KEYEXAMPLE\svc_MyServiceName"
}
For example, a password stored as a Keyfactor secret will look like:
Copy
{
"SecretValue": "MySuperSecretPassword"
}
A secret stored as a CyberArk PAM secret will look like (where the Provider value—1 in this example—is the Id value from GET PAM Providers and the Safe, Folder, and Object reference the information in the CyberArk safe needed for this record):
Copy
{
"Provider": "1",
"Parameters":{
"Safe":"MySafeName",
"Folder":"MyFolderName",
"Object":"MyObjectName"
}
}
A secret stored as a Delinea PAM secret will look like (where the Provider value—2 in this example—is the Id value from GET PAM Providers and the SecretId and SecretFieldName contain the information created in the Delinea secret server for this purpose):
Copy
{
"Provider": "2",
"Parameters":{
"SecretId":"MyId"
"SecretFieldName":"MyReferenceName"
}
}
This parameter is required.
|
|
Discovery Document Endpoint
|
1 - String |
https:// my-keyidp-server .keyexample.com /realms /Keyfactor /.well-known /openid-configuration |
The discovery URL for the identity provider.
For Keyfactor Identity Provider, this is the link to the OpenID Endpoint Configuration page, which can be found on the Realm Settings page (see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation). Populate this value and click Fetch to populate the remainder of the fields in this section, if desired.
If you opt not to populate this field or if the discovery document does not return a valid response, the remainder of the fields in this section of the configuration will need to be configured manually. This value is not stored in the database.
This field does not appear in the Management Portal identity provider configuration.
|
|
Fallback Unique Claim Type
|
1 - String |
cid |
A backup value used to reference the type of claim used for users in the identity provider in case the primary referenced name does not contain a value. This parameter is required. |
|
JSON Web Key Set Uri
|
1 - String |
https:// my-keyidp-server .keyexample.com /realms /Keyfactor /protocol /openid-connect /certs |
The JWKS (JSON Web Key Set) URL for the identity provider.
For Keyfactor Identity Provider, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation). It is automatically returned by the Discovery Document Endpoint Fetch step. Review it to confirm that it appears correct.
This parameter is required.
|
|
Name Claim Type
|
1 - String |
preferred_ username |
The name used to reference the type of user claim for the identity provider.
For Keyfactor Identity Provider, this should be:
preferred_ username
This parameter is required.
|
|
Role Claim Type
|
1 - String |
groups |
The value used to reference the type of group claim for the identity provider.
For Keyfactor Identity Provider, this should be:
groups
This parameter is required.
|
|
OIDC Scope
|
1 - String |
|
One or more scopes that are requested during the OIDC protocol when Keyfactor Command is the relying party. Multiple scopes should be separated by spaces.
This value is not used for Keyfactor Identity Provider.
|
|
SignOut URL
|
1 -String |
https:// my-auth0-instance .us.auth0.com /oidc/logout |
The signout URL for the identity provider.
This parameter only appears if Auth0 is selected as the type and is required in that case.
|
| Timeout |
1 - String |
60 |
The number of seconds a request to the identity provider is allowed to process before timing out with an error. |
|
Token Audience
|
1 - String |
|
An audience value to be included in token requests delivered to the identity provider when making a token request where Keyfactor Command is acting as the OAuth client.
This value is not used for Keyfactor Identity Provider.
|
|
Token Endpoint
|
1 - String |
https:// my-keyidp-server .keyexample.com /realms /Keyfactor /protocol /openid-connect /token |
The token endpoint URL for the identity provider.
For Keyfactor Identity Provider, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation). It is automatically returned by the Discovery Document Endpoint Fetch step. Review it to confirm that it appears correct.
This parameter is required.
|
|
Token Scope
|
1 - String |
|
One or more scopes that should be included in token requests delivered to the identity provider when making a token request where Keyfactor Command is acting as the OAuth client. Multiple scopes should be separated by spaces.
This value is not used for Keyfactor Identity Provider.
|
|
Unique Claim Type
|
1 - String |
sub |
The value used to reference the type of claim used for users in the identity provider. For Keyfactor Identity Provider, this should be (for subject): sub This parameter is required. |
|
User Info Endpoint
|
1 - String |
https:// my-keyidp-server .keyexample.com /realms /Keyfactor /protocol /openid-connect /certs |
The user info endpoint URL for the identity provider.
For Keyfactor Identity Provider, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation). It is automatically returned by the Discovery Document Endpoint Fetch step. Review it to confirm that it appears correct.
|
Table 456: Identity Provider Response Parameter Structure
| Id |
An integer indicating the Keyfactor Command reference ID for the parameter. |
| Name |
A string indicating the short reference name for the parameter (e.g. NameClaimType). |
| Display Name |
A string indicating the display name for the parameter (e.g. Name Claim Type). |
| Required |
A Boolean indicating whether the parameter is required (true) or not (false). |
| Data Type |
An integer indicating the data type for the parameter. Possible values are:
-
1 - String
-
2 - Secret
-
3 - Boolean
|
| Value |
A string indicating the value set for the parameter, for parameters of type 1 or 3. |
| Secret Value |
A string indicating the value set for the parameter, for parameters of type 2.
Due to its sensitive nature, this value is not returned in responses.
|
|
) at the top of the Management Portal page next to the Log Out button.