> For the complete documentation index, see [llms.txt](https://community-test.logicnets.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://community-test.logicnets.com/release-9/platform-documentation/system-administration/authentication-and-authorization/configuring-idp-in-access-management.md).

# Configuring IdP in Access Management

With v8.4, LogicNets provides a wizard to help you configure the access authentication information in the *settings.cfg* file. To use this wizard, go to the *Access Management* function on your LogicNets dashboard.

From *Access Management,* click the ***Server Connections*** icon, which is shown above, and select the *Identify Providers* sub-option. This takes you to a screen summarizing your current applied IdP configurations, which can include the following:

* Configuration applied to the instance: This is the root URL, it is read-only, and you can only change it by directly editing the *config.sys* file at the instance level (*../logicnets/dat/*).
* Configuration for Admins only: This is only visible when you use the *\_admin* suffix to the launch URL.
* Configuration for all users: This is visible on the general logon screen.

### Create a New Configuration

You can view, edit, or delete any configuration that is not read-only, and the following screenshots show the steps you can take to create a new configuration.

1. Enter the URL. The system validates this field against known formats.
2. Using the *Purpose* dropdown menu, specify if the IdP applies to the common logon page or to a specific package or category.

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-f77dcbb4a1b9ea4dabbaa13882b21235abb5ca58%2Fa1ed387d-e367-4117-a39c-356366234757.png?alt=media)
3. Record the Client ID/Client Secret from your IdP's configuration page.

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-933f72d194099ccc46915b64fa404060f88c6cb4%2F8554f3e2-e09c-41b0-9b2c-5c4f259a6338.png?alt=media)

   Note that there are various assertion types, including the following:

   * **Plain text (Shared Secrets):** With this type, both the Identity Provider and the Client share and the same secret, which is typically generated by the Identity Provider.
   * **JWT Bearer:** With this type of assertion, the system uses a signed JWT token for authenticating the IdP Client using a static set consisting of a Public and Private key. The private key is stored at the IdP Client and the public key is stored at the Identity Provider. The LogicNets system only supports RS256 keys, and there are different tools available for generating a RS256 public/private key set. LogicNets' AccessManagement supports generating such a set when a server user is created.
   * **JSON Web Key Set:** With this type, a signed JWT token is used for authenticating the IdP Client using rotating keys that are generated by the IdP Client. Both the private and public key are stored at the IdP client, and the IdP client must offer a publicly available URL endpoint that exposes all public keys. The Identity Provider must configure this endpoint, use that endpoint to get the latest public key, and verify the JWT signature using that key.
4. Test the configuration and review any errors if they appear.

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-028eda3a73c785aa07246a342c4e0dd8d4b95eee%2F385f830a-fd1c-47c0-8557-d6eb6a8f62d5.png?alt=media)
5. Add any UI details to the configuration and click ***Finish***.

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-162082b2b40d14ee83a4948ebacc7066083224fc%2F58c3343e-2d16-4ca2-8503-b96e3562fcdc.png?alt=media)

### Configure an External Identity Provider iFrame Mode

To configure an external Identity Provider, go to *Access Management > Server Connections > Identity Providers*.

1. Click ***View*** on the specific Identity Provider you want to configure.
2. Click ***Edit***.
3. To edit the iFrame mode, go to the *Advanced Parameters* section of the *View/Edit* configuration popup and use the dropdown menu to make your selection.

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-9161e343e92a2eaa2e8e31a30584606b62e893f1%2F0a462a4d-024c-4be9-b5d3-f53c5e5109dc.png?alt=media)

### Edit Rotating Keys

With v8.4, when you use LogicNets as an IdP Client the system also supports rotating keys, which get renewed every 30 days.

The IdP can retrieve the public keys through LogicNets' JSON Web Key Set URL: *https\:////oauth2token/keys*, which can contain multiple public keys--each one identified with the public key identifier (kid). The header of the JWT bearer token contains the JSON Web Key Set (jku) URL and the kid URL. The Identity Provider determines if the jku is whitelisted and belongs to the IdP client-id. Using the jku for signing JWT tokens is not yet widely used, but some production systems do require it.

To use the rotation keys, do the following:

1. Open AccessManagement on your LogicNets server.

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-2c5a46928368487a278f35b55c3e2006e17d590e%2Fb9fbd729-a0d9-4749-b5ea-7697c041145a.png?alt=media)
2. Click Identity Providers.

   ![](https://2802811211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdFhfexCjZ5JMhwGzzywq%2Fuploads%2Fgit-blob-0b50ed7647c48f698e398490e58ac19e37b06c0c%2Faf034159-79bf-480b-a1bd-3598f065814c.png?alt=media)
3. Click the ***View*** button on the configuration line you want to update.
4. Click ***Edit*** to edit the configuration.
5. Ensure that the *Client Assertion Type* is set to *JSON Web Key Set URL*. Test and save your updates.
6. Register the LogicNets JSON Web Key Set URL: *https\:////oauth2token/keys*.

### Additional Information

For more detailed information about configuring external IdPs, see these articles:

* [OAUTH 2.0/OpenID 1.0](/release-9/platform-documentation/advanced-topics/system-integration/oauth-2-0openid-1-0-for-logicnets-v7-4.md)
* [IdP Parameter Definitions](/release-9/platform-documentation/system-administration/authentication-and-authorization/configure-remote-idps-parameter-definitions-examples.md)
* IdP Example URLs


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://community-test.logicnets.com/release-9/platform-documentation/system-administration/authentication-and-authorization/configuring-idp-in-access-management.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.