Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Enjoy members-only rewards and discounts
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.
Sign In Create an Account Dell Financial Services Premier Sign In Partner Program Sign In
Contact Us

Your Dell.com Carts

OpenManage Enterprise 4.1.x User's Guide

PDF

Configure OIDC login using PingFederate

To enable OpenManage Enterprise OpenID Connect (OIDC) login using PingFederate, add and map a scope dxcua (Dell extended claim for user authentication) to the Client ID and define the user privileges.

About this task

CAUTION: User roles and scopes are reset to 'default' on client re-registration with the OIDC provider PingFederate (PingIdentity). This issue might reset the privileges and scope of nonadmin roles (DM and Viewer) to that of the Administrator. Re-registration of the appliance console with the OIDC provider is triggered during an appliance upgrade, change in network configuration, or change in SSL certificate.

To avoid security concerns post any of the above-mentioned re-registration events, the administrator must reconfigure all the OpenManage Enterprise Client IDs on the PingFederate site. Also, it is highly recommended that Client IDs are created only for Administrator users with Pingfederate till this issue is resolved.

NOTE: The default assigning algorithm should be RS256 (RSA Signature with SHA-256).

Steps

  1. Add an 'exclusive' or 'default' scope called dxcua under Scope Management in OAuth Settings.
  2. Map the scope that is created in OpenID Connect Policy Management > Policy using the following steps:
    1. Enable Include User info in Token.
    2. In the Attribute Scope, add the scope and attribute value as dxcua.
    3. In Contract fulfillment, add dxcua and select the type as 'Text'. Then, define the user privileges for OpenManage Enterprise OpenID Connect provider login using one of the following attributes:
      1. Administrator: dxcua : [{“Role": "AD"}]
      2. Device Manager: dxcua : [{“Role": "DM"}]
        NOTE:To restrict access of the device manager to select device groups, say G1 and G2, in OpenManage Enterprise use dxcua : [{“Role": "DM", "Entity":"G1, G2"}].
      3. Viewer: dxcua : [{“Role": "VE"}]
    4. If an 'exclusive' scope is configured after the client registration in OpenManage Enterprise, edit the configured client in PingFederate and enable the created 'dxcua' exclusive scope.
  3. Dynamic client registration should be enabled in PingFederate for OpenManage Enterprise client registration. If the 'Require Initial access token' option is disabled on the OpenID Connect provider client settings, the registration works with Username and password. If the option is enabled, then the registration works only with the Initial Access token.

Rate this content

Accurate
Useful
Easy to understand
Was this article helpful?
0/3000 characters
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please select whether the article was helpful or not.
  Comments cannot contain these special characters: <>()\