OpenManage Enterprise 4.0.x User's Guide

Configure OIDC login using PingFederate

To enable OpenManage Enterprise OpenID Connect (OIDC) login using PingFederate, add and map a scope dxcua (Dell extended claim for user authentication) to the Client ID and define the user privileges.

1. Add an 'exclusive' or 'default' scope called dxcua under Scope Management in OAuth Settings.
2. Map the scope that is created in OpenID Connect Policy Management > Policy using the following steps:
   1. Enable Include User info in Token.
   2. In the Attribute Scope, add the scope and attribute value as dxcua.
   3. In Contract fulfillment, add dxcua and select the type as 'Text'. Then, define the user privileges for OpenManage Enterprise OpenID Connect provider login using one of the following attributes:
      1. Administrator: dxcua : [{“Role": "AD"}]
      2. Device Manager: dxcua : [{“Role": "DM"}]
         NOTE:To restrict access of the device manager to select device groups, say G1 and G2, in OpenManage Enterprise use dxcua : [{“Role": "DM", "Entity":"G1, G2"}].
      3. Viewer: dxcua : [{“Role": "VE"}]
   4. If an 'exclusive' scope is configured after the client registration in OpenManage Enterprise, edit the configured client in PingFederate and enable the created 'dxcua' exclusive scope.
3. Dynamic client registration should be enabled in PingFederate for OpenManage Enterprise client registration. If the 'Require Initial access token' option is disabled on the OpenID Connect provider client settings, the registration works with Username and password. If the option is enabled, then the registration works only with the Initial Access token.