Skip to content

Configurations

Beginning in Launcher 3.x, the configurations for the authentication providers have been moved out of the settings object into their own separate objects under the root configuration. If you are using Launcher 3.x, the following should be used when configuring the authentication providers:

LDAP

Field Description
hostname string Hostname of the LDAP server.
port integer Port of the LDAP server.
domain string The domain of the user when logging in (i.e. "@BLUEFLETCH").
rootDN string The Root DN of where the users can be searched after authentication (e.g. "DC=BLUEFLETCH,DC=com").
useHttps boolean Set to true to use LDAPS when authenticating via HTTPS.

Example:

...
"auth_ldap": {
    "hostname" : "ldapserver.bluefletch.com",
    "port" : 636,
    "domain" : "@BLUEFLETCH",
    "rootDN" : "DC=BLUEFLETCH,DC=com",
    "useHttps" : true
}
...

Okta/OneLogin (PKCE flow)

Field Description
issuer_uri string The configured issuer URI for the identity provider.
client_id string The configured client ID for this application.
redirect_uri string The configured redirect callback URI for this application.
scopes string The scopes where this authentication applies.
force_logout string This allows for overriding the default logout End Session URL. This is required for OneLogin.

The following fields will still need to be configured under the settings object when using the Okta Auth Provider:

Field Description
auth_location_field string An optional setting that tells authorization which field in the auth provider response contains location information. Used in conjunction with auth_location_regex.
auth_location_regex string A regular expression to extract the location value from the location field. Used in conjunction with auth_location_field.
auth_group_field string An optional setting that tells authorization which field in the authentication provider response contains group information. Used in conjunction with auth_group_regex.
auth_group_regex string A regular expression to match against the group information. Used in conjunction with auth_group_field.
auth_group_regex_true string If the regular expression auth_group_regex returns true (found a value), will use this group value.
auth_default_group string A default group.
auth_role_field string An optional setting that tells authorization which field in the authentication provider response contains user role information. Used in conjunction with auth_role_regex. Available in Auth 1.1.x.
auth_role_regex string A regular expression to match against the role information. Used in conjunction with auth_role_field.
auth_role_regex_true string If the regular expression auth_role_regex returns true (found a value), will use this role value.
auth_default_role string A default user role.

Example:

...
"auth_okta": {
    "issuer_uri" : "https://dev.oktapreview.com",
    "client_id" : "0o5o9hn89wN4AAhhJ0h7",
    "redirect_uri" : "com.bluefletch.launcher:/callback",
    "scopes" : "[\"openid\", \"profile\", \"offline_access\", \"groups\"]"
},
"settings" : {
    ...
    "auth_default_group" : "Associates",
    "auth_group_field" : "title",
    "auth_group_regex" : "(?i)leader$",
    "auth_group_regex_true" : "Managers",
    "auth_location_field" : "custom_fields.deptnum",
    "auth_location_regex" : "(\\d+)",
    ...
}
...

Beginning in Auth 4.x, Okta authentication will be configured with the auth_oauth2 object instead of the auth_okta object, as in this example:

"auth_oauth2": {
        "issuer_url": "https://dev.oktapreview.com",
        "client_id": "0o5o9hn89wN4AAhhJ0h7",
        "redirect_url": "com.bluefletch.ems.auth://callback",
        "browser": "com.bluefletch.ems.browser",
        "scopes": "openid profile offline_access groups",
        "logout_redirect": "com.bluefletch.ems.auth://logout"
    },

Please note the following changes:
* the issuer_uri and redirect_uri have been renamed to issuer_url and redirect_url. * new redirect URLs have been introduced for compatibility with other OIDC providers: * com.bluefletch.ems.auth://callback * com.bluefletch.ems.auth://logout

For more information on the properties for configuring, see the AppAuth/OIDC IDP section.

AppAuth/OIDC IdP

Beginning in Auth 4.x, the AppAuth/Generic OAuth2 configuration will support login through the BlueFletch Browser, as well as Chrome Custom Tabs. The authenticating browser is defined by the browser value.

Field Description
issuer_url string The configured issuer URL for the identity provider.
client_id string The configured client ID for this application.
redirect_url string The configured redirect callback URL for this application. The recommended callback URL is "com.bluefletch.launcher:/callback". However, if the identity provider only supports HTTPS redirect URLs, use "https://ems-launcher-auth-release.firebaseapp.com/oauth2redirect".
Starting in Auth4, the redirect callback URL should be com.bluefletch.ems.auth://callback
scopes string The OpenID scope values required for the identity provider.
baseUrl string Base URL for the identity provider.
authorize_url string The full URL for the authorize endpoint for the identity provider.
token_url string The full URL for the token endpoint for the identity provider.
logout_url string The full URL for the logout endpoint for the identity provider.
logout_redirect string The full URL for the logout redirection location for your IdP. Default is "com.bluefletch.ems.auth://logout".
userinfo_url string The full URL of the userInfo endpoint for the identity provider.
resource string Specifies the host to access for a token during login when the IdP does not provide it through userinfo_url. Used in Azure AD authentication (e.g "https://graph.microsoft.com").
login_hint string Hint to be displayed for the username field on the identity provider login page.
ignoreExpiresIn boolean If true, instructs the launcher to refresh the token based on the refreshThresholdInMins value instead of the expiration indicated in the token.
browser string Specifies the browser package name to execute the authorize call. Default is "com.android.chrome".
refreshThresholdInMins integer The number of minutes after which the launcher will automatically refresh the token if ignoreExpiresIn is set to true.
auth_location_field string An optional setting that tells authorization which field in the auth provider response contains location information. Used in conjunction with auth_location_regex.
auth_location_regex string A regular expression to extract the location value from the location field. Used in conjunction with auth_location_field.
auth_group_field string An optional setting that tells authorization which field in the authentication provider response contains group information. Used in conjunction with auth_group_regex.
auth_group_regex string A regular expression to match against the group information. Used in conjunction with auth_group_field.
auth_group_regex_true string If the regular expression auth_group_regex returns true (found a value), will use this group value.
auth_default_group string A default group.
auth_role_field string An optional setting that tells authorization which field in the authentication provider response contains user role information. Used in conjunction with auth_role_regex. Available in Auth 1.1.x.
auth_role_regex string A regular expression to match against the role information. Used in conjunction with auth_role_field.
auth_role_regex_true string If the regular expression auth_role_regex returns true (found a value), will use this role value.
auth_default_role string A default user role.
claim_userId string The claim in the access token that contains the user ID of the logged-in user.
claim_username string The claim in the access token that contains the display name of the logged-in user.
claim_groups string The claim in the access token that contains the logged-in user's membership groups.
userinfo_attrs string A comma-delimited list of names indicating the field names within the userInfo response that should be copied into the session extended attributes collection. This provides the ability to get optional data points.

Example:

...
  "auth_oauth2": {
    "client_id": "com.bluefletch.ems.auth",
    "redirect_url": "com.bluefletch.launcher:/callback",
    "baseUrl": "https://oauth2server.bluefletch.com",
    "authorize_url": "https://oauth2server.bluefletch.com/oauth2/authorize",
    "token_url": "https://oauth2server.bluefletch.com/oauth2/token",
    "userinfo_url": "https://oauth2server.bluefletch.com/oauth2/userinfo",
    "logout_url": "https://oauth2server.bluefletch.com/oauth2/logout",
    "scopes": "openid profile offline_access groups",
    "claim_userId": "upn",
    "claim_username": "commonname",
    "claim_groups": "memberof",
    "browser": "com.bluefletch.ems.browser"
}
...

MSAL for Azure AD

Field Description
client_id string The client ID used to register this application.
authorization_user_agent string Set to "DEFAULT".
redirect_uri string The configured redirect callback URI for this application. For the MSAL library, the redirect must use the application ID and its signature. Use "msauth://com.bluefletch.ems.auth.msal/KUKEusfKtqAOu9UB6jgjtTMKYas=".
broker_redirect_uri_registered boolean Set to true if using the Microsoft Authenticator application in Shared Device Mode on the device. Default is false.
authority_type string Set to "AAD" for Azure AD.
authority_url string The directory from which MSAL can request tokens. Typically, set to "https://login.microsoftonline.com/<tenant_id>", where <tenant_id> is the Azure Tenant ID.
tenant_id string Set to the Azure Tenant ID.
logout_url string Set to "https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F%3Fref%3Dlogout", which will also log the user out of office365.
limit_to_launcher_groups boolean If set to true, only the groups identified in the group_inclusion and layouts in the launcher configuration file will be passed into the session.

Example:

...
"auth_msal" : {
    "client_id" : "<client_id during registration>",
    "authorization_user_agent" : "DEFAULT",
    "redirect_uri" : "msauth://com.bluefletch.ems.auth.msal/KUKEusfKtqAOu9UB6jgjtTMKYas=",
    "authority_type" : "AAD",
    "authority_url" : "https://login.microsoftonline.com/<tenant_id>",
    "tenant_id" : "<tenant_id>",
    "logout_url" : "https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F%3Fref%3Dlogout",
    "limit_to_launcher_groups" : true
}
...

Beginning in Auth 4.3.x, Azure AD authentication will be configured with the auth_oauth2 object instead of the auth_msal object, as in this example:

...
"auth_oauth2": {
    "client_id": "01cceca8-d87b-11ec-9d64-0242ac120002",
    "redirect_url": "msauth://com.bluefletch.ems.auth/K8s43sSfptA3T2LoAlTd9XEfKQg=",
    "baseUrl": "https://login.microsoftonline.com/469a2de6-d87b-11ec-9d64-0242ac120002",
    "authorize_url": "https://login.microsoftonline.com/469a2de6-d87b-11ec-9d64-0242ac120002/oauth2/authorize",
    "token_url": "https://login.microsoftonline.com/469a2de6-d87b-11ec-9d64-0242ac120002/oauth2/token",
    "scopes": "openid profile email User.Read GroupMember.Read.All https://graph.microsoft.com",
    "resource" : "https://graph.microsoft.com",
    "userinfo_url": "https://graph.microsoft.com/v1.0/me/memberOf",
    "claim_userId": "upn",
    "claim_username": "name",
    "claim_groups": "memberOf"
}
...

For more information on configuring, see the AppAuth/OIDC IdP section.

ADFS 3.0/2012 Using ADAL library

Field Description
authority string Configured resource ID for this application.
resourceId string Configured resource ID for this application.
clientId string Configured client ID for this application.
redirectUri string Configured callback URL for this application
defaultDomain string Pre-populates the username field with the domain prefix (optional).
claim_userId string Passthrough field containing the userID (e.g. "unique_name").
claim_username string LDAP passthrough field containing the user's display name.
claim_groups string LDAP passthrough field containing the groups (e.g. equivalent to MemberOf).
baseUrl string The base URL for the ADFS environment.

Example:

...
"auth_adal" : {
    "baseUrl" : "https://adfs2012.bluefletch.com",
    "authority" : "https://adfs2012.bluefletch.com/adfs/oauth2",
    "clientId" : "com.bluefletch.ems.auth",
    "resourceId" : "com.bluefletch.ems.auth",
    "redirectUri" : "com.bluefletch.launcher:/callback",
    "defaultDomain" : "BLUEFLETCH\\",
    "claim_userId" : "upn",
    "claim_username" : "commonname",
    "claim_groups" : "MemberOf"
}
...

Okta (Resource Owner Flow)

Field Description
issuer_uri string The configured Issuer URI for the identity provider.
client_id string The configured client ID for this application.
client_secret string The configured client secret for this application.
redirect_uri string The configured redirect callback URI for this application.
scopes string The scopes where this authentication applies.

Example:

...
"auth_oktaRest": {
    "issuer_uri" : "https://dev.oktapreview.com",
    "client_id" : "0o5o9hn89wN4AAhhJ0h7",
    "client_secret" : "A8300hhnadf84993225160kjfdB",
    "redirect_uri" : "com.bluefletch.launcher:/callback",
    "scopes" : "[\"openid\", \"profile\", \"offline_access\", \"groups\"]"
}
...