Configurations
Beginning Launcher 3.x, the configuration for the auth providers have been moved out of the Settings into their own separate objects under the root configuration. If you are using Launcher 3.x, the following should be used when configuring the Auth providers:
LDAP
Field | Description |
---|---|
hostname | string Hostname of the LDAP server |
port | integer Port of the LDAP server |
domain | string The domain of the user when logging in, i.e. @BLUEFLETCH |
rootDN | string The Root DN of where the users can be searched after authentication, e.g. "DC=BLUEFLETCH,DC=com", |
useHttps | boolean Set to true to use LDAPS when authenticating via HTTPS |
Example:
...
"auth_ldap": {
"hostname" : "ldapserver.bluefletch.com",
"port" : 636,
"domain" : "@BLUEFLETCH",
"rootDN" : "DC=BLUEFLETCH,DC=com",
"useHttps" : true
}
...
Okta/OneLogin (PKCE flow)
Field | Description |
---|---|
issuer_uri | string The configured Issuer URI for the identity provider |
client_id | string The configured client ID for this application |
redirect_uri | string The configured redirect callback URI for this application |
scopes | string The scopes where this authentication applies |
force_logout | string This allows for overriding the default logout End Session URL. This is required for OneLogin |
The following fields will still need to be configured under the settings object when using the Okta Auth Provider:
Field | Description |
---|---|
auth_location_field | string An optional setting that tells authorization which field in the auth provider response contains Location information. Used in conjunction with auth_location_regex. |
auth_location_regex | string A regular expression to extract the location value from the location field. Used in conjunction with auth_location_field |
auth_group_field | string An optional setting that tells authorization which field in the auth provider response contains Group information. Used in conjunction with auth_group_regex. |
auth_group_regex | string A regular expression to match against the group information. |
auth_group_regex_true | string If the regular expression auth_group_regex returns true (found a value), will use this group value. |
auth_default_group | string A default group |
auth_role_field | string An optional setting that tells authorization which field in the auth provider response contains User ROLE information. Used in conjunction with auth_role_regex. Available AUTH 1.1.x |
auth_role_regex | string A regular expression to match against the role information |
auth_role_regex_true | string If the regular expression auth_role_regex returns true (found a value), will use this Role value. |
auth_default_role | string A default user role |
Example:
...
"auth_okta": {
"issuer_uri" : "https://dev.oktapreview.com",
"client_id" : "0o5o9hn89wN4AAhhJ0h7",
"redirect_uri" : "com.bluefletch.launcher:/callback",
"scopes" : "[\"openid\", \"profile\", \"offline_access\", \"groups\"]"
},
"settings" : {
...
"auth_default_group" : "Associates",
"auth_group_field" : "title",
"auth_group_regex" : "(?i)leader$",
"auth_group_regex_true" : "Managers",
"auth_location_field" : "custom_fields.deptnum",
"auth_location_regex" : "(\\d+)",
...
}
...
AppAuth/Generic OAuth2
Field | Description |
---|---|
client_id | string The configured client ID for this application |
redirect_uri | string The configured redirect callback URI for this application. The recommended callback URL is com.bluefletch.launcher:/callback, however if your identity provider only supports https redirect URLs, you can use https://ems-launcher-auth-release.firebaseapp.com/oauth2redirect |
baseUrl | string Base URL for your identity provider |
authorize_url | string The full URL for the authorize endpoint for your IDP. |
token_url | Tstring he full URL for the token endpoint for your IDP. |
logout_url | string The full URL for the logout endpoint for your IDP. |
claim_userId | string The claim in the Access Token that contains the userId of the logged in user. |
claim_username | string The claim in the Access Token that contains the display name of the logged in user. |
claim_groups | string The claim in the Access Token that contains the groups that the logged in user is a member of. |
Example:
...
"auth_oauth2": {
"client_id" : "com.bluefletch.ems.auth",
"redirect_url" : "com.bluefletch.launcher:/callback",
"baseUrl" : "https://oauth2server.bluefletch.com",
"authorize_url" : "https://oauth2server.bluefletch.com/oauth2/authorize",
"token_url" : "https://oauth2server.bluefletch.com/oauth2/token",
"logout_url" : "https://oauth2server.bluefletch.com/oauth2/logout",
"claim_userId" : "upn",
"claim_username" : "commonname",
"claim_groups" : "memberof"
}
...
MSAL for Azure AD
Field | Description |
---|---|
client_id | string The client ID used to register this application |
authorization_user_agent | string set to 'DEFAULT' |
redirect_uri | string The configured redirect callback URI for this application. For the MSAL library, the redirect must use the application ID and it's signature. Use msauth://com.bluefletch.ems.auth.msal/KUKEusfKtqAOu9UB6jgjtTMKYas= |
authority_type | string set to 'AAD' for Azure AD |
authority_url | string set to "https://login.microsoftonline.com/ |
tenant_id | string set to your Azure Tenant ID |
logout_url | string set to "https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F%3Fref%3Dlogout", which will also log you out of office365. |
limit_to_launcher_groups | boolean if set to true, only the groups identified in the group_inclusion and layouts in the launcher configuration file will be passed into the session. |
Example:
...
"auth_msal" : {
"client_id" : "<client_id during registration>",
"authorization_user_agent" : "DEFAULT",
"redirect_uri" : "msauth://com.bluefletch.ems.auth.msal/KUKEusfKtqAOu9UB6jgjtTMKYas=",
"authority_type" : "AAD",
"authority_url" : "https://login.microsoftonline.com/<tenant_id>",
"tenant_id" : "<tenant_id>",
"logout_url" : "https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F%3Fref%3Dlogout",
"limit_to_launcher_groups" : true
}
...
ADFS 3.0/2012 Using ADAL library
Field | Description |
---|---|
authority | string Configured resource ID for this application |
resourceId | string Configured resource ID for this application |
clientId | string Configured Client ID for this application |
redirectUri | string Configured callback URL for this application |
defaultDomain | string optional, to pre-populate the username field with the domain prefix. |
claim_userId | string Passthrough field containing the userID (e.g. unique_name) |
claim_username | string LDAP passthrough field containing the user's display name |
claim_groups | string LDAP passthrough field containing the groups (e.g. equivalent to MemberOf) |
baseUrl | string The base url for the ADFS environment |
Example:
...
"auth_adal" : {
"baseUrl" : "https://adfs2012.bluefletch.com",
"authority" : "https://adfs2012.bluefletch.com/adfs/oauth2",
"clientId" : "com.bluefletch.ems.auth",
"resourceId" : "com.bluefletch.ems.auth",
"redirectUri" : "com.bluefletch.launcher:/callback",
"defaultDomain" : "BLUEFLETCH\\",
"claim_userId" : "upn",
"claim_username" : "commonname",
"claim_groups" : "MemberOf"
}
...
Okta (Resource Owner Flow)
Field | Description |
---|---|
issuer_uri | string The configured Issuer URI for the identity provider |
client_id | string The configured client ID for this application |
client_secret | string The configured client secret for this application |
redirect_uri | string The configured redirect callback URI for this application |
scopes | string The scopes where this authentication applies |
Example:
...
"auth_oktaRest": {
"issuer_uri" : "https://dev.oktapreview.com",
"client_id" : "0o5o9hn89wN4AAhhJ0h7",
"client_secret" : "A8300hhnadf84993225160kjfdB",
"redirect_uri" : "com.bluefletch.launcher:/callback",
"scopes" : "[\"openid\", \"profile\", \"offline_access\", \"groups\"]"
}
...