Settings: auth | signotec Knowledge Base

The following settings configure the authentication of users. By default, the authentication mechanism of the servlet container or application server is used. Alternatively, Single Sign On (SSO) with OpenID Connect (OIDC) can be used.

The mobile apps for Android and iOS are not compatible with Single Sign On. Use the setting auth.type = REALM, to use signoSign/Universal via the apps.
For the use of single sign-on, setting the key web.ssmPublicUrl is essential.

auth.type

Description	Specifies the type of authentication. To use OpenID Connect, the keys `auth.oidc.discoveryUrl`, `auth.oidc.clientId`, and `auth.oidc.clientSecret` must be specified.
Possible values	`REALM`	The authentication mechanism of the servlet container or application servers is used.
	`OIDC`	Users are authenticated by an authorization server by means of OpenID Connect.
Default value	`REALM`

auth.realm.forceLowerCaseUsername

Description	If this setting is activated, the username is case-insensitive. Users "John Smith" and "john smith" share the same data in the system, such as documents. Both users can log in, however, as long as the log-in mechanism allows this, but signoSign/Universal uses the lower case username internally.
Possible values	`true`	Case sensitivity is ignored. "John Smith" and "john smith" are the same user account.
	`false`	Case sensitivity is taken into account. "John Smith" and "john smith" are different user accounts.
Default value	`false`

auth.oidc.discoveryUrl

Description

The URL of the OpenID Provider Metadata of the identity server. The URL generally ends with /.well-known/openid-configuration.

This value must be specified in order to use OpenID Connect.

Possible values

A URL.

Default value

auth.oidc.clientId

Description

The identifier with which signoSign/Universal is registered with the identity server. An application that uses OpenID Connect must be registered with the identity server, whereby this identifier is issued, which is required for the authorization code flow.

This value must be specified in order to use OpenID Connect.

Possible values

Any string of characters.

Default value

auth.oidc.clientSecret

Description

The secret specified with the identity server that signoSign/Universal uses for the authorization code flow.

This value must be specified in order to use OpenID Connect.

Possible values

Any string of characters.

Default value

auth.oidc.scope

Description	The scope values that are used for the authorization code flow. For the fundamental functionality, OpenID Connect requires the value openid.
Possible values	Any string of characters.
Default value	`openid profile email`

auth.oidc.usernameClaim

Description	The value (claim) in the token from which the username is taken. If the value is not present or is empty, it is not possible to log in to signoSign/Universal.
Possible values	Any string of characters.
Default value	`email`

The default value email is a standard claim that is inserted into the token by the scope email. If the value email is not contained in auth.oidc.scope, this setting should be checked.

auth.oidc.tenantClaim

Description	The claim in the token from which the tenant identification is taken. If the value is not present or empty, it is not possible to log in to signoSign/Universal if the application is running in multi-tenant mode.
Possible values	An alphanumeric string that is unique for each tenant.
Default value	`tenant`

This claim is mandatory if the system is operated in tenant mode. See also the section Multi-tenant capability.

auth.oidc.rolesClaim

Description	The value (claim) in the token from which the user roles are taken. If the value is not present in the token, is empty, or is not a JSON array, it is not possible to log in to signoSign/Universal.
Possible values	Any string of characters.
Default value	`roles`

The default value roles is not a standard claim, because OpenID Connect does not define a standard for user roles. The value must be inserted into the token by proprietary setting of the identity server and by using custom scopes.

auth.oidc.tokenAudience

Description	From the perspective of the identity server, signoSign/Universal is a resource. An OAuth access token is always issued for a resource. This setting can be used to specify a list of valid resources. The signoSign/Universal REST API will only accept the access token if its aud claim value is included in this list. The check is deactivated if no value has been specified.
Possible values	A comma-separated list of identifiers.
Default value	-

If the signoSign/Universal REST API is available publicly, specifying this list is strongly recommended for security reasons. A public REST API should always check whether an access token was issued for the API.

auth.oidc.tokenIssuer

Description	A list of additional trustworthy access token issuers. The issuer from the OpenID Provider Metadata is always trustworthy. The signoSign/Universal REST API will only accept access tokens if their iss claim value is known.
Possible values	A comma-separated list of identifiers.
Default value	The issuer from OpenID Provider Metadata, if available.