Identity Provider Application Registration

There are three main considerations when registering the EMu application (reviewing the example registration below should clarify what is required):

#	Consideration	Details
1	Desktop application registration	The registration should be configured for a desktop or public client / application. For example, when configuring the Redirect URI in Microsoft Azure AD you would select: Public client / native (mobile & desktop)
2	Specify the Redirect URI	The Redirect URI itself must be: http://127.0.0.1/emu Differences between Microsoft and Google: Google: it is not necessary to specify the Redirect URI when registering a desktop application with Google Cloud Platform.
3	Specify access to the required scopes	Scope values specify the user information that the application is allowed to access. Access to the following scopes is required: openid Used to indicate that the application intends to use OIDC to verify the user's identity. profile Allows the application to access details about a user, including their name. email Allows the application to access the user's primary email address. Details about scope values can be found on the Microsoft documentation site: Permissions and consent in the Microsoft identity platform. Differences between Microsoft and Google: Microsoft: it is not necessary to specify access to the required scopes when registering an application with Azure AD.

Full details about registering an application with Microsoft and Google are available here:

• Register an application with the Microsoft identity platform
• Google Identity OpenID Connect

Once the EMu application has been registered with an identity provider, it is necessary to configure the EMu server to use OpenID. While configuring the EMu server to use OpenID can be performed by Axiell staff, this requires access to your organization's identity provider connection details (including your client_secret). As such it is highly recommended that your System Administrator configures the EMu server to use OpenID.

Details about how to configure the EMu server to use OIDC can be found here.

Alternatively, Axiell staff can undertake the server configuration for you. In this case, information must be obtained from the application registration and provided to Axiell. This may include:

• Application (client) ID
• OAuth 2.0 authorization endpoint (v2)
• OAuth 2.0 token endpoint (v2)
• OpenID Connect metadata document

The following information may need to be obtained from the application registration and provided to Axiell:

• Application (client) secret

This information is used by Axiell to configure a customer's EMu client and server to use the OIDC protocol.

Differences between Microsoft and Google:

Microsoft:

1. Microsoft Azure AD uses specific endpoint and metadata document values for each organization (AKA tenant). These values must be provided to Axiell.
2. Microsoft Azure AD does not use or provide the Application (client) secret value for registered desktop or public applications. Therefore, it is not necessary to provide this value to Axiell.

Google:

1. It appears that Google Cloud Platform uses the same endpoint and metadata document values for all organizations, specifically:
   • Authorization endpoint:

     https://accounts.google.com/o/oauth2/v2/auth
     

   • Token endpoint:

     https://oauth2.googleapis.com/token
     

   • Metadata document:

     https://accounts.google.com/.well-known/openid-configuration
     

2. Google Cloud Platform requires the use of the Application (client) secret value when authorizing registered desktop applications. Therefore, this value must be provided to Axiell.

The steps are:

1. Sign into the Azure portal.
2. If you have access to multiple tenants, use the Directory + subscription filter in the top menu to select the tenant in which you want to register an application.
3. Search for and select Azure Active Directory.
4. Under Manage, select App registrations>New registration.
5. Set the application Name:

   EMu

6. Set the Supported account types.

   The value for this setting depends on the Azure AD setup but is likely to be:

   Accounts in this organizational directory only (Axiell Group AB only -
   Single tenant)

7. Set the Redirect URI.

   It should be specified for:

   Public client/native (mobile & desktop)

   And the Redirect URI should have the value:

   http://127.0.0.1/emu

   See the following screenshot for an example:

   

8. Obtain the registration details.

   To configure the EMu client and server to use OIDC, some information about the application registration must be provided to Axiell. The required information is:

   • Application (client) ID
   • OAuth 2.0 authorization endpoint (v2)
   • OAuth 2.0 token endpoint (v2)
   • OpenID Connect metadata document

   The Application and Directory IDs can be found on the Overview page of the Application Registration, for example:

   

   The endpoint and metadata document information can be found on the Endpoints page accessible via the Endpoints button on the Overview page of the Application Registration, for example: