Authentication with OpenID

With this extension, users can connect to iTop using OpenID providers (Facebook, Google, Twitter, LinkedIn, MicrosoftGraph …)

Add capability to configure SSO authentication with most common OpenID Identity providers (Facebook, Google, Twitter, LinkedIn, MicrosoftGraph …)

• It offers new authentication modes based on oAuth and OpenID Single Sign On (SSO) for the following OpenID providers:
• Those modes can be mixed with other modes (internal, SAML …)
  
• It is possible to configure several Identity providers if you want to allow access for instance to both Google and MicrosoftGraph
• It relies on HybridAuth library library, which provides a unified interface to identify a user and retrieve contact information.
• Some of those Identity providers are able to provide user information to allow automatic User and Person provisioning in iTop.
  Check the third column of the Providers table, it is required for automatic User/Person provisioning on User first connection.

There is no mapping capability for contact provisioning.

This capability may not work if you have changed the default datamodel

You have to configure the iTop application on your Identity provider to allow communication between iTop and this one. Look at your Identity provider documentation for more details.

Use the Standard installation process for this extension.

First, you have to configure the iTop provider on your identity provider (Google, Facebook …)

• The iTop landing page to provide to your Identity provider is:

<itop url>/env-production/combodo-hybridauth/landing.php

Once iTop is configured on Identity Provider side you can follow below steps

• open the file 'config-itop.php'
• add to the allowed_login_types parameter, the corresponding provider in the form of hybridauth-<provider name>

config-itop.php

allowed_login_types => 'form|hybridauth-Facebook|hybridauth-Google|hybridauth-MicrosoftGraph|basic|external',

form must remain the first, for all the others to be proposed to the user.

If an hybridauth option is entered first, then the login page directly jump to the remote provider login page. basic must be left in the list for REST to still work.

• Customize OpenID authentication/login screen/ provisioning in a dedicated section combodo-hybridauth.
  

In the providers section you can configure several providers. The “enabled” flag allows to activate the each authentication provider or not

Example: a configuration in which Google is configured but deactivated and MicrosoftGraph is activated:

config-itop.php

'combodo-hybridauth' => [
        'debug' => true,
        'providers' => [
                'Google' => [
                                'enabled' => false,
                                'debug' => true,
                                'keys' => [
                                                'id' => 'your-google-client-id',
                                                'secret' => 'your-google-client-secret',
                                ],
                ],
                'MicrosoftGraph' => [
                                'enabled' => true,
                                'debug' => false,
                                'keys' => [
                                                'id' => 'xxxx-xxxxx-xxxxx-xxxxx',
                                                'secret' => 'xxxxxx',
                                ],
                ],
        ],
]

Since version 1.2.0 (included in iTop pro 3.1.1) it is possible to customize the label, tooltip and icon on the login screen buttons. For example, if you would like to change the label and the icon to connect to google provider you can replace de default button by the one below

Define in module section theirs settings:

config-itop.php

'combodo-hybridauth' => array (
        'debug' => false,
        'synchronize_user' => false,
        'synchronize_contact' => false,
        'default_organization' => '',
        'default_profiles' => ['Portal User'],
        'providers' => array (
          'Google' => 
                array (
                  'enabled' => true,
                   'label' => 'Login like a bear',
                   'tooltip' => 'Login with your paw',
                   'icon_url' => 'fas fa-paw',
                  'keys' => 
                  array (
                    'id' => 'your-google-client-id',
                    'secret' => 'your-google-client-secret',
                  ),
                ),
        ),
),

In this case, you will see on the button the label you set + provider name (automatically added after your label).
If you want to hide provider used to connect, you will need to use dictionary entry in your configuration file and set values in all languages you used to this dictionary entry.

config-itop.php

'combodo-hybridauth' => array (
        'debug' => false,
        'synchronize_user' => false,
        'synchronize_contact' => false,
        'default_organization' => '',
        'default_profiles' => ['Portal User'],
        'providers' => array (
          'Google' => 
                array (
                  'enabled' => true,
                   'label' => 'Google:HybridAuth:Login:SignIn',
                   'tooltip' => 'Login with your paw',
                   'icon_url' => 'fas fa-paw',
                  'keys' => 
                  array (
                    'id' => 'your-google-client-id',
                    'secret' => 'your-google-client-secret',
                  ),
                ),
        ),
),

Below iTop objects can be created/updated when connecting through Oauth2 provider via email/login reconciliation.

In other words user logs in via Identity Provider server. Then all fields associated to authentified user are used to create/sync up below object fields. Afterwhile user is connected into iTop with this new updated account (user+person).

• User (login, person_id)
• Person (first_name, name, email, phone)
• Profiles (linked to user via profile_list)
• Organization (linked to Person object via org_id):

New in 1.2.4 : Organization assigned to created Person is either coming from service provider either by configuration (fallback).

• Allowed Organization (linked to User object via allowed_org_list)

Example : Google IdP with provisioning enabled at first connection only. it describes how to use different profile and organization for a given provider.

config-itop.php

'combodo-hybridauth' => [
                'debug' => false,
                'synchronize_user' => false,
                'synchronize_contact' => false,
                'default_organization' => 'GlobalOrg',
                'default_profiles' => ['Configuration Manager'],
                'providers' => [
                        'Google' =>
                                [
                                        'keys' =>
                                                [
                                                        'id' => 'id',
                                                        'secret' => 'secret',
                                                ],
                                        'enabled' => true,
                                        'synchronize_user' => true,
                                        'synchronize_contact' => true,
                                        'default_profiles' => ['PortalUser'],
                                        'default_organization' => 'IT Department',
                                ],
                ],
        ],        

Example: profile synchronization with OktaOIDC (New in 2.0.0 )

Here iTop objects are created at first connection and updated each time user logs in iTop based on IdP up-to-date user data.

In below configuration:

• if OktaOIDC sends sp_id1 group, then user will have “Configuration Manager” profiles. his previous profiles will be removed.

• if OktaOIDC sends sp_id2 group, then user will only “Portal power user” and “Portal user” profiles.

• if OktaOIDC sends sp_id1 and sp_id2 groups, user will have the 3 profiles.

• if there is no profile matching with the groups returns by hybridauth JSON output, then connection to iTop is refused (user is considered without any grant access) and iTop user is saved with default profiles (if there are some configured)..

config-itop.php

      'combodo-hybridauth' => [
                'debug' => true,
                'synchronize_user' => true,
                'refresh_existing_user' => true,
                'refresh_existing_contact' => true,
                'synchronize_contact' => true,
                'default_organization' => 'demo',
                'default_profiles' => ['Portal User'],
                'providers' => [
                        'OktaOIDC' =>
                                [
                                        'enabled' => false,
                                        'debug' => true,
                                        'keys' =>
                                                [
                                                        'id' => 'your-id',
                                                        'secret' => 'your-secret',
                                                ],
                                        'groups_to_profiles' => ["sp_id1" => "Configuration Manager", "sp_id2" => ["Portal power user", "Portal user"]]
                                ]
                ],
        ],

NB: profile part of JSON OktaOIDC response is already an array of values.

Example: profile synchronization with a specific key coming from Json Keycloak response

In this case Keycloak provides profile in another key as a string. iTop explodes profiles via a configured ',' separator.

config-itop.php

      'combodo-hybridauth' => [
                'debug' => true,
                'synchronize_user' => true,
                'refresh_existing_user' => true,
                'refresh_existing_contact' => true,
                'synchronize_contact' => true,
                'default_organization' => 'demo',
                'default_profiles' => ['Portal User'],
                'providers' => [
                        'Keycloak' =>
                                [
                                        'enabled' => false,
                                        'debug' => true,
                                        'keys' =>
                                                [
                                                        'id' => 'your-id',
                                                        'secret' => 'your-secret',
                                                ],
                                        'profiles_idp_key' => 'profiles',
                                        'profiles_idp_separator' => ',',
                                        'groups_to_profiles' => ["sp_id1" => "Configuration Manager", "sp_id2" => ["Portal power user", "Portal user"]]
                                ]
                ],
        ],

Example: allowed organization synchronization with a specific key coming from Json Keycloak response

In this case Keycloak provides organization in allowed_orgs key as a string. iTop explodes organization named via a configured ',' separator.

config-itop.php

      'combodo-hybridauth' => [
                'debug' => true,
                'synchronize_user' => true,
                'refresh_existing_user' => true,
                'refresh_existing_contact' => true,
                'synchronize_contact' => true,
                'default_organization' => 'demo',
                'default_profiles' => ['Portal User'],
                'providers' => [
                        'Keycloak' =>
                                [
                                        'enabled' => false,
                                        'debug' => true,
                                        'keys' =>
                                                [
                                                        'id' => 'your-id',
                                                        'secret' => 'your-secret',
                                                ],
                                        'allowed_orgs_idp_key' => 'allowed_orgs',
                                        'allowed_orgs_idp_separator' => ',',
                                        'groups_to_orgs' => ["sp_id1" => "Demo", "sp_id2" => ["My organization", "IT Organization"]]
                                ]
                ],
        ],

If you don't use the automatic provisionning, you have to create in iTop SSO users using the type External user when prompted for a “New user Account”:

Once configured, the Login form will look like

Q: Can I mix OpenID Connect and a captcha?
A: Yes this is possible using the Combodo's customer extension Brute Force Protection.

Q: What is Hybridauth, OpenID Connect and OAuth2?
A:

• Hybridauth is the PHP library used by iTop to run the OpenID Connect protocol
• OpenID Connect is the 3rd version of the OpenID protocol, it uses OAuth2, it's a protocol used exclusively for Authentication and user provisionning

More info in french

Q: How to fix when consent form always displayed with Google/MSGraph
A: This regression (due to N°8235) impacts version 1.2.4 only Please upgrade extension version. Otherwise follow workaround procedure.

Even when remaining connected on Identity provider (Google/MSGraph only), consent form is proposed each time you click on login button. in versions = 1.2.4, the form was not displayed and user was immediately logged in.

Workaround (Google/MSGraph only): add authorize_url_parameters section as proposed in below example

'combodo-hybridauth' => array (
        ...
        'providers' => array (
          'Google' => 
          array (
            'enabled' => true,
            'authorize_url_parameters' => 
            array (
              'prompt' => '',
            ),
            ...

Q: Can we implement several connexion for a given provider to implement several tenant?
A: Since version 1.2.0 (inclued in iTop pro 3.1.1) this is possible to configure several connexion to different tenant using the same provider.

In the example below we configure connexion with MicrosoftGraph to TENANT1 and TENANT2

You have to configure the module combodo-hybridauth to define 2 providers using the same adpater (method to access the provide). It is MicrosoftGraph in our example.

The code TENANT1 and TENANT2 are the idenfier that will be used in the variable allowed_login_type to allow those connexions

You can specify application id and secret corresponding to your tenant and define label, tooltip and icon specific to help the user to chose the good connexion method.

config-itop.php

'combodo-hybridauth' => array (
                'debug' => true,
                'synchronize_user' => false,
                'synchronize_contact' => false,
                'default_organization' => '',
                'default_profiles' => ['Portal User'],
                'providers' => array (
                  'TENANT1' => 
                  array (
                    'adapter' => 'Hybridauth\\Provider\\MicrosoftGraph',
                    'label' => 'Authentification On Tenant 1',
                    'tooltip' => 'Connexion from O365 - Tenant 1',
                    'enabled' => true,
                    'keys' => 
                    array (
                      'id' => 'MyApplicationIdOnTOnMyTenant-1.fr',
                      'secret' => 'MySecretOnMyTenant-1',
                    ),
                    'synchronize_user' => true,
                    'synchronize_contact' => true,
                    'tenant' => 'MyTenant-1.fr',
                    'default_organization' => 'MyCompagny',
                  ),
                  'TENANT2' => 
                  array (
                    'adapter' => 'Hybridauth\\Provider\\MicrosoftGraph',
                    'label' => 'Authentification On Tenant 2',
                    'tooltip' => 'Connexion from O365 - Tenant 2',
                    'enabled' => true,
                    'keys' => 
                    array (
                      'id' => 'MyApplicationIdOnTOnMyTenant-2.fr',
                      'secret' => 'MySecretOnMyTenant-2',
                    ),
                    'synchronize_user' => true,
                    'synchronize_contact' => true,
                    'tenant' => 'MyTenant-2.fr',
                    'default_organization' => 'Demo',
                  ),
                ),
        ),

In this case, the provider 'TENANT1' gives access to iTop with a MicrosoftGraph connexion to MyTenant-1.fr, and the provider 'TENANT2' to MyTenant-2.fr

in your configuration file, you have to add values hybridauth-TENANT1 and hybridauth-TENANT2 in field allowed_login_types:

config-itop.php

'allowed_login_types' => 'url|form|hybridauth-TENANT1|hybridauth-TENANT2|external|basic',