OIDC provider settings reference

The Provider URL, scope, and redirect URL values that BigFix UI requires differ for each supported identity provider. Use this reference when you register BigFix UI with your provider and when you complete the OIDC configuration fields.

Provider URL

The Provider URL is the base URL of the OIDC identity provider. BigFix UI uses it to discover the OIDC endpoints of the provider and to authenticate users. The format depends on the provider.

Table 1. Provider URL format by identity provider
Provider Format Example
ADFS The ADFS server domain followed by /adfs:
https://{domain-name}/adfs
 https://adfs.corpdemo.local/adfs
Azure Entra ID The Microsoft login URL with the tenant ID of your Entra ID tenant:
https://login.microsoftonline.com/{tenant-id}/v2.0
 https://login.microsoftonline.com/ab223859-234e-4efg-b123-1a2b3c4d5e6f/v2.0
Okta The Okta organization URL of your Okta account:
https://{okta-org-name}.okta.com
 https://integrator-234567.okta.com
Restriction: For Okta, the Provider URL (issuer) must have okta.com as its domain suffix. Custom Okta domains are not supported in this release.

Scope

The value to enter in the Scope (optional) field depends on the provider.

Table 2. Scope value by identity provider
Provider Scope Required
ADFS openid Optional
Azure Entra ID .default Mandatory
Okta Not applicable Leave the field empty

Client ID and client secret

The client ID and client secret are the credentials of the OIDC application that is registered for BigFix UI with the identity provider. Obtain these values from your identity provider administrator or from the owner of the application. BigFix UI does not generate them. See Registering BigFix UI with your identity provider.

Redirect URL

Configure the redirect URL, also called the redirect URI or reply URL, in the identity provider. It must point to the BigFix UI server address that the browser uses, in the following format:

<scheme>://<bfui-host>:<port>/oidc/callback

For example:

  • https://bfui.example.com/oidc/callback
  • https://10.134.85.110:8080/oidc/callback

Apply the following rules:

  • The host name or IP address must resolve from the browser that is used to access BigFix UI, and it must point to the BigFix UI server.
  • The redirect URL must end with the /oidc/callback path.
  • The redirect URL that is configured in the provider must match the URL that BigFix UI uses. A mismatch in the scheme, host name, IP address, port, or callback path causes authentication to fail.
  • If, during the BigFix UI setup, the host name is configured with a DNS name, use the DNS name in the redirect URL. If it is configured with an IP address, use the IP address.
  • Omit the default ports, 80 for HTTP and 443 for HTTPS. Specify only non-default ports.

For example, if users access BigFix UI at https://bfui.example.com, the redirect URL is https://bfui.example.com/oidc/callback. If they access it at https://10.134.85.110:8080, the redirect URL is https://10.134.85.110:8080/oidc/callback.

Provider URL accessibility

The Provider URL must be reachable from both the BigFix UI server and the client browser:

  • The provider must be reachable over HTTPS from the BigFix UI server.
  • The provider must present a valid, trusted SSL/TLS certificate. The certificate must not be expired, and its host name must match the configured Provider URL.
  • If the provider uses a private or internal certificate authority (CA), add the CA certificate to the trusted certificate store on the BigFix UI server. For example, if ADFS uses a local CA, the BigFix UI server must trust that CA.
  • Network and firewall rules must not block traffic between the BigFix UI server and the provider.
  • The client browser must also reach the provider, because the user is redirected to the provider during authentication.