Single Sign-On (SSO) with OpenID Connect authentication in Bold Reports®

Bold Reports® supports OpenID Connect for Single Sign-On (SSO), so users log in directly to the Bold Reports® application after they authenticate with OpenID Connect.

What do I need before I configure OpenID Connect?

To configure OpenID Connect in Bold Reports®, you need the following:

  1. An account with an OpenID Connect provider.

  2. Register the Bold Reports® application with the OpenID Connect provider.

Steps to configure OpenID Connect in Bold Reports®

You configure OpenID Connect in the Bold Reports® Report Server settings. Follow these steps:

  1. Log in to Bold Reports® with an admin credential.

  2. Click the settings in the Bold Reports® Report Server left-side menu.

  3. Go to the Authentication tab and select OpenID Connect, as shown in the following images.

    Authentication Settings OpenID Connect Authentication

  4. Provide the following details in the OpenID Connect settings of the Bold Reports® application:

Provider Name It represents the name of the authentication provider to be displayed on the login page.
Provider Logo It represents the logo of the authentication provider to be displayed on the login page.
Authority It is the instance created within the provider for the user.
Client ID It is a unique identifier provided to each of the applications while registering with the providers.
Client Secret It is a secret key used to authorize the applications.
Identifier It is the property name that stores the email address of the user in the deserialized ID token.
Logout Endpoint It is an endpoint that logs out the third-party provider.

Note: While configuring OpenID Connect, you need to choose the appropriate Response Type either token-id or code for the Group Claims settings.

The following screenshot shows the Response Type option for the Group Claims settings.

Response Type

How does group claims authentication work?

Group claims authentication in Bold Reports® maps users and groups automatically, based on the group claim received in the authentication token. The claims are typically a JSON object with key-value pairs for each claim. Provide the JSON key that identifies the group claim value.

Enable User and Group Mapping When enabled, the system fetches group claim values from the token and dynamically maps users to one or more groups during login.
Un-map Existing Groups of User and map to New Group When enabled, all previously assigned groups for the user are removed, and the user is mapped only to the groups specified in the claim.
Group Claim Name Enter the claim name that contains the group identifiers. Users will be mapped only if the group names in the claim match existing groups in the site.

Group-Claims-Settings

OpenID Connect Authentication

How do I configure OpenID Connect in the User Management Server?

You configure OpenID Connect in the Bold Reports® User Management Server with the same steps. Log in to the URL {Bold Reports URL}/ums/administration/sso?view=openid-settings with an admin credential.

Which OpenID Connect providers can I connect to Bold Reports®?

The following guides explain how to connect several OpenID Connect providers to the Bold Reports® application:

Can I turn off OpenID Connect for a single site?

Yes. OpenID Connect is provided on both the Bold Reports® sites and the User Management Server. You can manage it individually for each site on the settings page by disabling the option, as the following screenshot shows.

OpenId Global Authentication Control

Set OpenID Connect as Default Authentication

Bold Reports® can use OpenID Connect as the default authentication when the OpenID Connect settings are enabled and saved. Follow these steps:

  1. On the settings page, click the Authentication tab and select General.
  2. Enable the option Enable Default Authentication and select OpenID Connect as the default authentication provider, as shown in the following screenshot.

OpenId Default Setting

What happens when I disable OpenID Connect settings?

When OpenID Connect is the default authentication and you try to disable the OpenID Connect settings, Bold Reports® displays the following pop-up. Click Yes to proceed and disable the OpenID Connect default authentication.

OpenId Default Setting Popup

How do I bypass OpenID Connect authentication?

To log in to Bold Reports® as a normal user who is not from OAuth, use the following custom login URL when OpenID Connect default authentication is enabled:

{Bold Reports URL}/reporting/site/{tenant-name}/login?use_default_authentication=false

See also