Connect to your IdP with OpenID Connect

How to configure an OpenID Connect (OIDC) Single Sign-On connection between your Identity Provider (IdP) and Black Duck Portal, enabling users to authenticate through your organization's identity system.

Prerequisites

Setting up single sign-on requires the following:

Organization Admin permission in Black Duck Portal.
Sufficient permissions to create an integration with Black Duck Portal in your IdP.

Connect to your IdP with OpenID Connect

Follow these steps to set up an SSO connection with your IdP using OpenID Connect.

Note: OIDC connections use service-provider-initiated (SP-initiated) authentication only. After you set up single sign-on, users must access Black Duck Portal to start the authentication process. Black Duck Portal does not support IdP-initiated authentication for OIDC connections.

In Black Duck Portal, go to Org Admin > SSO Connections and select + Create SSO Connection.
The Create SSO Connection page opens.
If necessary, replace your tenant ID GUID in the Configuration Name field with a friendly name. The Configuration Name must be unique. In this example, we will name it example-oidc-connection.
Important: We strongly recommend you do not change the configuration name.

Configuration names can be up to 64 alphanumeric characters long and can include dashes.
Select OpenID Connect (OIDC) using the Identity Provider Strategy dropdown.
Provide your OIDC Discovery URL from your identity provider in the Discovery URL field.
Select Create Connection.
The Configuration URLs tab opens.
Use the Callback URL value to set up a connection to Black Duck Portal in your IdP.
Note: The steps to complete this step vary from IdP to IdP. When you register Black Duck Portal as an application in your IdP, your IdP will generate several values you'll need later on, including:
- Client ID
- Client Secret
Select Continue to Configuration.
The Configure Connection Details tab opens.

Enter your OpenID Connect connection information in the form.

Table 1. Configure Connection Details for OIDC form, fields reference
Field	Description
Client ID	The client ID for Black Duck Portal, generated by your IdP. This ID allows your IdP to recognize connection requests from Black Duck Portal as legitimate.
Client Secret	A confidential key generated by your IdP. Black Duck Portal uses this key to authenticate itself with your IdP.
Scopes (Optional)	Space-separated list of OAuth scopes to request from your IdP during authentication. Scopes define what information and permissions Black Duck Portal can access. Important: `openid` (required for OIDC), `profile` (basic user info), and `email` (user's email address) are enabled, even if they aren't listed in the Scopes field. For example: `openid profile email`
Email Domain for Home Realm Discovery (Optional)	Comma-separated list of email domains that automatically direct users to this IdP connection when they sign in. For example: `company.com,subsidiary.com` When users with matching email domains access the login page, they're routed directly to this IdP without needing to select it manually. This simplifies login for organizations with multiple identity providers or domains.

Select Save Configuration.

Enable SCIM provisioning (optional)

Now, you have the option to enable System for Cross-domain Identity Management (SCIM) provisioning.

SCIM provisioning automates user lifecycle management between your identity provider and Black Duck Portal. While SSO handles authentication, SCIM provisioning handles provisioning—automatically creating, updating, and removing user accounts based on changes in your identity provider.

See Enable SCIM provisioning (optional) for more information.

Next steps

Next, grant users access to Black Duck Portal in your IdP. The steps to complete this vary from IdP to IdP.

Important: After you grant a user access to Black Duck Portal, the user must sign in to Black Duck Portal successfully (using single sign-on) before their user information appears on the Users tab (Org Admin > Users).