Skip to main content

Identity Provider - SSO

Identity Provider service Single sign-on support.

Prerequisites​

SSO - Flow​

Backend SSO configuration (c#)​

For opt-in sign-in termination by sid, protocol behavior and activation requirements, see Session logout.

Backend SSO Prerequisites (c#)​

Example of configuration for ASP.NET Core project which hosting your RestAPI:

"SsoAuthOptions": {
    "Authority": "https://[HostName]/api/asol/idp",
    "EnableCaching": true,
    "CacheDuration": "00:01:00",
    "RequireHttpsMetadata": false,
    "Audience": "apiim",
},

Example of dependency injection register SSO authentication services:

// Configure ASP.NET Core authentication
services.AddPlatformAuthentication(configuration);

IDP access-token lifetime​

The default OIDC access-token lifetime is 600 seconds (10 minutes) for user sign-in, refresh and client_credentials grants. Configure it in the IDP host's appsettings:

{
  "OIDCOptions": {
    "AccessTokenLifetimeSeconds": 600
  }
}

Alternatively, set OIDCOptions__AccessTokenLifetimeSeconds=600. The value must be a positive 32-bit integer; invalid values prevent startup. Omitting it uses 600 seconds. Restart all IDP instances after changing it. To restore the previous one-hour default, set it to 3600 and restart.

An explicit lifetime set during token issuance or in the client's Application.Settings["tkn_lft:act"] takes precedence over this default. See client registration.

Changes apply to newly issued access tokens. Existing JWTs keep their original expiration; refresh-token and ID-token lifetimes and SSO cookie settings are unaffected. For logout behavior, see Session logout.