| At line 4 changed 5 lines |
| __!!!Important__: Ensure that all {{''__(Required)__''}} fields are properly configured as outlined on this wiki page.\\ |
| \\ |
| __!!! Proxy Configuration__: If your server accesses the internet through a proxy, ensure that the __Identity Provider__’s (IdP’s) domains are whitelisted to allow the authentication process.\\ |
| \\ |
| __!!! Constraints__:\\ |
| ---- |
| __⚠️ Important__: Ensure that all {{''__(Required❗)__''}} fields are properly configured as outlined on this wiki page.\\ |
| ---- |
| __⚠️ Proxy Configuration__: If your server accesses the internet through a proxy, ensure that the __Identity Provider__’s (IdP’s) domains are whitelisted to allow the authentication process.\\ |
| ---- |
| __⚠️ Constraints__:\\ |
| At line 19 added one line |
| \\ |
| At line 29 changed one line |
| __!!!See details at__: [Apple Sign In Configuration]\\ |
| __⚠️ See details at__: [Apple Sign In Configuration]\\ |
| At line 31 changed 4 lines |
| __Google__: Refer to the App registration section under: [Google OAuth 2.0 Link| https://www.crushftp.com/crush11wiki/Wiki.jsp?page=SMTP%20Google%20Mail%20Integration#section-SMTP+Google+Mail+Integration-1.GoogleMailOAuth2.0]. Adjust the redirect URL to meet CrushOIDC requirements. The redirect URL must target the CrushFTP server and conclude with __/SSO_OIDC/__. Like:\\ |
| {{{ |
| https://your.domain.com/SSO_OIDC/ |
| }}}\\ |
| __Google__:\\ |
| __1.__ Go to: __Google Cloud Console__ – __Credentials__: [Google APIs & Services Link|https://console.developers.google.com/projectselector/apis/credentials]\\ |
| __2.__ Create an __OAuth 2.0 Client ID__\\ |
| • Application type: __Web application__\\ |
| • Set your __Redirect URL__ (e.g., https://your.domain.com/SSO_OIDC/)\\ |
| __3.__ Enable the __People API__ (if you need access to the user’s name, profile pic, ...)\\ |
| • Navigate to __APIs & Services__ -> __Library__\\ |
| • Search for __People API__ and click __Enable__\\ |
| At line 36 changed 2 lines |
| __Microsoft__: Refer to the App registration: [Microsoft Sign in Configuration] ensure the redirect URL is described above.\\ |
| __Microsoft B2C__: Refer to the App registration section under: [Azure Active Directory B2C Configuration] ensure the redirect URL is described above.\\ |
| As a reference example, see the [GDriveSetup] documentation.\\ |
| At line 39 changed one line |
| __Amazon Cognito__: Refer to the App registration section under: [Amazon Cognito Configuration] ensure the redirect URL is described above.\\ |
| __Microsoft__: Refer to the App registration: [Microsoft Sign in Configuration]\\ |
| \\ |
| __Microsoft B2C__: Refer to the App registration section under: [Azure Active Directory B2C Configuration]. Ensure the redirect URL is described above.\\ |
| At line 41 changed 2 lines |
| __Dropbox__: Refer to the App registration section under: [Dropbox Integration] ensure the redirect URL is described above.\\ |
|
| __Amazon Cognito__: Refer to the App registration section under: [Amazon Cognito Configuration]. Ensure the redirect URL is described above.\\ |
| At line 50 added 2 lines |
| __Dropbox__: Refer to the App registration section under: [Dropbox Integration]. Ensure the redirect URL is described above.\\ |
| \\ |
| At line 50 changed one line |
| !2.1.1 OpenID Configuration URL {{''__(Required)__''}}: \\ |
| !2.1.1 OpenID Configuration URL {{''__(Required❗)__''}}: \\ |
| At line 55 changed one line |
| • Authorization endpoint {{''__(Required)__''}}\\ |
| • Authorization endpoint {{''__(Required❗)__''}}\\ |
| At line 93 changed one line |
| !2.1.3 Authorization related settings {{''__(Required)__''}}:\\ |
| !2.1.3 Authorization related settings {{''__(Required❗)__''}}:\\ |
| At line 104 changed one line |
| • {oidc_redirect_url}: An autogenerated URL by CrushFTP, composed of the initial host and port, followed by __/SSO_IDC/__. This URL is used to redirect the user after successful authentication. __!!! It must exactly match the redirect URL registered and configured in the IdP.__\\ |
| • {oidc_redirect_url}: An autogenerated URL by CrushFTP, composed of the initial host and port, followed by __/SSO_IDC/__. This URL is used to redirect the user after successful authentication. __⚠️ It must exactly match the redirect URL registered and configured in the IdP.__\\ |
| At line 120 changed one line |
| __The refresh token enables access to the user's cloud storage through the IdP. __CrushFTP supports cloud storage integration with services such as Google Drive ([GDriveSetup]), OneDrive ([OneDriveSetup]), SharePoint ([SharePoint Integration]), and Dropbox ([Dropbox Integration]).\\ |
| __The refresh token enables access to the user's cloud storage through the IdP. __CrushFTP supports cloud storage integration with services such as Google Drive ([GDriveSetup]), Google Cloud Storage ([Google Cloud Storage Integration]), OneDrive ([OneDriveSetup]), SharePoint ([SharePoint Integration]), and Dropbox ([Dropbox Integration]).\\ |
| At line 124 changed 2 lines |
| Google: https://www.googleapis.com/auth/drive |
| Dropbox: files.metadata.write files.content.write files.content.read |
| Google: https://www.googleapis.com/auth/drive |
|
| GStorage: https://www.googleapis.com/auth/devstorage.full_control |
|
| Dropbox: files.metadata.write files.content.write files.content.read |
| At line 137 changed one line |
| __Verify ID Token:__ The Authorization Code Flow uses the code value returned by the IdP to obtain the ID token. Although this step is not mandatory in the OpenID protocol, you can enable an additional verification of the returned ID token by selecting this checkbox. __!!!__ This feature works only if the OpenID configuration includes the "__jwks_uri__" endpoint. __It provides an extra layer of validation for the ID token.__\\ |
| __Verify ID Token:__ The Authorization Code Flow uses the code value returned by the IdP to obtain the ID token. Although this step is not mandatory in the OpenID protocol, you can enable an additional verification of the returned ID token by selecting this checkbox. ⚠️ This feature works only if the OpenID configuration includes the "__jwks_uri__" endpoint. __It provides an extra layer of validation for the ID token.__\\ |
| At line 141 changed one line |
| __Check User Endpoint URL?__: This option enables CrushFTP to retrieve additional information about the user from the IdP via the "__user_info__" endpoint URL. __!!!__ This feature only works if the OpenID configuration includes a "userinfo_endpoint" URL or if you manually specify it in the "__User Endpoint URL__" input field. \\ |
| __Check User Endpoint URL?__: This option enables CrushFTP to retrieve additional information about the user from the IdP via the "__user_info__" endpoint URL. ⚠️ This feature only works if the OpenID configuration includes a "userinfo_endpoint" URL or if you manually specify it in the "__User Endpoint URL__" input field. \\ |
| At line 145 changed one line |
| __Special Case for Microsoft Azure AD:__ When using __Microsoft Azure AD__ as the Identity Provider (IdP), a specific user endpoint is required to retrieve group information for the authenticated user:\\ |
| ⚠️ __Special Case for Microsoft Azure AD:__ When using __Microsoft Azure AD__ as the Identity Provider (IdP), a specific user endpoint is required to retrieve group information for the authenticated user:\\ |
| At line 160 changed one line |
| __Claim as Username__ {{''__(Required)__''}}: Specify the name of the claim within the IdP's response that should be used as the __username for the CrushFTP session__. |
| __Claim as Username__ {{''__(Required❗)__''}}: Specify the name of the claim within the IdP's response that should be used as the __username for the CrushFTP session__. |
| At line 162 changed one line |
| __!!!__ If this claim is not present or its value is missing in the IdP's response (either within the ID Token or retrieved from the user endpoint), __the authentication will fail due to a missing username__.\\ |
| __⚠️__ If this claim is not present or its value is missing in the IdP's response (either within the ID Token or retrieved from the user endpoint), __the authentication will fail due to a missing username__.\\ |
| At line 172 changed one line |
| __Enable__: Activate the plugin. {{''__(Required)__''}}\\ |
| __Enable__: Activate the plugin. {{''__(Required❗)__''}}\\ |
| At line 178 changed one line |
| !2.2.1 Login Button {{''__(Required)__''}}:\\ |
| !2.2.1 Login Button {{''__(Required❗)__''}}:\\ |
| At line 183 changed one line |
| !2.2.2 Username matching {{''__(Required)__''}}:\\ |
| !2.2.2 Username matching {{''__(Required❗)__''}}:\\ |
| At line 201 changed one line |
| !2.2.5 User Templates {{''__(Required)__''}}:\\ |
| !2.2.5 User Templates {{''__(Required❗)__''}}:\\ |
| At line 203 changed 2 lines |
| __Template Username__: The signed-in user inherits both the settings and the VFS items(as Linked [VFS]). __It must have a value!__\\ |
| __Import settings from CrushFTP user__: The signed-in user inherits only the settings from the specified user. __It must have a value!__\\ |
| __Template Username__: The signed-in user inherits both the settings and the VFS items(as Linked [VFS]). ⚠️ __It must have a value!__\\ |
| __Import settings from CrushFTP user__: The signed-in user inherits only the settings from the specified user. ⚠️ __It must have a value!__\\ |
| At line 212 changed one line |
| __!!! Important__: If roles are configured and the IdP's user does not match any of the predefined roles, the authentication will be rejected due to the absence of matching roles.\\ |
| __⚠️ Important__: If roles are configured and the IdP's user does not match any of the predefined roles, the authentication will be rejected due to the absence of matching roles.\\ |
| At line 215 changed one line |
| __!!! Important__: Template user must exist in the [User Manager], otherwise, it will have no effect.\\ |
| __⚠️ Important__: Template user must exist in the [User Manager], otherwise, it will have no effect.\\ |
| At line 224 removed one line |
|
| At line 250 changed one line |
| !2.2.7 Custom VFS {{''__(Required Under Specific Conditions)__''}}: |
| !2.2.7 Custom VFS {{''__(Required Under Specific Conditions❗)__''}}: |
| At line 253 changed one line |
| __!!! Important:__ If the CrushOIDC user has no assigned VFS, __authentication will be rejected due to the absence of an assigned [VFS]__. CrushOIDC user can inherit VFS configuration from:\\ |
| __⚠️ Important:__ If the CrushOIDC user has no assigned VFS, __authentication will be rejected due to the absence of an assigned [VFS]__. CrushOIDC user can inherit VFS configuration from:\\ |
| At line 258 changed one line |
| __Custom VFS examples:__ Uses the refresh token obtained through OpenID Connect authentication.\\ |
| __Custom VFS examples:__ This Custom VFS setup allows access to remote resources using a refresh token obtained through OpenID Connect (OIDC) authentication.\\ |
| At line 263 removed one line |
| |
| At line 265 removed one line |
| |
| At line 267 changed 2 lines |
| \\ |
| __!!! It requires the scope__:\\ |
| __More info at__: [GDriveSetup]\\ |
| __⚠️ It requires the scope__:\\ |
| At line 279 added one line |
| [CrushOIDC/oidc_gdrive_settings.png] |
| At line 272 changed one line |
| __b.) OneDrive__:\\ |
| __b.) Google Cloud Storage__:\\ |
| \\ |
| {{{ |
| gstorage://{oidc_client_id}~{oidc_client_secret_decoded}:{oidc_refresh_token}@storage.googleapis.com/ |
| }}}\\ |
| \\ |
| __More info at__: [Google Cloud Storage Integration]\\ |
| __⚠️ It requires the scope__:\\ |
| {{{ https://www.googleapis.com/auth/devstorage.full_control}}}\\ |
| Check the description of : __2.1.3 Authorization related settings__ [Link|https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CrushOIDC#section-CrushOIDC-2.1.3AuthorizationRelatedSettingsRequired] regarding scope.\\ |
| [CrushOIDC/oidc_gstorage_settings.png]\\ |
| \\ |
| __c.) OneDrive__:\\ |
| \\ |
| At line 274 changed 3 lines |
|
| OneDrive: onedrive://{oidc_client_id}~{oidc_client_secret_encoded}:{oidc_refresh_token}@graph.microsoft.com/ |
|
| Onedrive Personal Type: onedrive://{oidc_client_id}~{oidc_client_secret_encoded}:{oidc_refresh_token}@graph.microsoft.com/ |
| or |
| OneDrive Business Type: onedrive://app_permission~{oidc_client_id}:{oidc_client_secret_decoded}@graph.microsoft.com/ |
| At line 278 changed 2 lines |
|
| __!!!__ Ensure the __Azure App Registration__ includes the required __API Permission__ (More info at [OneDriveSetup]).\\ |
| __More info at__: [OneDriveSetup]\\ |
| __⚠️ Note__:\\ |
| -Ensure the __Azure App Registration__ includes the required __API Permission__ (More info at [OneDriveSetup]).\\ |
| -__User id or User principal name__: Provide the user's ID or the user principal name (UPN) or {user_name} variable.\\ |
| [CrushOIDC/oidc_onedrive_settings.png]\\ |
| At line 281 changed one line |
| __c.) DropBox__:\\ |
| __d.) SharePoint__:\\ |
| \\ |
| {{{ |
| Sharepoint Delegated Permission: sharepoint://{oidc_client_id}~{oidc_client_secret_encoded}:{oidc_refresh_token}@graph.microsoft.com/ |
| or |
| Sharepoint Application Permission: sharepoint://app_permission~{oidc_client_id}:{oidc_client_secret_decoded}@graph.microsoft.com/ |
| or |
| SharePoint REST service API-based: sharepoint2://delegated_permission~{oidc_client_id}~{oidc_client_secret_encoded}:{oidc_refresh_token}@graph.microsoft.com/ |
| }}}\\ |
| __More info at__: [SharePoint Integration]\\ |
| __⚠️ Note__:\\ |
| - Ensure the __Azure App Registration__ includes the required __API Permission__ (More info at [SharePoint Integration]).\\ |
| - __Configure the Sharepoint-specific settings__ too (More info at [SharePoint Integration]):\\ |
| __Tennant:__ See at App Registration -> Overview -> Directory (tenant) ID. Based on the App Registration Account type it can be an ID, common, or consumer. |
| __Site id__ : The SharePoint domain name.\\ |
| __Site Path__: The path of the SharePoint site. It should start and end with a slash.\\ |
| __Drive name__: Each SharePoint site has a Document Library where the site-related files are stored. See [SharePoint: Documents and Libraries Description Link|https://support.microsoft.com/en-us/office/what-is-a-document-library-3b5976dd-65cf-4c9e-bf5a-713c10ca2872] Provide its name\\ |
| __Folder__: Relative path of the document library of the SharePoint site.\\ |
| [CrushOIDC/oidc_sharepoint2_settings.png]\\ |
| \\ |
| __e.) DropBox__:\\ |
| \\ |
| At line 283 removed one line |
|
| At line 285 removed one line |
| |
| At line 331 added 2 lines |
| More info at: [Dropbox Integration]\\ |
| [CrushOIDC/oidc_dropbox_settings.png]\\ |
