By default, the CSP Vault for VM Encryption is configured for local authentication. You can change the authentication method as required, but you can use only one type of authentication per vault at a time.

• If you want to use OpenID Connect (OIDC) without AD, you can configure OIDC authentication when only local authentication is configured.
• If you have configured AD or OIDC with AD, you cannot change to OIDC without AD. You must first delete all AD users and groups, then remove the AD and/or OIDC configuration before configuring OIDC without AD.

Each vault can be configured with a separate OIDC server or a separate application from same server.

For an example of how to configure an OIDC provider, see Example: Configuring Entrust Identity as a Service. If you are using a cluster, even though you configure OIDC for only one node, you will need to enter the Callback URIs (the Login Redirect URIs and Logout Redirect URIs) for all nodes in the cluster.

Complete the following procedures to configure OIDC for Vault for VM Encryption:

Prerequisites

Before you begin, make sure you have completed the following tasks:

• Create an OIDC application and a user in your identity provider (IdP)
• Obtain:
  
  • The client ID
  • The client secret

To configure OIDC 

1. Log into the CSP Vault for VM Encryption webGUI using an account with Security Admin privileges.
2. In the top menu bar, click Settings.
3. In the General Settings section, click Authentication. The General Settings window appears.
4. In the Choose Authentication Type drop-down list, select OpenID Connect.
5. Complete the following fields:
   • Client ID: Enter the client ID.
     

     Client ID is the organizational identity assigned by the OpenID Connect provider when you signed up for the service.

   • Client Secret: Enter the client secret.
     

     Client secret is a cryptographic component used to secure the organization's access to the OIDC provider

     This field is write-only. It will never be displayed again after it has been initially created. It can be reentered if necessary.

   • Base URL: Enter the URL that Cryptographic Security Platform Vault will use to contact the OpenID Connect provider to present the login page.
   • Name: Enter the name that you defined for the OpenID Connect provider. Cryptographic Security Platform Vault displays this name on the button on the login dialogs.

6. Optional. Click Browse to upload the CA Certificate. 

   The certificate needs to be in base64 encoded pem format.

7. Click Apply. The OpenID Connect Configuration window appears showing the current configuration.

8. Click Verify and Enable. After the verification, a message appears confirming OpenID Connect has been successfully enabled. The vault is now set for OIDC authentication.

9. Close the General Settings window.

To add an OIDC user

1. Log into the CSP Vault for VM Encryption webGUI using an account with Security Admin privileges.
2. In the top menu bar, click Security.
3. From the menu, select Users. 
4. From the Actions drop-down list, select Add User. The Add a New User window appears.
5. Select User and complete the following fields:
   • Authentication Type: From the drop-down list, select OpenID Connect.
   • Full Name: Enter the full name of the user.
   • Email: Enter the email of the user.
6. Click Next. The Privileges & Groups tab opens.
7. Select the role for the user based on your requirements. 
8. Click Add. The User Successfully Added window appears.
9. Copy the URL and provide it to the OIDC user. The user clicks the URL to register with the identity provider and the CSP Vault appliance.

   If you enabled Email notifications, the OIDC user receives an email with the OIDC URL. The user clicks the URL to register with the identity provider and the CSP Vault appliance.

   The URL is valid for only 24 hours.