This tab plays a role in the system configuration: it allows you to enter the parameters related to setting up identity federation for a connection via OpenID Connect.

Identity federation is a concept that makes it easy to share user information across different platforms. It allows the user to navigate between different services by authenticating only once.
This mechanism is implemented within an SSO (Single Sign-On) architecture and uses a standardized protocol such as OpenID Connect.
The CARL Source environment uses the OpenID Connect (OIDC) protocol.

Basic principle

1. The client requests access to a protected (secured) resource in the CARL Source application.

2. The CARL Source application sends an authentication request to the configured Identity Provider (IdP).

3. The Identity Provider redirects the user to its authentication page.

4. The user enters their credentials and submits the form for validation.

5. The Identity Provider verifies the login information.

6. If the login information is valid, it sends an authorization code to the CARL Source application.

7. Once the authorization code is received, the CARL Source application requests an access token from the Identity Provider, passing the authorization code and identification information.

8. Once the access-token request is received, the Identity Provider verifies the code and the identification information.

9. If the code and identification information are valid, the Identity Provider sends an ID token, an access token and optionally a refresh token to the CARL Source application.

10. After receiving the tokens, the CARL Source application verifies the ID token and signs in the corresponding user if everything is correct.

11. If the user could be signed in, the client accesses the protected resource it requested, only if authorized to do so.

Once authenticated, the client can access protected resources without having to re-authenticate as long as their session is active on the CARL Source application.

Configuration in CARL Source

[...]

For further information regarding the implementation of identity federation, please contact CARL Berger-Levrault technical support.