analytics/templates/AAA/OIDC_Generic.xml

<!-- OIDC-Generic: Defines a group of properties that allows the product to use an OpenID 
             Connect identity provider for user authentication.  -->
<!-- Set the values for this group of properties to allow the product access to your existing 
             OpenID connect identity provider. This external resource must already exist in your 
             environment and be configured to use for authentication.  -->
<crn:instance name="MANDATORY" class="OIDC_Generic">
	<!-- identityProviderType: Specifies the implementation of an OpenID Connect identity 
               provider.  -->
	<crn:parameter name="identityProviderType">
		<crn:value xsi:type="xsd:string">Generic</crn:value>
	</crn:parameter>
	<!-- id: Specifies a unique identifier for the authentication namespace.  -->
	<!-- Use the namespace identifier to distinguish between multiple namespaces. Each namespace 
               must have a unique identifier. When you select a namespace to use for authentication 
               in the run-time environment, the identifier is used by the IBM Cognos components. 
               Changing the namespace ID after the service has been started may invalidate the object 
               security policies and the Cognos group and role memberships. The use of the colon 
               in the Namespace ID is not supported.  -->
	<crn:parameter name="id">
		<crn:value xsi:type="xsd:string">MANDATORY</crn:value>
	</crn:parameter>
	<!-- selectableForAuth: Specifies whether the namespace is selectable for authentication.  -->
	<!-- If this property is set to true, the namespace will be available for authentication 
               in the logon page namespace selection prompt. Set this value to false if the namespace 
               should not be available for selection on the logon page.  -->
	<crn:parameter name="selectableForAuth">
		<crn:value xsi:type="xsd:boolean">true</crn:value>
	</crn:parameter>
	<!-- advancedProperties: Specifies a set of advanced properties.  -->
	<!-- The user needs to provide the name and the value for each advanced property.  -->
	<crn:parameter name="advancedProperties" opaque="true">
		<crn:value xsi:type="cfg:array"/>
	</crn:parameter>
	<!-- useDiscoveryEndpoint: Specifies whether the Identity Provider returns a discovery 
               document.  -->
	<!-- Set this value to true if the Identity Provider supports a discovery document endpoint 
               and fill out the discovery endpoint configuration group. Set this value to false 
               if the Identity Provider does not support a discovery document endpoint and fill 
               out the non-discovery endpoint configuration group.  -->
	<crn:parameter name="useDiscoveryEndpoint">
		<crn:value xsi:type="xsd:boolean">true</crn:value>
	</crn:parameter>
	<!-- oidcDiscEndpoint: Specifies the OpenID Connect discovery endpoint  -->
	<!-- The discovery endpoint is used to retrieve the OpenID Connect configuration that 
               includes the authorization endpoint, token endpoint, jwks endpoint, and issuer.  -->
	<crn:parameter name="oidcDiscEndpoint">
		<crn:value xsi:type="cfg:anyPathURI"/>
	</crn:parameter>
	<!-- issuer: Specifies the OpenID claim issuer.  -->
	<!-- A string that represents the identity provider that issued the claims in the ID token. 
               This value must match the value of the 'iss' entry in the ID token JSON document.  -->
	<crn:parameter name="issuer">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- oidcTokenEndpoint: Specifies the OpenID Connect token endpoint, using the following 
               syntax: https://<hostname:port>/<path>  -->
	<!-- The token endpoint is used to retrieve the identity token after a successful authentication 
               to the OpenID Connect identity provider.  -->
	<crn:parameter name="oidcTokenEndpoint">
		<crn:value xsi:type="cfg:anyPathURI"/>
	</crn:parameter>
	<!-- oidcAuthEndpoint: Specifies the OpenID Connect authorization endpoint, using the 
               following syntax: https://<hostname:port>/<path>  -->
	<!-- The authorization endpoint is a URL that your OpenID Connect identity provider uses 
               for authentication. In most cases, the URL should use the https scheme. The authorization 
               endpoint is invoked when users authenticate to the OpenID Connect identity provider.  -->
	<crn:parameter name="oidcAuthEndpoint">
		<crn:value xsi:type="cfg:anyPathURI"/>
	</crn:parameter>
	<!-- clientId: Specifies the OpenID Connect client identifier  -->
	<!-- The client identity that is assigned to the application by the OpenID Connect identity 
               provider.  -->
	<crn:parameter name="clientId">
		<crn:value xsi:type="xsd:string">MANDATORY</crn:value>
	</crn:parameter>
	<!-- returnUrl: Return URL that is configured with the OpenID Connect identity provider.  -->
	<!-- The return URL is invoked by the OpenID Connect identity provider after successfully 
               authenticating a user. The URL format is https://dispatcherHOST:dispatcherPORT/bi/completeAuth.jsp 
               or https://webserverHOST:webserverPORT/ibmcognos/bi/completeAuth.jsp. This URL completes 
               Cognos Analytics authentication using the OpenID Connect identity provider.  -->
	<crn:parameter name="returnUrl">
		<crn:value xsi:type="cfg:anyPathURI">MANDATORY</crn:value>
	</crn:parameter>
	<!-- authScope: Specifies the scope parameter values provided to the authorize endpoint.  -->
	<!-- The scope parameter values that will be added to the authorize endpoint URL for authentication. 
               At a minimum, 'openid' must be included in the list of possible scope values.  -->
	<crn:parameter name="authScope">
		<crn:value xsi:type="xsd:string">openid</crn:value>
	</crn:parameter>
	<!-- accountClaims: Specifies if the id_token contains all of the account claims.  -->
	<!-- Set this value to token if the id_token contains all of the user claims. Set this 
               value to userinfo if an additional call should be made to the userinfo endpoint in 
               order to retrieve any user claims that are not part of the id_token.  -->
	<crn:parameter name="accountClaims">
		<crn:value xsi:type="xsd:string">token</crn:value>
	</crn:parameter>
	<!-- tokenEndpointAuth: Specifies how to authenticate to the Identity Provider when invoking 
               the token endpoint.  -->
	<!-- Use client secret post if the client id and client secret should be transmitted in 
               the request body. Use client secret basic if the client id and client secret should 
               be transmitted in the HTTP header. Use private key JWT if the client id and a JWT 
               client_assertion that is signed with a private key should be transmitted in the request 
               body.  -->
	<crn:parameter name="tokenEndpointAuth">
		<crn:value xsi:type="xsd:string">client_secret_post</crn:value>
	</crn:parameter>
	<!-- clientSecret: Specifies the client secret that is assigned to the application by 
               the OpenID Connect identity provider.  -->
	<!-- The client secret that is assigned to the application by the OpenID Connect identity 
               provider.  -->
	<crn:parameter name="clientSecret">
		<crn:value xsi:type="xsd:string" encrypted="true"></crn:value>
	</crn:parameter>
	<!-- privateKeyFile: Specifies the file that contains the private signing key.  -->
	<!-- The file that contains the private signing key in PKCS8 format. It must contain a 
               single private RSA key of length 2048 bits.  -->
	<crn:parameter name="privateKeyFile">
		<crn:value xsi:type="cfg:filePath"/>
	</crn:parameter>
	<!-- privateKeyPassword: Specifies the private key password used to protect the private 
               signing key.  -->
	<!-- This password is required to secure the private key. It provides an extra layer of 
               security by encrypted the private key file using a password.  -->
	<crn:parameter name="privateKeyPassword">
		<crn:value xsi:type="xsd:string" encrypted="true"></crn:value>
	</crn:parameter>
	<!-- privateKeyId: Specifies the key identifier that should be placed in the JWT header.  -->
	<!-- The key identifier that will be set in the JWT 'kid' header. Use this configuration 
               item if your identity provider requires a 'kid'. Leave this value blank if your identity 
               provider does not require a 'kid'.  -->
	<crn:parameter name="privateKeyId">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- keyLocation: Specifies the location of the signing public key or certificate.  -->
	<!-- Set this value to 'File' if the signing certificate is manually downloaded from the 
               Identity Provider as a certificate and placed on the file system. Set this value 
               to 'JWKS endpoint' if the Identity Provider supports an endpoint for retrieving id_token 
               signature keys. Note: if the Identity Provider does not support a discovery document 
               but provides public keys via a JWKS endpoint, then the JWKS Endpoint must contain 
               a valid URI for retrieving the public keys.  -->
	<crn:parameter name="keyLocation">
		<crn:value xsi:type="xsd:string">jwks_uri</crn:value>
	</crn:parameter>
	<!-- idpCertificateFile: Specifies the location of the certificate that is used by the 
               OpenID Connect identity provider to sign the identity token.  -->
	<!-- A path to the file that contains the certificate used by the identity provider to 
               sign the JSON Web Token. The path must include the certificate file name and be accessible 
               to the running instance of Cognos Analytics. The certificate must be in a PEM format, 
               include only the public key certificate, and include the begin and end certificate 
               lines. The certificate file cannot be placed in the configuration/certs directory.  -->
	<crn:parameter name="idpCertificateFile">
		<crn:value xsi:type="cfg:filePath"/>
	</crn:parameter>
	<!-- jwksEndpoint: Specifies the OpenID Connect endpoint for retrieving JWT signing keys.  -->
	<!-- The JWKS endpoint is a URL that your OpenID Connect identity provider uses to provide 
               signing key data. In most cases, the URL should use the https scheme. The JWKS endpoint 
               is invoked when validating an id_token returned from the identity provider.  -->
	<crn:parameter name="jwksEndpoint">
		<crn:value xsi:type="cfg:anyPathURI"/>
	</crn:parameter>
	<!-- pgStrategy: Specifies how to get the user's identity when using the password grant 
               flow.  -->
	<!-- Set this value to 'ID token' if all user claims are returned in the id_token. Set 
               this value to 'ID token and userinfo endpoint' if an id_token is returned from the 
               password grant flow but does not contain all of the user claims. Set this value to 
               'Userinfo endpoint' if the id_token does not contain any user claims and if the user 
               claims should be retrieved from the userinfo endpoint. Set this value to 'Unsupported' 
               if the Identity Provider does not support the password grant flow.  -->
	<crn:parameter name="pgStrategy">
		<crn:value xsi:type="xsd:string">idToken</crn:value>
	</crn:parameter>
	<!-- pgInclScope: Specifies that the scope should be included when using the password 
               grant flow.  -->
	<!-- Set this value to true to indicate that the scope parameter should be included as 
               part of the query string for the password grant flow. Set this value to false to 
               indicate that the scope should be omitted from the query string for the password 
               grant flow.  -->
	<crn:parameter name="pgInclScope">
		<crn:value xsi:type="xsd:boolean">true</crn:value>
	</crn:parameter>
	<!-- pgAddParams: Specifies any additional parameters that are required for the password 
               grant flow.  -->
	<!-- Set this value to reflect any additional parameters that should be included as part 
               of the query string for the password grant flow. The parameter must begin with an 
               '&' and must be urlencoded so that it can be safely inserted into the query string. 
               For example, if the 'resource=https://ca.ibm.com' parameter is required in the query 
               string, it must be entered as: '&resource=https%3A%2F%2Fca.ibm.com'.  -->
	<crn:parameter name="pgAddParams">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- tcStrategy: Specifies the information that should be stored for scheduling jobs.  -->
	<!-- Set this value to 'Credentials' if the Identity Provider supports the password grant 
               and returns a valid id_token that contains all of the user claims in the response. 
               Set this value to 'Credentials and ID token' if the Identity Provider supports the 
               password grant flow but does not return a valid id_token in the response or if the 
               id_token does not contain all of the user claims. Set this value to 'Refresh token' 
               if the Identity Provider supports the refresh token flow, provides a non-expiring 
               refresh token, and returns a valid id_token that contains all of the user claims 
               from the refresh token flow. Set this value to 'ID token only' if the Identity Provider 
               does not support the password grant nor refresh token flows (Note: when set to 'ID 
               token only', it will not be possible to verify that the user is still exists and 
               is enabled in the Identity Provider).  -->
	<crn:parameter name="tcStrategy">
		<crn:value xsi:type="xsd:string">credentials</crn:value>
	</crn:parameter>
	<!-- tcAccountClaims: Specifies if the id_token contains all of the account claims.  -->
	<!-- Set this value to 'ID token' if the id_token returned from the token endpoint contains 
               all of the user claims. Set this value to 'Userinfo endpoint' if an additional call 
               to the userinfo endpoint is required in order to obtain all of the user claims.  -->
	<crn:parameter name="tcAccountClaims">
		<crn:value xsi:type="xsd:string">id_token</crn:value>
	</crn:parameter>
	<!-- tenantIdMapping: Specifies how namespace users are mapped to tenant IDs.  -->
	<!-- Specifying a value for this parameter enables multitenancy. The tenant ID for a user 
               can be determined using a pattern or a tenant provider class. The pattern is a AAA 
               service search path to a property which defines a tenant ID. The search path must 
               be relative to a user account. For example: '~/ancestors[2]/defaultName'. A tenant 
               provider class is Java class which implements the the ITenantProvider interface. 
               For more details please consult the installation and configuration guide.  -->
	<crn:parameter name="tenantIdMapping" opaque="true">
        <crn:value xsi:type="cfg:tenancyInfo">
          <crn:item name="pattern" xsi:type="xsd:string"></crn:item>
        </crn:value>
      </crn:parameter>
	<!-- tenantBoundingSetMapping: Specifies how the tenant bounding set is determined for 
               a user.  -->
	<!-- This parameter is used when multitenancy is enabled. The tenant bounding set for 
               a user can be determined using a pattern or a tenant bounding set provider class. 
               The pattern is a AAA service search path to a property which defines a tenant bounding 
               set. The search path must be relative to a user account. For example: '˜/parameters/boundingSet'. 
               A tenant bounding set provider class is Java class which implements the the IBoundingSetProvider 
               interface. For more details please consult the installation and configuration guide.  -->
	<crn:parameter name="tenantBoundingSetMapping" opaque="true">
		<crn:value xsi:type="cfg:tenancyInfo">
			<crn:item name="pattern" xsi:type="xsd:string"></crn:item>
		</crn:value>
	</crn:parameter>
	<!-- accountCamidProperty: Specifies the value used to uniquely identify account objects.  -->
	<!-- Specify either an existing Content Manager account object model property (e.g., email, 
               username, defaultName, etc) or the name of a configured custom property. A claim 
               must be returned for all accounts from the Identity Provider for either the Content 
               Manager account object model property or the configured custom property. The value 
               selected must be unique across all account objects. The value selected should be 
               constant over time with a low probability of needing to be changed. NOTE: this value 
               should not be changed after initial namespace configuration.  -->
	<crn:parameter name="accountCamidProperty">
		<crn:value xsi:type="xsd:string">email</crn:value>
	</crn:parameter>
	<!-- acEncoding: Specifies if the claims in the id_token are URL encoded.  -->
	<!-- Set this value to URL encoded if the claims in the id_token are URL encoded. Set 
               this value to Not encoded if the claims in the id_token are not encoded.  -->
	<crn:parameter name="acEncoding">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- acBusinessPhone: Specifies the OIDC claim used for the "businessPhone" property for 
               an account.  -->
	<crn:parameter name="acBusinessPhone">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- acContentLocale: Specifies the OIDC claim used for the "contentLocale" property for 
               an account.  -->
	<crn:parameter name="acContentLocale">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- acDescription: Specifies the OIDC claim used for the "description" property for an 
               account.  -->
	<crn:parameter name="acDescription">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- acEmail: Specifies the OIDC claim used for the "email" property for an account.  -->
	<crn:parameter name="acEmail">
		<crn:value xsi:type="xsd:string">email</crn:value>
	</crn:parameter>
	<!-- acFaxPhone: Specifies the OIDC claim used for the "faxPhone" property for an account.  -->
	<crn:parameter name="acFaxPhone">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- acGivenName: Specifies the OIDC claim used for the "givenName" property for an account.  -->
	<crn:parameter name="acGivenName">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- acHomePhone: Specifies the OIDC claim used for the "homePhone" property for an account.  -->
	<crn:parameter name="acHomePhone">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- acMemberOf: Specifies the OIDC claim used for the "memberOf" property for an account.  -->
	<crn:parameter name="acMemberOf">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- acMobilePhone: Specifies the OIDC claim used for the "mobilePhone" property for an 
               account.  -->
	<crn:parameter name="acMobilePhone">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- acName: Specifies the OIDC claim used for the "name" property for an account.  -->
	<crn:parameter name="acName">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- acPagerPhone: Specifies the OIDC claim used for the "pagerPhone" property for an 
               account.  -->
	<crn:parameter name="acPagerPhone">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- acPostalAddr: Specifies the OIDC claim used for the "postalAddress" property for 
               an account.  -->
	<crn:parameter name="acPostalAddr">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- acProductLocale: Specifies the OIDC claim used for the "productLocale" property for 
               an account.  -->
	<crn:parameter name="acProductLocale">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- acSurname: Specifies the OIDC claim used for the "surname" property for an account.  -->
	<crn:parameter name="acSurname">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- acUsername: Specifies the OIDC claim used for the "userName" property for an account.  -->
	<crn:parameter name="acUsername">
		<crn:value xsi:type="xsd:string"/>
	</crn:parameter>
	<!-- customProperties: Specifies a set of custom properties.  -->
	<!-- Use this set of custom properties to define additional account information. The "name" 
               field corresponds to the property name set in the account while the "value" corresponds 
               to the claim name in the id_token.  -->
	<crn:parameter name="customProperties" opaque="true">
		<crn:value xsi:type="cfg:array"/>
	</crn:parameter>
</crn:instance>