Specifying preauthentication and postauthentication activities for an OpenID Connect SSO authentication service
To customize the login process, you can write activities that will be triggered before and after OpenID Connect authentication. For example, a postauthentication activity can update the operator record with values from the service provider or can refuse an automatically provisioned user access to an application.
- Create your preauthentication and postauthentication activities. For more
information, see the sample activities
pySSOPreAuthenticationActivity and
pySSOPostAuthenticationActivity. When you write these
activities, consider the following:
- Update the pega Browser requestor type's default access group to equal an access group that includes the ruleset of the preauthentication activity. The preauthentication activity must be accessible to the pega Browser requestor type, which is used for the unauthenticated user session. By default, this requestor type is assigned to the PRPC:Unauthenticated access group.
- Create the postauthentication activity in a ruleset that is accessible to the user's default access group. The postauthentication activity must be accessible to the user who has just been authenticated.
- Set the Applies To key part of the activities to Code-Security.
- Set the authentication result in
pyAuthenticationPolicyResult to
trueto proceed with authentication, or set tofalseto terminate the request; for example:tools.getRequestor().getRequestorPage().putString("pyAuthenticationPolicyResult", "true"); - You can dynamically update the user’s role list by using a
postauthentication activity. This is useful if you want to dynamically
add roles to the user context at login without maintaining multiple
access groups in the database for all combinations of roles. In the
postauthentication activity, update the list of roles by calling
setRoles, as shown in the following
example.
tools.getAuthorizationHandle().setRoles(tools, tools.getAuthorizationHandle().UPDATE_APPEND, rolesList);
- Open the service from the navigation panel in Dev Studio by clicking and choosing a service from the instance list.
- On the OpenID Connect tab, expand the Advanced configuration settings section.
- In the Pre-authentication activity field, enter the name of the preauthentication activity.
- In the Post-authentication activity field, enter the name of the postauthentication activity.
- Click Save.
Previous topic Mapping operator information for an OpenID Connect SSO authentication service Next topic Requiring reauthentication for new and expired sessions for an OpenID Connect SSO authentication service