OpenID providers

invoiceR can hand over the login to an OpenID Connect provider, for example Microsoft Entra ID. Users then log in with their company account (see Log in and log out).

You can also set up several providers at the same time, for example when several organizations with their own directory use the same invoiceR.

How invoiceR chooses the provider

• One provider is unambiguous: invoiceR redirects the user straight to the provider’s login.
• Several providers are possible: The user stays on the login page. Besides the login with user name and password, they see one button per provider and choose themselves.

invoiceR login page with the form for user name and password and below it two buttons “Log in with A” and “Log in with B”

A provider is unambiguous if its TenantName

• matches the name of the tenant that invoiceR recognizes from the address (one tenant per subdomain), or
• is given in the address of the login page in the parameter oid, for example https://<server>/account/login?oid=providerA.

You can use the oid parameter to give each organization its own login link.

Configuration

The providers are entered in the backend configuration file (appsettings.json or the environment-specific file) in the section Authentication:OpenId. The first provider is directly in OpenId, all further ones in the array AdditionalTenants. Each further provider has the same settings as the first.

"Authentication": {
  "OpenId": {
    "IsEnabled": "true",
    "ClientId": "<client-id-a>",
    "ClientSecret": "<client-secret-a>",
    "Authority": "<authority-a>",
    "LoginUrl": "<login-url-a>",
    "ValidateIssuer": "false",
    "ResponseType": "id_token",
    "DisplayName": "Log in with A",
    "TenantName": "providerA",
    "ClaimsMapping": [
      { "claim": "unique_name", "key": "preferred_username" }
    ],
    "AdditionalTenants": [
      {
        "ClientId": "<client-id-b>",
        "ClientSecret": "<client-secret-b>",
        "Authority": "<authority-b>",
        "LoginUrl": "<login-url-b>",
        "ValidateIssuer": "false",
        "ResponseType": "id_token",
        "DisplayName": "Log in with B",
        "TenantName": "providerB",
        "ClaimsMapping": [
          { "claim": "unique_name", "key": "preferred_username" }
        ]
      }
    ]
  }
}

Setting	Meaning
IsEnabled	Turns on login through OpenID. Applies to all providers.
ClientId, ClientSecret	ID and secret of the app registration at the provider.
Authority, LoginUrl	Addresses of the provider (issuer and login page), as the provider states them for the app registration.
ValidateIssuer	Whether the issuer of the token is checked ("true" or "false"). Required for further providers.
ResponseType	Type of response from the provider, usually id_token.
DisplayName	Label of the button on the login page. Without it, the button shows “OpenIdConnect”.
TenantName	ID of the provider. Must match the tenant name or the value in the oid parameter.
ClaimsMapping	Which details from the provider’s token invoiceR takes over for the user.

Redirect address at the provider

If you use the oid parameter, the provider redirects back to an address with this parameter after login. Enter the full address as redirect URI at the provider (for example in the app registration in Entra ID), including protocol and parameter, for example https://<server>/account/login?oid=providerA.

Note

Secrets such as ClientSecret do not belong in a file stored in a repository. Provide them through the environment of the installation or a key vault.

After changing the configuration, the backend must be restarted.