Identity Providers in Thingshub (SSO)
Thingshub supports two identity provider mechanisms:
internal identity provider that thingshub provides
external 3rd party identity provider mechanism.
The 3rd party system is particularly helpful if you have a common identity provider system for your complete enterprise software stack. The internal identity provider is enabled by default and can be disabled from the tenant configuration file. The external identity providers can be enabled in your thingshub tenant installation by using the tenant configuration file.
Internal Identity Provider System:
This is the internal identity management mechanism that thingshub provides. It is enabled by default with the tenant installation. User can authenticate themselves to the thingshub system by logging in with theemail/username
andpassword
associated with their thingshub account.External Identity Provider System:
The external identity provider system is the mechanism to enable thingshub to use a 3rd party system for authentication. This can be enabled or disabled from the tenant configuration file.
By default the external identity provider is disabled.Thingshub currently supports 3 external identity providers:
Google Oauth2
,Keycloak Open ID Connect,
andPingID Oauth 2
Configuring multiple identity providers
Thingshub supports configuring multiple identity providers in a single instance, however there is a constraint of a singular identity provider of a type. For example, you can configureGoogle Oauth
and also haveKeycloak
setup in a single tenant. However, you will not be able to set-up anotherGoogle Oauth
identity provider for the same tenant.Configuring Identity Providers:
YAMLglobal: domain: foo.bar.com tenant_mode: trackinghub ... identity_providers: thingshub: enabled: true google_oauth2: enabled: false ... keycloak_oidc: enabled: true ... ping_id_oauth2: enabled: true ... ...
The identity providers can be enabled or disabled from the tenant configuration file by setting the appropriate values in the
identity_providers
block as shown above. The specific identity provider can be turned on or off using theenabled
flag in their respective sub-blocks.By default, the
thingshub
identity provider is enabled and bothkeycloak_oidc
andgoogle_oauth2
are disabled. The tenant operator can explicitly disable thethingshub
internal identity provider if they want to use the external identity providers only.
However, there should be at least one identity provider enabled at a time for a tenant. If all of the identity providers are disabled for a thingshub tenant, it will enable thethingshub
internal identity provider. The same is the case if the wholeidentity_provider
block is absent.
You can see a tenant configured with all the identity providers here: https://qa-whitelabel.thingshub.smartmakers.de/ui/en/login
The config block for setting up the identity providers as shown in the tenant is:
global:
identity_providers:
thingshub:
enabled: true
google_oauth2:
enabled: true
params:
client_id: "..."
client_secret: "..."
auth_url: "https://accounts.google.com/o/oauth2/auth"
token_url: "https://oauth2.googleapis.com/token"
user_info_url: "https://www.googleapis.com/oauth2/v2/userinfo?access_token="
scopes:
- "https://www.googleapis.com/auth/userinfo.email"
button:
logo: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAWgAAAFoBAMAAACIy3zmAAAAJ1BMVEXu7u7////qQTQzqFJAhfX7vAV5pfKszNvyx66AxZPpe3Prykg6lKgf/8M3AAAHXElEQVR42u3dTUsjSRgH8NSojLqXqn3RdnMJfZKcAr0wBDyMEJyrqzQseBKG3euEkVnmZgRBPM3gQbxpTpLTyuA38INtJ+m8dVV1uqvT9VRm/nXrMdX+5vGpStXTZayIYeOVYVuKywrQQAMNNNBAAw000N8jOm4s/vdlugQaaKCBBhpooIEG+vtCYxMANNBAAw000EADDTSqpti5AA000EADDTTQQAONqinQQAMNNNBAAw000KiaYucCNNBAAw000EADDTSqpkAD/aOhR8N8edBRW7/q9bq9erfXuzpn8dfdRnvXXX+69YZul9Hrs+Jhe2TCYTRXkaNWf2TOoq99bat3nEQLr+untXsH0WLTn9N2nUPza39uqzO30PzC9zOpXaqaZjJPhqMTm4CM5mGGOILObI7UrqA3/Rxt1wk08/xc7d4FNO/mQ/sderTIax4ORlJ0voSepDUp2vMN2gMtOndCjxKEEG2SHP1Wo0R7vmHr0KHZhSl6l5Ohf/eN2z0VmnXN0TWiqikrEGifEW0CCgWaaOeyiEDbRxcJNCdCe0UCTbSxLRZoInSxQNOgzd8MB4GmQfNigSZBs1fFAk2D7hYLNAl67jDsPV5dXfW6ukBToOdkx+MV0zzLGAWaAp26y6qfczH14mtVoCnQacuORzbLSjyGYWRV05TsOJfrotM/lxpdLS+llstVfS+k5Z19tD47Olzdt5sINAH6VYpZ3XeUIYwu0rq5455r+3rx1EGG9rQ1upS+m8Opgwz9s67Yldq3O5ijqdC6VekDT603eIM5mizSZkUjdlHjdGjPsDzndQjP5a0ZFkIZ4WFCdhmqKxlOn4AMwyNlychltBeGofKRlcvoaqhQ7wq3z5pe9tHJBHlw/FzecyiHus4dR4ehrK45jvZi9NFCqwIlo6uhHOo6dxy9Fsqhvnf9gOxzKKvZ8qDD2exwGM0n5nGoa66fn/ZCWd1xHV2dRscJUnEd/VsohXq0ZXEXfRlKoa45H+nnUFJ3lg59NK6Duvsb+ixMtvGZRoc3ARI63HUe7cnoQ22hQ2RvpaJ/ktFPuhd/+jtj+6dkdFVGn+vqYK2s7aBk9JqM1hbv3mdW20dz19HsUjKfLCP6rwWkBys3PWT04QIi3S430s8yurKE6P8WgD61jX4CupSBKKPPCdA517Xye0tH++Ls6P1yNwHloN8CjfRApBFpRHpB6OdljLRi7bGMkX76USNdMlrebv25APSpbfQhAdqJ3fip7WLNifO78ZLKYkAXq5o6U2Faz16fdqdqqngS0Chcn25Zf+Zy3NQ9gvikadaL6tLTrZMg0KEFixofP1ZhgybEtn10cvERBEE738OeLevoZK33OEJ/zYf+VV6Z2kVHyREEjXzoM+toNvvu8q2PbuZDyzPhftmRriaTIxiPxIy3Uq2XSkZ7iVEYTJI62622Ve/iZZ81TSZHP6nzHLySJ4+WzdNicXJESZ0HvSqjeenoy2Ry9Gfq7LdSjMMDbu8E5LcJupHj2KYc6Hfc2lnTk4k5zo9Mt9pSVT2sneoNpls7861WSdAiMQon+ZHpVopFdtvWSfWTYLaJjLdSzNItGyfV16Tk6L+/ZLzVKhG6KiVHPBSz3Ep1roZbQHtycgyHYoa+Wy31OCz/V7BnpuhRe5PpIzvOlDUxG+jL4yBQhXp+321l0cMKuqoyR6Ge31c1DFsVK+htJXq869L3VQb6gOdHm6y+1eimmLfrOVM+urBw1rR/9VGtjpfV2r5bmjKvFXRlR42OV6i6vvy9po5nB61J6jhBNH3Vo7Bf87CDZjca9Ruh77vx0tKntA30Lxp08EXo+kY/nZSUtoHW5Uek5uq+PPranj6lrXy+x41eLVR9+aDDizalraBXghS13Hc03bRUxSVr6B09OhqNyb6fR1/6Q5fSdj4D8iZFHQd78MropRtTX3nRZIcd9EoaOmjejsbX688z/7099YRnCc2Dee0uavLPI5Egp8wmOj0/UtpMghxU7KJ3DNEzCfKWm6EN1tPDS0P0TIK0Lf3C2eiSrZiqZ+YOu+gKDwonyL51tG4rkGMsMuvoynZQUP1O2Eezm4IJ0iZAFw31gaBAm4c6GK+VrKMLhHpvtFayjxYfCyTIKRXaPNTBgaBCC+O3xVERjQJt/LbYFHRo48VemxJtOBYbxT6e3HQ9Pb40TI7C37dIZ7ZhNgpJ0SaTdUPQ/42iG5OZgxidezvQdgHNtg3eVsjRIs9g/CIcQedQN4Qz6EmNcU57IxxCZ4x1QzCX0JnUt6LiFjrD4lr/RIbuL7vPeZdptkXFPXT61Hcb13gcQ0frEK6bRW6ZWOA3KrqeTl7yOxU5+u8s8BuV8WFar2fczbsPTHDn/0h63/3v3aDdfhgXGR1HTz/FX/idS0SXewk00EADDTTQQC+makp3CTTQQAMNNNBAAw3094XGJgBooIEGGmiggQYaaFRNsXMBGmiggQYaaKCBBhpVU6CBBhpooIEGGmigUTXFzgVooIEGGmiggQYaaM3l/+tnm2ZXdYOGAAAAAElFTkSuQmCC"
text: "Sign-in with Smartmakers Google"
btn_color: "#82BBE5"
text_color: "#FFFFFF"
keycloak_oidc:
enabled: true
params:
realm: "..."
root_url: "..."
client_id: "..."
client_secret: "..."
skip_verify: true
self_signed: true
ca_certificate: "..."
button:
logo: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADYAAAA2CAYAAACMRWrdAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAAEnQAABJ0Ad5mH3gAAABkelRYdFJhdyBwcm9maWxlIHR5cGUgaXB0YwAAeNo9wbsNgDAMBcDeUzDCc/zizzghEImOgv2FRMGdXPczZftYiiUbiwcI4qelE80DUHp2xjCNEd1XoCfLd3eeJMuXmVWnBAF5AaE0E+atkxdXAAADhklEQVRoQ+2YX0gUURjFj5ZZlv0zLaNEwYJUEqGihyKwBymyIDHyIaJ6Kaheeinoz0ORBUUEFRFUkkFRvRRE9VZUkERvlUaGCaGoaZr2x3Szc3ZmYdPdcdfdmWVkfvAxd2Z2d+65373nu7NJQ5cxhHFIsnkcd3jC3IYnzG14wtyGJ8xteMLchifMbXjCbMfHGGD0M34wehnfGT1mW9f+MP4yIiAx72PqnISoo78ZExkLlgBz1wLTMoBZeUA6IyWdPeTYD/6iwHqg/RPw7izQzS/N5HcscE7YIEMZ0ehnTQAW7aWYEmDxdt2Njo7XwPUVwAzzPAT2CpMYZYQDjqL1QP4GHvfoTuy01wE3VjKz5vkw4i9MUyywToorKKQKyOPRDqqTgNlmexjxMw+tl3ZGej5QdhU4zPEqv2efKGFhJLEJU65/MroYRbuBI3zSto9AwU7dtZfWp8Bksx2CsU1FjVQfQz9ceg0o3KGrzlJbQCOiU9KHQhFdxiToGyNlDrD1EbCPY5IIUV+eAS3hRYnIMqZPqFBmZAIbH9Cu6UaJ5CRNg+XOCmthuiN3m8QKWvEEmF/qvxyWfqZzQHOUqVVxTQ1jWbFwYTozxWI4ylwLL0yWrRpU+ZjOVua/5KeZGWt5Q8PgVOh4AXS2GnVKD1JwMP3oV2X9Os/OBnIrgVXHKZgdGys13I30fuZAm+cWjBSmM+3RSquBZQeBeppDI9dTI61b2ZvCSGEEhASLCYfWpop1N6NwDbCZjhYttRTVRVEWThjM/8LUgbSFwNIDwNvzzE4T9268JiFaqKMJiATNhKnM4K4W4zwSanK5xpsjFiVGZkzTR6MbyIodKHNVD4EcbrNG4xINy/c1oukXzMiuKzOpDLtEiTRGE9enFT4u3DOaItGLEnZ235pkiyLU9Z77QKrXMrD4mBWJEabXl8wcoz2cV8eAi4W8z3YMa9q6jtlFG+NoiMfe5MtmW4ORqRhxPmMypuJNRjtAHx3vNNPTEx9RwnlhnYzy20ZbvDwEnKOd621YfxHECWeF6Z1tOXcgyWZBupIF1J3i3pPteNTIIJwTpiWlLdq6O8CHu8AJKvF1sFj778Yd54Rpm7afQm6VAPe3GK5n49OdcUVt1eat5hbtuVFsx1ibosGZjOkprRSlpeWAKOHcVJSgOBuEFc4JcxhPmNvwhLkNT5jb8IS5DU+Y2xinwoB/N3vc3ZUlwFsAAAAASUVORK5CYII="
text: "Sign-in with Smartmakers KeyCloak"
btn_color: "#192E35"
text_color: "#FFFFFF"
To get further details on configuring individual external identity providers, please refer to the pages given below: