Overview

Up to three application service principals are involved in securing the communication of the tia® Connect SharePoint process:

tia® Connect Authentication (App Registration M2M, Client Credentials Flow) → General authentication for all request against tia® Connect
tia® Connect SharedLink Authentication (App Registration U2M, Authorization Code Flow) → Needed if OIDC authentication is configured for the SharedLink requests
tia® Connect to tia® Core CMIS (App Registration M2M, Interprocess Communication) → Used for interprocess communication authentication between tia® Connect and tia® Core CMIS

tia® Connect Authentication

Parent	Parameter	Description	Supported values	Default

Parent	Parameter	Description	Supported values	Default
`tia.security`	`oidc.type`	Type of the authentication	`none` \| `client_credentials` \| `authorization_code`	`none`
`tia.security.oidc`	`sslBundleName`	Name of the configured SSL bundle. Only needed if `spring.security.oauth2.client.registration.cmisauth.client-authentication-method` is configured to `tls_client_auth` or `self_signed_tls_client_auth`	<user>	`selfsignedcertificate`
`spring.security.oauth2.resourceserver.jwt`	`issuer-uri`	Issuer URI of the authorization server	<user>
`spring.security.oauth2.resourceserver.jwt`	`audience`	Expected audience in the `aud` claim for the token validation	<user>
`spring.security.oauth2.resourceserver.jwt`	`master-tenant-id`	Expected tenant ID in the `tid` claim for the token validation	<user>

To ensure correct authentication functionality tia® Connect needs to be configured with tia.security.oidc.type=authorization_code .

The main authentication will be client credentials flow, but to ensure the authorization code flow for shared links this configuration needs to be done.

For an example see the https://kgs-software.atlassian.net/wiki/x/CgDf0

tia:
  security:
    oidc:
      type: authorization_code
      sslBundleName: selfsignedcertificate
spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://login.microsoftonline.com/<tenant id>/v2.0
          audience: <audience>
          master-tenant-id: <tenant id>

tia® Connect SharedLink Authentication

Parent	Parameter	Description	Required

Parent	Parameter	Description	Required
`spring.security.oauth2.client.provider.azure`	`issuer-uri`	Issuer URI of the authorization server	yes
`spring.security.oauth2.client.provider.azure`	`user-name-attribute`	The name of the attribute in the token that references the Name or Identifier of the end-user	no
`spring.security.oauth2.client.registration.sharedlinkauth`	`provider`	Name of the configured provider	yes
`spring.security.oauth2.client.registration.sharedlinkauth`	`client-id`	The client identifier	yes
`spring.security.oauth2.client.registration.sharedlinkauth`	`client-secret`	The client secret	yes
`spring.security.oauth2.client.registration.sharedlinkauth`	`authorization-grant-type`	A credential representing the resource owner's authorization used by the client to obtain an access token	yes
`spring.security.oauth2.client.registration.sharedlinkauth`	`scope`	The scope(s) requested by the client during the authorization request	yes

spring:
  security:
    oauth2:
      client:
        provider:
          azure:
            issuer-uri: https://login.microsoftonline.com/<tenant id>/v2.0
            user-name-attribute: name
        registration:
          sharedlinkauth:
            provider: azure
            client-id: <client id>
            client-secret: <client secret>
            authorization-grant-type: authorization_code
            scope:
              - openid
              - email
              - profile

tia® Connect to tia®Core CMIS

There are two options

Authentication via client_secret
Authentication via certificate

For client_secret authentication, only a client ID and a client secret need to be configured.

For certificate authentication, a keystore containing the key pair must be provided. A certificate must be generated from this and imported into the app registration.
The client-authentication-method tls_client_auth or self_signed_tls_client_auth needs to get configured. The name of the configured SSL bundle needs to get configured into the tia.security.oidc.sslBundleName property.

How exactly this is configured is described as follows

Parent	Parameter	Description	Required

Parent	Parameter	Description	Required
`spring.security.oauth2.client.provider.azure`	`issuer-uri`	Issuer URI of the authorization server	yes
`spring.security.oauth2.client.provider.azure`	`user-name-attribute`	The name of the attribute in the token that references the Name or Identifier of the end-user	no
`spring.security.oauth2.client.registration.cmisauth`	`provider`	Name of the configured provider	yes
`spring.security.oauth2.client.registration.cmisauth`	`client-id`	The client identifier	yes
`spring.security.oauth2.client.registration.cmisauth`	`client-secret`	The client secret	yes
`spring.security.oauth2.client.registration.cmisauth`	`authorization-grant-type`	A credential representing the resource owner's authorization used by the client to obtain an access token	yes
`spring.security.oauth2.client.registration.cmisauth`	`scope`	The scope(s) requested by the client during the authorization request	yes
`spring.security.oauth2.client.registration.cmisauth`	`client-authentication-method`	The authentication method used when authenticating the client with the authorization server. Only needs to get overwritten with `tls_client_auth` or `self_signed_tls_client_auth` if the client_redentials flow should authenticate with a certificate	no
`spring.ssl.bundle.jks.selfsignedcertificate.key`	`alias`	Key alias	no
`spring.ssl.bundle.jks.selfsignedcertificate.key`	`password`	Key password	no
`spring.ssl.bundle.jks.selfsignedcertificate.keystore`	`location`	Path to the keystore	no
`spring.ssl.bundle.jks.selfsignedcertificate.keystore`	`password`	Keystore password	no
`spring.ssl.bundle.jks.selfsignedcertificate.keystore`	`type`	Type of the keystore, e.g. `PKCS12`	no

spring:
  security:
    oauth2:
      client:
        provider:
          azure:
            issuer-uri: https://login.microsoftonline.com/<tenant id>/v2.0
            user-name-attribute: name
        registration:
          cmisauth:
            provider: azure
            client-id: <client id>
            client-secret: <client secret>
            authorization-grant-type: client_credentials
            scope: <client id>/.default
          cmisauthwithcert:
            provider: azure
            client-id: <client id>
            client-authentication-method: self_signed_tls_client_auth
            authorization-grant-type: client_credentials
            scope: <client id>/.default
  ssl:
    bundle:
      jks:
        selfsignedcertificate:
          key:
            alias: <key alias>
            password: <key password>
          keystore:
            location: <path to>\<keystore>.p12
            password: <keystore password>
            type: PKCS12

Documentation

Security configuration (tia® Connect)

Analytics

Overview

tia® Connect Authentication

tia® Connect SharedLink Authentication

tia® Connect to tia®Core CMIS

Related content