OpenID Connect¶

OpenID Connect is browser single sign-on on the Professional package. It is off until an administrator configures it, and it does not replace personal access tokens or embed tokens.

The Open Source package does not include the OIDC routes. Its Administration → Authentication page states that OpenID Connect and SAML are in the Professional distribution.

On the Professional package the routes exist before a license is activated. Login stays unavailable until feature enterprise.sso.oidc is entitled, which requires a valid Report Server Professional license. ACUGIS_EDITION does not enable it.

Routes¶

Method	Path	Role
`GET`	`/auth/oidc/login`	Starts the authorization-code redirect
`GET`	`/auth/oidc/callback`	IdP redirect target

With JRS_BASE_PATH set, prefix both paths. The callback URL shown in the admin UI is the public URL of /auth/oidc/callback.

Configure¶

Install the Professional package and activate a Report Server Professional license. See Licensing.
Open Administration → Authentication (/admin/authentication) as a platform administrator.
Set the provider fields and save. Use Test OIDC Connection before relying on the button.
Register the callback URL shown on that page with the identity provider.

The login button appears only when OIDC is enabled, the license feature is available, and issuer, client ID, and client secret are all set. The label is Sign in with plus the provider name, or Sign in with SSO when the name is empty.

Fields¶

Field	Behavior
Provider name	Button label
Issuer URL	OIDC issuer. Discovery uses the issuer's `/.well-known/openid-configuration`. Trailing slashes are removed.
Client ID and client secret	Confidential client
Scopes	Default `openid profile email`
Username claim	Default `preferred_username`, then `email` if that claim is empty
Email claim	Default `email`
Name claim	Default `name`
Groups claim	Default name `groups`. The value is read from the ID token and is not applied to AcuGIS groups.
Auto-provision	Default on. Creates a local user on first login when no identity is linked.
Allow email link	Default off. When on, a unique email can link to an existing user. A token that says `email_verified=false` is not used for that link. If the token does not include `email_verified`, linking can still happen.
IdP logout	Default off. When on, browser logout can redirect to the discovery `end_session_endpoint` after the local session is destroyed. `POST /api/v1/auth/logout` does not.

At least one of local authentication, OIDC, or SAML must stay enabled. The save is rejected when all of them would be off.

The stable identity is the issuer plus the sub claim. Email is not the permanent key.

Environment overrides¶

When a variable below is set, it overrides the saved admin value at runtime. An ACUGIS_OIDC_CLIENT_SECRET from the environment is not returned by the admin page.

ACUGIS_OIDC_ENABLED, ACUGIS_OIDC_ISSUER, ACUGIS_OIDC_CLIENT_ID, ACUGIS_OIDC_CLIENT_SECRET, ACUGIS_OIDC_SCOPES, ACUGIS_OIDC_USERNAME_CLAIM, ACUGIS_OIDC_EMAIL_CLAIM, ACUGIS_OIDC_NAME_CLAIM, ACUGIS_OIDC_PROVIDER_NAME, and ACUGIS_LOCAL_AUTH_ENABLED.

See Environment variables.

Local authentication stays on unless you turn it off. The login page then shows the username form, the OIDC button, or both.

To turn off the local form while OIDC remains enabled, clear Local Authentication and save. On a standalone server, an existing local account can still sign in with its password at:

/login?local=1

/login.php?local=1 is the same handler. The account must already exist and the password must be valid. The server does not check an administrator flag. The successful password login is audited as local_break_glass_login. This does not create an account.

This path is not available when Central login is in use. The qcarta profile and a set JRS_CENTRAL_LOGIN_URL send /login and /login.php to Central before local=1 is handled.

A successful OIDC login creates the normal jrs_session cookie. API clients keep using personal access tokens. Embed tokens stay emb_ tokens minted from a session or a personal access token.

Logout¶

Browser logout (/logout or /logout.php) destroys the Report Server session. If IdP logout is enabled and discovery published end_session_endpoint, the browser is then sent there. Otherwise the user returns to the login page.

POST /api/v1/auth/logout destroys the Report Server session and does not call the identity provider.

Public URL¶

The callback URL is built from the request that hit Report Server:

X-Forwarded-Host when that header is present, otherwise the request Host
https when the connection is TLS or X-Forwarded-Proto is https, otherwise http

Report Server uses those header values as received. It does not check that a trusted proxy set them. The packaged Apache configuration sets X-Forwarded-Proto and preserves the host. Register the HTTPS callback your users actually use. A callback computed from 127.0.0.1:9088 will not match an identity provider that only knows the public name.

Report Server does not terminate TLS. Put HTTPS on the reverse proxy. See Reverse proxy.

Troubleshooting¶

What you see	What to check
Authentication page has no OIDC form	Open Source package. OIDC is not compiled in.
Message that OIDC requires the Professional edition	Professional package without a valid license, or the license has expired.
No Sign in with button	OIDC disabled, license feature off, or issuer, client ID, or secret missing.
Discovery or login start fails	Issuer reachable from the server, TLS, and the issuer URL. The user is sent back to login with “SSO sign-in is unavailable.”
Callback fails	Redirect URI registered at the provider must match the callback on the admin page, including scheme, host, and `JRS_BASE_PATH`.
Locked out of SSO-only login	On a standalone server, `/login?local=1` with an existing local account and its password, then fix the provider or turn local authentication back on. Central login does not honor `local=1`.
User not created	Auto-provision is off, or the username cannot be allocated.

Audit actions include oidc_login_success, oidc_login_failed, oidc_user_created, oidc_identity_linked, oidc_logout, and oidc_config_changed. Secrets and tokens are not written into those events.