DocumentationAPI ReferenceRelease Notes
Documentation

OpenID Connect | PRA

Suggest Edits

Benefits of OpenID Connect integration

BeyondTrust Privileged Remote Access integrates with OpenID Connect providers to support modern identity management and secure single sign-on. BeyondTrust uses OpenID Connect tokens to authenticate users and inherit permissions from configured groups.

  • Use existing OpenID Connect providers for login.
  • Enable single sign-on across apps and systems.
  • Support modern, standards-based authentication.

How do I access the Security Providers page?

  1. Use a Chromium-based browser to sign in to your Privileged Remote Access URL.
    This URL is provided in the BeyondTrust welcome email and includes your site URL followed by /login.
  2. From the left menu, click Users & Security.
    The Users page opens and displays by default.
  3. At the top of the page, click Security Providers.
    The Security Providers page displays.

Add a security provider

  1. On the Security providers page, click + Add, and then select OpenID Connect from the list.
    The Add Security Provider page displays.
  2. Configure the security provider following the steps below.
OpenID Connect fields

  • Name: Enter a unique name to help identify your provider.

  • Enabled: If checked, your appliance can search this security provider when a user attempts to log in to the access console or /login. If unchecked, this provider will not be searched.

  • Associated email domains: This setting applies only when more than one OIDC provider is active. Otherwise, it is ignored.

    Enter the email domains you want to associate with this OIDC provider, one per line. During authentication, users enter their email address, and the domain is checked against this list. If it matches, they are redirected to the corresponding identity provider for authentication.

    If multiple OIDC providers are configured and the user’s email domain does not match any provider’s associated domains, the user will not be allowed to authenticate.

  • Server certificate: This is the certificate used for validating the response's signature. The certificate is usually provided by the metadata.

  • Provider settings

    • OIDC endpoint: The root address where the OIDC metadata can be found with /.well-known/openid-configuration appended. Any http protocol and trailing slashes will be removed.

    • Client ID: The unique identifier for the identity provider you are using.

    • Client secret: Provide a new shared secret so your appliance and your OIDC server can communicate.

  • User attribute settings

    • Username: The OIDC attribute that contains the user's unique username or login ID.
    • E-mail: The SAML attribute that contains the user's email address.
    • Display name: The SAML attribute that contains the user's display name.

  • Authorization settings

    • Lookup groups using this provider: Enabling this feature allows faster provisioning by automatically looking up groups for this user, using Group lookup attribute name and Delimiter. We recommend enabling this feature. If not used, OIDC users must be manually assigned to group policies after their first successful authentication.

    • Group lookup attribute name: Enter the name of the OIDC attribute that contains the names of groups to which users should belong. If the attribute value contains multiple group names, then specify the Delimiter used to separate their names. If left blank, OIDC users must be manually assigned to group policies after their first successful authentication.

    • Delimiter: If this field is left blank, then the attribute value may contain multiple XML nodes, with each one containing a different name.

    • Available groups: This is an optional list of OIDC groups always available to be manually assigned to group policies. If left blank, a given OIDC group is made available only after the first successful authentication of a user member of such group. Enter one group name per line.

    • Default group policy: Each user who authenticates against an external server must be a member of at least one group policy in order to authenticate to your appliance, logging into either the /login interface or the access console. You can select a default group policy to apply to all users allowed to authenticate against the configured server.

      If a default policy is defined, any allowed user who authenticates against this server might have access at the level of this default policy. Therefore, we recommend you set the default to a policy with minimum privileges to prevent users from gaining permissions you do not wish them to have.

      ℹ️

      If a user is in a default group policy and is then specifically added to another group policy, the settings for the specific policy always take precedence over the settings for the default, even if the specific policy is a lower priority than the default, and even if the default policy's settings are set to disallow override.

  1. Click Save at the top of the page.

Change priority order of security providers

  1. At the top of the Security providers page, click Change Order.
  2. Drag and drop security providers to set their priority. You can drag and drop servers within a cluster; clusters can be dragged and dropped as a whole.
  3. Click Save Order for prioritization changes to take effect.

Disable a security provider

Disable this security provider connection. This is useful for scheduled maintenance, when you want a server to be offline but not deleted.

  1. On the Security providers page, locate the security provider you want to disable.
  2. Click > Disable.

To re-enable the security provider, click > Enable.

View the log for a security provider

View the status history for a security provider connection.

  1. On the Security providers page, locate the security provider you want to view.
  2. Click > View Log.

Edit a security provider

ℹ️

If you edit the local security provider and select a default policy that does not have administrator permissions, a warning message appears. Ensure other users have administrator permissions before proceeding.

  1. On the Security providers page, locate the security provider you want to edit from the list.
  2. Click .
    The Edit security provider page displays.
  3. Edit the security provider details. The details available are the same as the Add security provider page details.
  4. Click Save at the top of the page.

Delete a security provider

  1. On the Security providers page, locate the security provider you want to delete.
  2. Click to delete the security provider.

Updated 15 days ago

©2003-2025 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.