Experior & Remote Viewer – OpenID Connect (OIDC) Login Guide

[Kasper.Vestrup]

Overview

This document explains how to enable OpenID Connect (OIDC) authentication for Experior and the Experior Remote Viewer. Once configured, users can authenticate via an external Identity Provider (IdP) instead of using local credentials.

This setup supports standard OIDC-compatible identity providers (e.g., Azure AD, Keycloak, Auth0, Okta, or similar platforms).

Prerequisites

Before starting, ensure the following:

• Experior is installed and runnable
• Experior Remote Viewer is available
• Access to an Identity Provider (IdP) that supports OpenID Connect
• Ability to register a client/application in the IdP

1. Experior Configuration

Runtime Requirements

Experior must be started using one of the following modes:

• -graphicsserver
• -headless

These modes enable the web interface and API required for authentication.

Web API Configuration

Update the WebApiSettings.json file to include identity provider settings.

Option A – Direct OIDC Configuration

Provide explicit configuration values:

1     "IdentityProvider": {
2       "Authority": "https://<idp-domain>/",
3       "Issuer": "https://<idp-domain>/",
4       "Audience": "account",
5       "ClientId": "experior-remote-viewer",
6       "UserIdField": "",
7       "RedirectUri": "http://127.0.0.1:8080/callback",
8       "EndSessionRedirectUri": "http://localhost:8080/",
9       "AuthorizationScope": "openid",
10       "Prompt": "login"
11     }

Option B – Dynamic Configuration via External API

Alternatively, configuration can be retrieved from an external service:

1     "ExternalApi": {
2       "BaseUrl": "http://localhost:5050/api",
3       "IdpEndpoint": "/idp"
4     },
5     "IdentityProvider": {
6       "Authority": "",
7       "Issuer": "",
8       "Audience": "",
9       "ClientId": "",
10       "UserIdField": "",
11       "RedirectUri": "",
12       "EndSessionRedirectUri": "",
13       "AuthorizationScope": "",
14       "Prompt": "login"
15     }

In this scenario, Experior will query the external API to retrieve the required IdP configuration.

Other Relevant Settings

Ensure the following sections are configured as needed:

• WebUi.Enabled = true
• CorsConfiguration.AllowAll = true (or restrict appropriately for production)
• CertificateConfiguration.AllowInsecureCertificate should be false in production

2. Identity Provider Setup

Your Identity Provider must be configured with a client application for Experior Remote Viewer.

Required Configuration

Create a client with the following characteristics:

• Client ID: experior-remote-viewer (or match your configuration)
• Protocol: OpenID Connect
• Redirect URI: Must match RedirectUri in WebApiSettings.json
• Scopes: At minimum openid

Optional but recommended:

• Enable refresh tokens
• Configure logout redirect URI
• Add additional scopes such as profile or email

Supported Identity Providers

Any OIDC-compliant provider can be used, for example:

• Azure Active Directory
• Keycloak
• Auth0
• Okta

3. Remote Viewer Setup

The Remote Viewer uses the configured Identity Provider via Experior's API.

Ensure:

• Remote Viewer can reach the Experior Web API
• Redirect URI configured in the IdP matches the viewer callback endpoint
• Network configuration allows communication between viewer, Experior, and the IdP

4. Login Flow

The authentication flow works as follows:

1. User opens the Remote Viewer
2. User is redirected to the Identity Provider login page
3. User authenticates with the IdP
4. IdP redirects back to the Remote Viewer using the configured callback URL
5. Experior validates the token
6. Access is granted

5. Best Practices

• Always use HTTPS in production environments
• Do not allow insecure certificates outside of development
• Restrict CORS settings to known origins
• Keep client secrets and configuration secure
• Align redirect URIs exactly between configuration and IdP

Summary

By configuring Experior with an OpenID Connect-compatible Identity Provider, you enable secure, centralized authentication for both Experior and the Remote Viewer. This allows integration with enterprise identity systems and improves security and user management.