Appendix A – Single Sign On (SSO) Knowledge base

Asset Strategy Optimization uses Open ID Connect (OIDC). The Entra ID application (client) ID registered for Asset Strategy Optimization as the identifier.

Access token is required. The REST API (AppMiddlewareExtensions.cs) validated Bearer access tokens via UseOAuth. The Angular client fetches and refreshes them via angular-oauth2-oidc.

OAuth token configuration uses

• Grant type: Authorization Code;

• Response type: code;

• Scopes: openid profile roles offline access system

You must not use relay state as it is not applicable to OIDC.

Metadata URL is not applicable; SAML is not used, instead OIDC discovery endpoint is used ( {AIMIssuer}/.well-known/openid-configuration.

User provisioning is not required. Asset Strategy Optimization manages its own users in SQL Server via nHibernate. There is no SCIM endpoint or automatic provisioning support in the codebase.

The following are some of the examples of security groups:

• Azure-AVEVA-ASO-Users-Site A

• Azure-AVEVA-ASO-Users-Site B

• Azure-AVEA-ASO-Admins

Application visibility and access should be restricted to the groups (for example as above). The application tile should not be visible to all users.

No application proxy is being used.