Identity Providers

An identity provider provides authentication services and maintains credentials for users that have been provisioned in the platform. Each tenant can have one or more identity providers. Each user is associated with one of the available identity providers in the tenant. A user can only log in with the same identity provider with which they signed up. Note: Identity Provider options differ by platform. OSIsoft Cloud Services supports multiple Identity Providers. CONNECT data services supports only a single Identity Provider: CONNECT.

Get Identity Provider

Returns an IdentityProvider object.

Request

GET /api/v1/IdentityProviders/{identityProviderId}

Parameters

string identityProviderId
Identity provider identifier.

Response

Example response body

200 Response (IdentityProvider)

{
  "Id": "string",
  "DisplayName": "string",
  "Scheme": "string",
  "UserIdClaimType": "string",
  "ClientId": "string",
  "IsConfigured": true,
  "Capabilities": {
    "User": {
      "SignIn": true,
      "Invitation": true,
      "Search": true
    },
    "Group": {
      "Authorize": true,
      "Search": true
    }
  }
}

Authorization

Allowed for these roles:

• Tenant Member

Get Identity Provider based on Id

Validates that a identity provider exists.

Request

HEAD /api/v1/IdentityProviders/{identityProviderId}

Parameters

string identityProviderId
Identity provider identifier.

Response

Authorization

Allowed for these roles:

• Tenant Administrator

Get Identity Provider by Scheme

Returns a list of identity provider objects that follow a scheme.

Request

GET /api/v1/IdentityProviders/schemes/{scheme}

Parameters

string scheme
Scheme name (for example, AAD or Google).

Response

Example response body

200 Response (IdentityProvider)

{
  "Id": "string",
  "DisplayName": "string",
  "Scheme": "string",
  "UserIdClaimType": "string",
  "ClientId": "string",
  "IsConfigured": true,
  "Capabilities": {
    "User": {
      "SignIn": true,
      "Invitation": true,
      "Search": true
    },
    "Group": {
      "Authorize": true,
      "Search": true
    }
  }
}

Authorization

Allowed for these roles:

• Tenant Member

Get Identity Provider Based on Scheme

Validates that a scheme exists.

Request

HEAD /api/v1/IdentityProviders/schemes/{scheme}

Parameters

string scheme
Scheme name (for example, AAD or Google).

Response

Authorization

Allowed for these roles:

• Tenant Administrator

List Identity Providers

Returns a list of identity provider objects.

Request

GET /api/v1/IdentityProviders
?query={query}&skip={skip}&count={count}

Parameters

[optional] string query
(Not supported) Search string identifier.

[optional] integer skip
Parameter representing the zero-based offset of the first object to retrieve. If unspecified, a default value of 0 is used.

[optional] integer count
Parameter representing the maximum number of objects to retrieve. If unspecified, a default value of 100 is used.

Response

Example response body

200 Response (IdentityProvider[])

[
  {
    "Id": "string",
    "DisplayName": "string",
    "Scheme": "string",
    "UserIdClaimType": "string",
    "ClientId": "string",
    "IsConfigured": true,
    "Capabilities": {
      "User": {
        "SignIn": true,
        "Invitation": true,
        "Search": true
      },
      "Group": {
        "Authorize": true,
        "Search": true
      }
    }
  }
]

Authorization

Allowed for these roles:

• Tenant Member

Get Header for Identity Providers

Returns the total number of identity providers.

Request

HEAD /api/v1/IdentityProviders

Response

Authorization

Allowed for these roles:

• Tenant Administrator

List all Identity Providers from Tenant

Returns all identity providers from a tenant.

Request

GET /api/v1/Tenants/{tenantId}/IdentityProviders
?query={query}&skip={skip}&count={count}

Parameters

string tenantId
Tenant identifier.

[optional] string query
(Not supported) Search string identifier.

[optional] integer skip
Parameter representing the zero-based offset of the first object to retrieve. If unspecified, a default value of 0 is used.

[optional] integer count
Parameter representing the maximum number of objects to retrieve. If unspecified, a default value of 100 is used.

Response

Example response body

200 Response (IdentityProvider[])

[
  {
    "Id": "string",
    "DisplayName": "string",
    "Scheme": "string",
    "UserIdClaimType": "string",
    "ClientId": "string",
    "IsConfigured": true,
    "Capabilities": {
      "User": {
        "SignIn": true,
        "Invitation": true,
        "Search": true
      },
      "Group": {
        "Authorize": true,
        "Search": true
      }
    }
  }
]

Authorization

Allowed for these roles:

• Tenant Member

Get Total Count of Identity Providers

Returns the total number of identity providers in a tenant. The value will be set in the Total-Count header. This method is identical to the GET method but it does not return any objects in the body.

Request

HEAD /api/v1/Tenants/{tenantId}/IdentityProviders

Parameters

string tenantId
Tenant identifier.

Response

Authorization

Allowed for these roles:

• Tenant Member

Add Identity Provider to Tenant

Adds an existing identity provider to a tenant. This identity provider will be available in the Home Realm Discovery Page for users to log in or sign up.

Request

POST /api/v1/Tenants/{tenantId}/IdentityProviders

Parameters

string tenantId
Tenant identifier.

Request Body

IdentityProviderAdd object

{
  "AzureActiveDirectoryConsentEmail": "user@example.com",
  "AzureActiveDirectoryConsentGivenName": "string",
  "AzureActiveDirectoryConsentSurname": "string",
  "AzureActiveDirectoryTenant": "string",
  "AzureActiveDirectoryConsentTypes": "string",
  "IdentityProviderId": "string",
  "AzureActiveDirectorySendConsent": true
}

Response

Example response body

201 Response (IdentityProvider)

{
  "Id": "string",
  "DisplayName": "string",
  "Scheme": "string",
  "UserIdClaimType": "string",
  "ClientId": "string",
  "IsConfigured": true,
  "Capabilities": {
    "User": {
      "SignIn": true,
      "Invitation": true,
      "Search": true
    },
    "Group": {
      "Authorize": true,
      "Search": true
    }
  }
}

Authorization

Allowed for these roles:

• Tenant Administrator

Get Identity Provider from Tenant

Returns an identity provider from a tenant.

Request

GET /api/v1/Tenants/{tenantId}/IdentityProviders/{identityProviderId}

Parameters

string tenantId
Tenant identifier.

string identityProviderId
Identity provider identifier.

Response

Example response body

200 Response (IdentityProvider)

{
  "Id": "string",
  "DisplayName": "string",
  "Scheme": "string",
  "UserIdClaimType": "string",
  "ClientId": "string",
  "IsConfigured": true,
  "Capabilities": {
    "User": {
      "SignIn": true,
      "Invitation": true,
      "Search": true
    },
    "Group": {
      "Authorize": true,
      "Search": true
    }
  }
}

Authorization

Allowed for these roles:

• Tenant Member

Get Header for Identity Provider

Validates that a identity provider exists in the tenant. This method is identical to the GET method but it does not return any objects in the body.

Request

HEAD /api/v1/Tenants/{tenantId}/IdentityProviders/{identityProviderId}

Parameters

string tenantId
Tenant identifier.

string identityProviderId
Identity provider identifier.

Response

Authorization

Allowed for these roles:

• Tenant Member

Remove Identity Provider From Tenant

Removes an identity provider from a tenant. Users provisioned with this identity provider will remain in the tenant, but will not be able to authenticate. An administrator cannot remove the identity provider with which they are signed in.

Request

DELETE /api/v1/Tenants/{tenantId}/IdentityProviders/{identityProviderId}

Parameters

string tenantId
Tenant identifier.

string identityProviderId
Identity provider identifier.

Response

Authorization

Allowed for these roles:

• Tenant Administrator

Get an Identity Provider Consent from a Tenant

Returns the consent information for an identity provider for a tenant. The ConsentState property, if returned, determines whether an identity provider consents to sharing access to its directory with the tenant. For example, the expected ConsentState's for AAD include (Pending_)SignIn and (Pending_)ReadAllUsersGroups.

Request

GET /api/v1/Tenants/{tenantId}/IdentityProviders/{identityProviderId}/Consent

Parameters

string tenantId
Tenant identifier.

string identityProviderId
Identity provider identifier.

Response

Example response body

200 Response (IdentityProviderConsent)

{
  "Scheme": "string",
  "property1": null,
  "property2": null
}

Authorization

Allowed for these roles:

• Tenant Member

Get Header for Identity Provider Consent

Validates that a identity provider consent exists in the tenant. This method is identical to the GET method but it does not return any objects in the body.

Request

HEAD /api/v1/Tenants/{tenantId}/IdentityProviders/{identityProviderId}/Consent

Parameters

string tenantId
Tenant identifier.

string identityProviderId
Identity provider unique identifier to check for consent

Response

Authorization

Allowed for these roles:

• Tenant Member

Update Identity Provider Consent of a Tenant

Updates the identity provider consent of a tenant. Currently only supports Azure Active Directory. The consent grants User.Read.All and GroupMember.Read.All permissions to the tenant.

Request

POST /api/v1/Tenants/{tenantId}/IdentityProviders/{identityProviderId}/Consent

Parameters

string tenantId
Tenant identifier.

string identityProviderId
Identity provider identifier.

Request Body

Identity provider consent

{
  "Scheme": "string",
  "property1": null,
  "property2": null
}

Response

Example response body

200 Response (IdentityProviderConsent)

{
  "Scheme": "string",
  "property1": null,
  "property2": null
}

Authorization

Allowed for these roles:

• Tenant Administrator

Get a List of All Users on an Identity Provider

Returns a list of users that matches the query string on an identity provider that supports advanced integration, such as Azure Active Directory. The prerequisite is that the identity provider must have already consented to sharing access to its directory with the tenant.

Request

GET /api/v1/Tenants/{tenantId}/IdentityProviders/{identityProviderId}/users
?query={query}&count={count}&skipToken={skipToken}

Parameters

string tenantId
Tenant identifier.

string identityProviderId
Identity provider identifier.

string query
Start of user name or email with which to search

[optional] integer count
Maximum number of users to returns

[optional] string skipToken
An encoded string that identifies the set of users that was not returned. For example, if you specify a count of the first 50 users matching your query, the skipToken identifies the 51st user.

Response

Example response body

200 Response (IdentityProviderResultsOfIdentityProviderUser)

{
  "Results": [
    {
      "Id": "string",
      "GivenName": "string",
      "Surname": "string",
      "Name": "string",
      "Email": "user@example.com"
    }
  ],
  "SkipToken": "string"
}

Authorization

Allowed for these roles:

• Tenant Administrator

Get a List of all Groups on an Identity Provider

Returns a list of groups that matches the query string on an identity provider that supports advanced integration, such as Azure Active Directory. The prerequisite is that the identity provider must have already consented to sharing access to its directory with the tenant. The consent grants User.Read.All and GroupMember.Read.All permissions to the tenant.

Request

GET /api/v1/Tenants/{tenantId}/IdentityProviders/{identityProviderId}/groups
?query={query}&count={count}&skipToken={skipToken}

Parameters

string tenantId
Tenant identifier.

string identityProviderId
Identity provider identifier.

string query
Start of user name or email to search for

[optional] integer count
Maximum number of groups to return

[optional] string skipToken
An encoded string that identifies the set of groups that was not returned. For example, if you specify a count of the first 5 groups matching your query, the skipToken identifies the 6th group.

Response

Example response body

200 Response (IdentityProviderResultsOfIdentityProviderGroup)

{
  "Results": [
    {
      "Id": "string",
      "Name": "string",
      "Email": "user@example.com",
      "IsClusterManagementAllowed": true
    }
  ],
  "SkipToken": "string"
}

Authorization

Allowed for these roles:

• Tenant Member

Get a List of All Groups that a User Belongs to on an Identity Provider

Returns a list of all groups that the specified user belongs to on an identity provider that supports advanced integration, such as Azure Active Directory. The prerequisite is that the identity provider must have already consented to sharing access to its directory with the tenant. The consent grants User.Read.All and GroupMember.Read.All permissions to the tenant.

Request

GET /api/v1/Tenants/{tenantId}/IdentityProviders/{identityProviderId}/Users/{userId}/Groups
?skip={skip}&count={count}&skipToken={skipToken}

Parameters

string tenantId
Tenant identifier.

string identityProviderId
Identity provider identifier.

string userId
User identifier.

[optional] integer skip
Indexes into a result set

[optional] integer count
Maximum number of groups to return

[optional] string skipToken
An encoded string that identifies the set of groups that was not returned. For example, if you request a count of the first 3 groups matching your query, the skipToken identifies the 4th user.

Response

Example response body

200 Response (IdentityProviderResultsOfIdentityProviderGroup)

{
  "Results": [
    {
      "Id": "string",
      "Name": "string",
      "Email": "user@example.com",
      "IsClusterManagementAllowed": true
    }
  ],
  "SkipToken": "string"
}

Authorization

Allowed for these roles:

• Tenant Administrator

Get Identity Provider Groups

Returns the groups based on the identifiers. Only Advanced Integration Identity providers such as Azure Active Directory and CONNECT support this method.

Request

POST /api/v1/Tenants/{tenantId}/IdentityProviders/{identityProviderId}/Groups

Parameters

string tenantId
Tenant identifier.

string identityProviderId
Identity provider identifier.

Request Body

Group identifier.

[
  "string"
]

Response

Example response body

200 Response (IdentityProviderResultsOfIdentityProviderGroup)

{
  "Results": [
    {
      "Id": "string",
      "Name": "string",
      "Email": "user@example.com",
      "IsClusterManagementAllowed": true
    }
  ],
  "SkipToken": "string"
}

Authorization

Allowed for these roles:

• Tenant Member

Get Identity Provider Group Mapping Roles

Returns the groups based on the identifiers that have tenant member access role. Only Advanced Integration Identity providers such as Azure Active Directory and CONNECT support this method.

Request

GET /api/v1/Tenants/{tenantId}/IdentityProviders/{identityProviderId}/groupmappings

Parameters

string tenantId
Tenant identifier.

string identityProviderId
Identity provider identifier.

Response

Example response body

200 Response (IdentityProviderResultsOfIdentityProviderGroupMappings)

{
  "Results": [
    {
      "Id": "string",
      "Name": "string",
      "Email": "user@example.com",
      "IsClusterManagementAllowed": true,
      "IdentityProviderClaimId": "string",
      "RoleIds": [
        "string"
      ]
    }
  ],
  "SkipToken": "string"
}

Authorization

Allowed for these roles:

• Tenant Member

Definitions

IdentityProvider

The IdentityProvider object

Properties

{
  "Id": "string",
  "DisplayName": "string",
  "Scheme": "string",
  "UserIdClaimType": "string",
  "ClientId": "string",
  "IsConfigured": true,
  "Capabilities": {
    "User": {
      "SignIn": true,
      "Invitation": true,
      "Search": true
    },
    "Group": {
      "Authorize": true,
      "Search": true
    }
  }
}

IdentityProviderCapabilities

The model for the capabilities of an identity provider

Properties

{
  "User": {
    "SignIn": true,
    "Invitation": true,
    "Search": true
  },
  "Group": {
    "Authorize": true,
    "Search": true
  }
}

IdentityProviderUserCapabilites

User-level capabilities of an identity provider

Properties

{
  "SignIn": true,
  "Invitation": true,
  "Search": true
}

IdentityProviderGroupCapabilites

The model for the group level capabilities of an identity provider

Properties

{
  "Authorize": true,
  "Search": true
}

ErrorResponse

Object returned whenever there is an error

Properties

{
  "OperationId": "string",
  "Error": "string",
  "Reason": "string",
  "Resolution": "string",
  "DynamicProperties": {
    "property1": null,
    "property2": null
  },
  "property1": null,
  "property2": null
}

IdentityProviderConsent

The model for an identity provider consent in identity storage

Properties

{
  "Scheme": "string",
  "property1": null,
  "property2": null
}

IdentityProviderAdd

Object for adding an identity provider

Properties

{
  "AzureActiveDirectoryConsentEmail": "user@example.com",
  "AzureActiveDirectoryConsentGivenName": "string",
  "AzureActiveDirectoryConsentSurname": "string",
  "AzureActiveDirectoryTenant": "string",
  "AzureActiveDirectoryConsentTypes": "string",
  "IdentityProviderId": "string",
  "AzureActiveDirectorySendConsent": true
}

IdentityProviderResultsOfIdentityProviderUser

Result object for Identity Provider access users/groups

Properties

{
  "Results": [
    {
      "Id": "string",
      "GivenName": "string",
      "Surname": "string",
      "Name": "string",
      "Email": "user@example.com"
    }
  ],
  "SkipToken": "string"
}

IdentityProviderUser

Base class for identity provider access user

Properties

{
  "Id": "string",
  "GivenName": "string",
  "Surname": "string",
  "Name": "string",
  "Email": "user@example.com"
}

IdentityProviderResultsOfIdentityProviderGroup

Result object for Identity Provider access users/groups

Properties

{
  "Results": [
    {
      "Id": "string",
      "Name": "string",
      "Email": "user@example.com",
      "IsClusterManagementAllowed": true
    }
  ],
  "SkipToken": "string"
}

IdentityProviderGroup

Base class for identity provider access group

Properties

{
  "Id": "string",
  "Name": "string",
  "Email": "user@example.com",
  "IsClusterManagementAllowed": true
}

IdentityProviderGroupsMultiStatusResponse

MultiStatusResponse objects returned in a 207 response

Properties

{
  "OperationId": "string",
  "Error": "string",
  "Reason": "string",
  "ChildErrors": [
    {
      "OperationId": "string",
      "Error": "string",
      "Reason": "string",
      "Resolution": "string",
      "EventId": "string",
      "StatusCode": 0,
      "ModelId": "string",
      "property1": null,
      "property2": null
    }
  ],
  "Data": [
    {
      "Id": "string",
      "Name": "string",
      "Email": "user@example.com",
      "IsClusterManagementAllowed": true
    }
  ]
}

MultiStatusResponseChildError

ChildError objects returned in a 207 response

Properties

{
  "OperationId": "string",
  "Error": "string",
  "Reason": "string",
  "Resolution": "string",
  "EventId": "string",
  "StatusCode": 0,
  "ModelId": "string",
  "property1": null,
  "property2": null
}

IdentityProviderResultsOfIdentityProviderGroupMappings

Result object for Identity Provider access users/groups

Properties

{
  "Results": [
    {
      "Id": "string",
      "Name": "string",
      "Email": "user@example.com",
      "IsClusterManagementAllowed": true,
      "IdentityProviderClaimId": "string",
      "RoleIds": [
        "string"
      ]
    }
  ],
  "SkipToken": "string"
}

IdentityProviderGroupMappings

Class for identity provider group mappings.

Properties

{
  "Id": "string",
  "Name": "string",
  "Email": "user@example.com",
  "IsClusterManagementAllowed": true,
  "IdentityProviderClaimId": "string",
  "RoleIds": [
    "string"
  ]
}

IdentityProviderGroupMappingsMultiStatusResponse

MultiStatusResponse objects returned in a 207 response.

Properties

{
  "OperationId": "string",
  "Error": "string",
  "Reason": "string",
  "ChildErrors": [
    {
      "OperationId": "string",
      "Error": "string",
      "Reason": "string",
      "Resolution": "string",
      "EventId": "string",
      "StatusCode": 0,
      "ModelId": "string",
      "property1": null,
      "property2": null
    }
  ],
  "Data": [
    {
      "Id": "string",
      "Name": "string",
      "Email": "user@example.com",
      "IsClusterManagementAllowed": true,
      "IdentityProviderClaimId": "string",
      "RoleIds": [
        "string"
      ]
    }
  ]
}