--- schema_version: "1" id: d3b331e1c7d5c29a53650d493e10afd36766ed327b208e10567edf4bc63a0381 title: Configuring OpenID Connect Identity Management in Anypoint Platform collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/access-management/conf-openid-connect-task.md canonical_url: https://docs.mulesoft.com/access-management/conf-openid-connect-task source_site: docs.mulesoft.com content_type: documentation content_hash: 85e650811b109e6dfb089c35ffd8566335c812259b686048a04294e2602d4cea description: MuleSoft Documentation Site latest: true --- --- product: Access Management version: master --- # Configuring OpenID Connect Identity Management in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Configure OpenID Connect identity management in Anypoint Platform using dynamic or manual client registration. Anypoint Platform supports integration with Okta, Salesforce, OpenAM, and PingFederate, as well as any identity provider that follows the OpenID Connect specification. You can use one of these identity management procedures for client registration in OpenID Connect: - Dynamic registration - Manual registration Anypoint Platform supports the following registrations: - Clients created dynamically in Okta and OpenAM - Clients created manually in Salesforce, Okta, OpenAM, and PingFederate MuleSoft has officially tested the integration with these identity providers. Because Anypoint Platform supports the OpenID Connect Protocol, any identity provider that supports the protocol can integrate unless they diverge from the [specification](https://openid.net/specs/openid-connect-core-1_0.html). If you already configured Anypoint Platform as a client application in your identity provider, perform manual registration. Otherwise, if your identity provider supports dynamic client registration, perform dynamic registration. During registration, provide several URLs. The following table contains examples of the URLs to provide, depending on your provider, during registration.
URL NameOkta Example URLSalesforce Example URLOpenAM Example URLPingFederate Example URL

Base

https://example.okta.com/oauth2/v1

https://domain.my.salesforce.com/services/oauth2

https://example.com/openam/oauth2

https://example.com:9031

Client Registration

{BASE URL}/clients

{BASE URL}/clients

{BASE URL}/connect/register

N/A

Authorize

{BASE URL}/authorize

{BASE URL}/authorize

{BASE URL}/authorize

{BASE URL}/as/authorization.oauth2

Token

{BASE URL}/token

{BASE URL}/token

{BASE URL}/access_token

{BASE URL}/as/token.oauth2

User Info

{BASE URL}/userinfo

{BASE URL}/userinfo

{BASE URL}/userinfo

{BASE URL}/idp/userinfo.openid

## Configure OpenID Connect Dynamically 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the **Business Groups** menu, select your root organization. 4. In the Access Management navigation menu, click **Identity Providers**. 5. In the **Identity Management** page, select **OpenID Connect**. The External Identity - Identity Management OpenID Connect form appears. 6. Fill in the following required fields after obtaining values from your identity provider’s configuration: - Client Registration URL The URL to dynamically register Anypoint as a client application for your identity provider. - Authorize Header The authorization header for dynamic client registration request. This is an optional field under the Advanced Settings link. This header is required if the provider restricts registration requests to authorized clients. - Okta: This value is `SSWS ${api_token}`, where `api_token` is an API token created through Okta. - OpenAM: This value is `Bearer ${api_token}`, where `api_token` is an API token created through OpenAM. - Authorize URL The URL where the user authenticates and grants OpenID Connect client applications access to the user’s identity. - Token URL The URL that provides the user’s identity encoded in a secure JSON Web Token. - User Info URL The URL that returns user profile information to Anypoint. 7. Save your configuration. 8. Log out and navigate to your organization’s SSO URL, for example: `https://anypoint.mulesoft.com/accounts/login/{yourOrgDomain}` 9. Log in through your identity provider to test the configuration. > [!NOTE] The dynamically registered application at the identity provider has only default settings. > If you want to configure additional functionalities (such as group mappings), update the settings > on the provider side. Anypoint Platform doesn’t support configuring dynamically registered > applications. ## Configure OpenID Connect Manually 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Identity Providers**. 4. From Identity Management, select **OpenID Connect**. The External Identity - Identity Management OpenID Connect form appears. 5. Click **Use manual registration** under Client Registration URL. 6. Create a client application for the Anypoint Platform inside your Identity Provider. - Your Identity Provider requires a redirect URI for redirecting authenticated users. Use the automatically generated redirect URI. - Inside your Identity Provider, make sure that your client’s supported scopes include `openid`, `profile`, and `email`. - Inside your Identity Provider, make sure that your client uses the `authorization_code` grant type. - Store your Client ID and Client Secret values in a secure place and enter these values in the next step. 7. Fill in the required fields after obtaining them from your identity provider’s configuration: - Client ID The unique identifier that you provided for your manually created client application. - Client Secret The password, or secret, for authenticating your Anypoint Platform client application with your Identity Provider. - Authorize URL The URL where the user authenticates and grants OpenID Connect client applications access to the user’s identity. - Token URL The URL that provides the user’s identity encoded in a secure JSON Web Token. - User Info URL The URL that returns user profile information to the client app. - OpenID Connect Issuer The location of the OpenID Provider. For most providers, `/.well-known/openid-configuration` is appended to the issuer to generate the metadata URL for openID Connect specifications. For Salesforce, you must provide the value for `issuer`. 8. Save your configuration. 9. Log out and navigate to your organization’s SSO URL, for example: `https://anypoint.mulesoft.com/accounts/login/{yourOrgDomain}` 10. Log in through your identity provider to test the configuration. ## See Also - [Okta OpenID Connect](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/overview/) - [Dynamic Client Registration](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/client) - [Getting a Token](https://developer.okta.com/docs/guides/create-an-api-token/) - [Get a User](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/user) - [Salesforce OAuth 2.0 Web Server Authentication Flow](https://help.salesforce.com/s/articleView?language=en_US&id=remoteaccess_oauth_web_server_flow.htm) - [Salesforce OpenID Connect, Authentication Request](https://help.salesforce.com/s/articleView?language=en_US&id=sso_provider_openid_connect.htm) - [Salesforce OAuth Refresh Token Process](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_oauth_and_connected_apps.htm) - [Salesforce Understanding Username-Password OAuth](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_oauth_and_connected_apps.htm) - [AM 5 OAuth 2.0 Guide, Section 3.1. OAuth 2.0 Client and Resource Server Endpoints](https://docs.pingidentity.com/archive/) - [AM 5 OpenID Connect 1.0 Guide, Section 2.4. To Register a Relying Party Dynamically](https://docs.pingidentity.com/archive/) - [AM 5 OpenID Connect 1.0 Guide, Section 3.1. Authorizing OpenID Connect 1.0 Relying Parties](https://docs.pingidentity.com/archive/) - [PingFederate Authorization Endpoint](https://docs.pingidentity.com/pingfederate/13.0/administrators_reference_guide/pf_enable_disable_express.html) - [PingFederate Token Endpoint](https://docs.pingidentity.com/pingfederate/13.0/administrators_reference_guide/pf_enable_disable_express.html) - [Migrate Client Applications for APIs with External Client Providers in API Manager](https://docs.mulesoft.com/api-manager/latest/migrate-client-apps#migrate_with_external)