Provider Settings

This page gives the identity provider settings for each provider. Use it with Step 3: Register the Client and Step 4: Enter the Provider Settings.

Each IDP profile needs its own client at the identity provider. Register one client for the staging profile and a different client for the production profile. The Redirect URL, Console Redirect URL, and Logout URL in each section come from the IDP profile page in the Console.

eCourtDate works with each provider on this page and with each other provider that meets the requirements for other OpenID Connect providers.

Microsoft Entra ID

Admin center: https://entra.microsoft.com

Register the Client

1. Open App registrations and click New registration.
2. Enter a name, such as eCourtDate Staging.
3. In Supported account types, select the option for accounts in this organizational directory only (single tenant).
4. In Redirect URI, select the Web platform. Enter the Redirect URL of the IDP profile.
5. Click Register.
6. Open Authentication. Under Web, add the Console Redirect URL.
7. Open Certificates & secrets and click New client secret. Copy the secret Value. Write down the expiry date.
8. Open Token configuration and click Add optional claim. Select ID and add email.
9. Optional, for agency access by group: click Add groups claim and select Groups assigned to the application. For the ID token, select sAMAccountName for groups from on-premises Active Directory, or Cloud-only group display names for cloud groups.
10. Optional, for roles: open App roles and create one app role for each eCourtDate role. Set the Value of each app role to the name of the eCourtDate role.
11. Open Enterprise applications and open the application. In Properties, set Assignment required? to Yes.
12. In Users and groups, assign the users and the groups. Assign an app role to each one, if the application has app roles.

Do not select Emit groups as role claims. eCourtDate reads groups from the groups claim and roles from the roles claim.

Profile Values

Field	Value
Well Known URL	https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration
Base URL	https://login.microsoftonline.com/{tenant-id}/v2.0
Authorization URL	https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/authorize
Authorization Scope	openid profile email
Token URL	https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token
User URL	https://graph.microsoft.com/oidc/userinfo
End Session URL	https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/logout

Replace {tenant-id} with the Directory (tenant) ID from the Overview page of the application. For Azure Government, use login.microsoftonline.us in place of login.microsoftonline.com.

Notes for Entra ID

• Use the tenant ID. Do not use common, organizations, or consumers in the URLs. The issuer of each token contains the tenant ID, so the Console issuer check fails with a multi-tenant URL.
• Use v2.0 URLs in all fields. Do not mix v1.0 URLs and v2.0 URLs. The issuer of a v1.0 token is different from the issuer of a v2.0 token.
• Groups need names. Entra sends group object IDs by default. An object ID does not contain ecourtdate, so it cannot select an agency. Select a group name format in step 9.
• No Microsoft Graph permissions. eCourtDate reads groups and roles from the ID token. It does not call Microsoft Graph. The default User.Read permission is the only permission that the application needs.
• Client secrets expire. Create a new secret before the expiry date, and enter it in the IDP profile.

Google Workspace

Console: https://console.cloud.google.com

Register the Client

1. Open APIs & Services > OAuth consent screen. Set the User type to Internal. Then only users in the Google Workspace organization can sign in.
2. Open APIs & Services > Credentials. Click Create credentials > OAuth client ID.
3. In Application type, select Web application.
4. In Authorized redirect URIs, add the Redirect URL and the Console Redirect URL of the IDP profile.
5. Click Create. Copy the Client ID and the Client secret.

Profile Values

Field	Value
Well Known URL	https://accounts.google.com/.well-known/openid-configuration
Base URL	https://accounts.google.com
Authorization URL	https://accounts.google.com/o/oauth2/v2/auth
Authorization Scope	openid profile email
Token URL	https://oauth2.googleapis.com/token
User URL	https://openidconnect.googleapis.com/v1/userinfo
End Session URL	The Logout URL of the IDP profile

Notes for Google Workspace

• No end-session endpoint. Google does not have an end-session endpoint. With the Logout URL as the End Session URL, sign-out ends the eCourtDate session. The Google session stays active.
• No groups and no roles. Google ID tokens do not contain a groups claim or a roles claim. At each sign-in, the user gets all of the Enabled Agencies. A new user gets the Default Role. Select only the Enabled Agencies that all users of the profile need.
• No Credentials Check. The Console does not show the Credentials Check for a Google Token URL.

Okta

Admin Console: the Okta Admin Console of the organization

Register the Client

1. Open Applications > Applications and click Create App Integration.
2. Select OIDC - OpenID Connect and Web Application. Click Next.
3. In Grant type, keep Authorization Code selected.
4. In Sign-in redirect URIs, add the Redirect URL and the Console Redirect URL of the IDP profile.
5. In Sign-out redirect URIs, add the Logout URL of the IDP profile.
6. In Assignments, select the users or groups that can use eCourtDate. Click Save.
7. On the General tab, copy the Client ID and the Client secret. Keep Client authentication set to Client secret.
8. Optional, for agency access by group: on the Sign On tab, edit OpenID Connect ID Token. Set Groups claim type to Filter. Set Groups claim filter to groups, Matches regex, and #\d+_ECOURTDATE.*.

Profile Values

Field	Value
Well Known URL	https://{okta-domain}/.well-known/openid-configuration
Base URL	https://{okta-domain}
Authorization URL	https://{okta-domain}/oauth2/v1/authorize
Authorization Scope	openid profile email groups
Token URL	https://{okta-domain}/oauth2/v1/token
User URL	https://{okta-domain}/oauth2/v1/userinfo
End Session URL	https://{okta-domain}/oauth2/v1/logout

Replace {okta-domain} with the Okta domain of the organization, such as agency.okta.com.

Notes for Okta

• The regex is case-sensitive. The filter #\d+_ECOURTDATE.* matches ECOURTDATE in uppercase only. Name the groups in the format #100_ECOURTDATE.
• Add the groups scope. Put groups in the Authorization Scope, as the table shows.
• No roles from the org authorization server. The URLs in the table use the Okta org authorization server, which does not send a roles claim. A new user gets the Default Role. To send a roles claim, use a custom authorization server with a claim named roles. The URLs of a custom authorization server contain /oauth2/{authorization-server-id}/v1/.
• Use the URLs of one authorization server. The Well Known URL, the Authorization URL, and the Token URL must all come from the same authorization server. If they do not, the issuer check in the Console fails.

AWS Cognito

Console: https://console.aws.amazon.com

GovCloud console: https://console.amazonaws-us-gov.com

Register the Client

1. Open the user pool. Make sure that the user pool has a domain.
2. Open App clients and create an app client. Select Traditional web application, so that the app client gets a client secret.
3. In Allowed callback URLs, add the Redirect URL and the Console Redirect URL of the IDP profile.
4. In Allowed sign-out URLs, add the Logout URL of the IDP profile.
5. In OAuth grant types, select Authorization code grant.
6. In OpenID Connect scopes, select openid, email, and profile.
7. Copy the Client ID and the Client secret.

Profile Values

Field	Value
Well Known URL	https://cognito-idp.{aws-region}.amazonaws.com/{user-pool-id}/.well-known/openid-configuration
Base URL	https://cognito-idp.{aws-region}.amazonaws.com/{user-pool-id}
Authorization URL	https://{cognito-domain}/oauth2/authorize
Authorization Scope	openid profile email
Token URL	https://{cognito-domain}/oauth2/token
User URL	https://{cognito-domain}/oauth2/userInfo
End Session URL	https://{cognito-domain}/logout

Replace these placeholders:

• {aws-region}: the AWS Region of the user pool, such as us-east-1.
• {user-pool-id}: the ID of the user pool.
• {cognito-domain}: the domain of the user pool, such as agency.auth.us-east-1.amazoncognito.com.

Notes for AWS Cognito

• Groups are in cognito:groups. eCourtDate reads only the claim named groups. To control agency access by group, add a pre token generation Lambda trigger that copies the group names to a groups claim. Without a groups claim, each user gets all of the Enabled Agencies.
• No roles by default. Cognito does not send a roles claim. A new user gets the Default Role. The same Lambda trigger can add a roles claim.

Other OpenID Connect Providers

eCourtDate works with each identity provider that meets these requirements:

Requirement	Detail
HTTPS	All URLs use HTTPS.
Authorization Code flow	The provider accepts response_type=code and response_mode=query.
Confidential client	The Token URL accepts the Client ID and the Client Secret with HTTP Basic authentication (client_secret_basic).
ID token	The token response contains an id_token.
email claim	The ID token contains the email address of the user.
Discovery document	The provider publishes a discovery document with the issuer and jwks_uri values. The Console needs these values to verify ID tokens.
Token signature	The provider signs ID tokens with RS256, with the keys at jwks_uri.
groups claim (optional)	A list of group names. See Agency Access.
roles claim (optional)	A list of role names. See Roles.

Enter the URLs from the discovery document of the provider:

Field	Value from the discovery document
Well Known URL	The URL of the discovery document
Authorization URL	authorization_endpoint
Token URL	token_endpoint
User URL	userinfo_endpoint
End Session URL	end_session_endpoint