Use OpenID Connect to launch session in generic user id context
We have a use case where we want to launch the Mashup session in context of a generic user id. We tried OpenID connect but once Authentication is done the operatorid is auto created if not present always. We tried Anonymous but our security team is pushing back on that solution since authentication is missing. Please suggest a way to achieve the same considering OpenID connect(using either Pre/Post Authentication activity). Thanks!
HCA Healthcare
US
@Jey2705 To launch a Mashup session in a generic user context using OpenID Connect, create a generic operator ID (e.g., GenericUser) with minimal access roles required for the Mashup. In the OpenID Connect configuration, disable the "Auto create operator if not found" option. Use a Pre-Authentication activity to map all authenticated users to the GenericUser by setting the pyUserIdentifier property to GenericUser. Validate the OpenID Connect claims (e.g., sub or email) in this activity to ensure only authorized users can proceed. Optionally, use a Post-Authentication activity to initialize session data or log activity. This ensures the session is authenticated without creating new operators while maintaining security compliance
CSC
US
@Sairohith Thanks for your response. I don't see "Auto create operator if not found" option on the OpenID Connect Authentication service that we created. Is it on the Authentication service rule instance or any other config/rule? Can you please help with the same.
HCA Healthcare
US
@Jey2705The "Auto create operator if not found" option is not explicitly visible in the OpenID Connect Authentication Service. To prevent operator auto-creation, use a Pre-Authentication activity in the service. In this activity, set the pyUserIdentifier property to the generic operator ID (e.g., GenericUser), ensuring all authenticated users are mapped to this operator. This prevents Pega from trying to create a new operator for every user. Ensure that the GenericUser operator exists in the system with the required access roles for the Mashup session. By doing this, you can control the authentication process and avoid operator auto-creation, even without a dedicated checkbox or setting , thanks
Updated: 2 Jan 2025 15:30 EST
CSC
US
@SairohithThanks for the clarification. Tried the approach but got below error. Please check the steps and let me know if I'm missing anything.
1. In Pre-Authentication activity, set the pyUserIdentifier property to the generic operator ID.(pyUserIdentifier is set in context of Code-Security.)
2. User doesn't exist in Pega.
3. User logged in Mashup app directly and authenticated to get access token but then failed with below error for OIDCClientHandler
Fetch operator from claim subname from received ID token claims Exception is thrown for OIDC flow com.pega.pegarules.pub.PRRuntimeException: Unable to derive operator from IDToken
HCA Healthcare
US
@Jey2705The error occurs because Pega is still trying to derive the operator from the OpenID Connect (OIDC) token claims, even though you set the pyUserIdentifier in the Pre-Authentication activity. To fix this, ensure the Pre-Authentication activity explicitly sets the pyUserIdentifier to the generic operator (e.g., GenericUser) before Pega attempts to map the user from the token claims. This can be done by adding a step to directly set the pyUserIdentifier property, ensuring Pega uses the generic operator for all authenticated sessions. Also, make sure the generic operator (GenericUser) exists in Pega, is active, and has minimal roles required for the Mashup session. In the OpenID Connect Authentication Service, double-check that the Pre-Authentication activity is properly configured and there are no mappings or rules that might override it or trigger Pega to search for users in the system. This setup ensures Pega doesn't try to fetch or auto-create operators based on the claims, preventing the "Unable to derive operator from IDToken" error. Let me know if you still face any issues. thanks
CSC
US
@Sairohith Yeah followed all the steps as attached but still same issue. Not sure what I'm missing here.