Each application that will use ActiveManage for sign-in is registered on the OpenID Connect Provider screen.
How it appears to your users
The name, description and logo are shown on the consent screen when a user is asked to approve the application. Get these right — this is exactly what your users read when deciding whether to trust something. A connected application called "test" with no logo will worry people, and should.
Application type
- Confidential — can keep a secret. A server-based website. Gets its own secret.
- Public — cannot keep a secret. A mobile app, or a website running entirely in the browser.
A secret shipped inside a mobile app or a browser page is not a secret. If the code runs on a device you do not control, it is public. Getting this wrong is the most common serious mistake here.
Return addresses
List every address the application may send users back to. They are matched exactly — a trailing slash or a different port will not match — because a loose match is how sign-ins get hijacked. Add development addresses while building, and remove them before going live.
User identifiers
- Shared — every application sees the same identifier for a user.
- Per-application — each sees a different identifier, so two applications cannot compare notes about who your users are.
Prefer per-application unless an application genuinely needs to be matched up with another.
Trusted applications
An application can be marked trusted, which skips the consent screen entirely. Reserve this for applications you publish yourself. It is not appropriate for anything from a third party.
Worked Examples
- Your own mobile app: public client, PKCE required, marked trusted so users are not asked to consent to your own app.
- Partner web application: confidential client, not trusted, limited to the information they actually need.