The feature is off when supplied. Turn it on with Enable OpenID Connect Provider; while it is off, ActiveManage behaves as though the feature does not exist rather than advertising a disabled service.
The settings
- Allow Authorization Code Grant (on) — the standard browser sign-in flow, which is what nearly every application uses.
- Allow Refresh Token Grant (on) — lets an application keep a user signed in without asking again.
- Allow Client Credentials Grant (off) — machine-to-machine access with no user involved.
- Allow Device Code Grant (off) — sign-in for devices with no keyboard.
- Require PKCE (on) — an extra protection on the sign-in exchange. Leave this on.
- Allow "plain" PKCE Method (off) — a weaker form for old applications. Leave off.
- Log OIDC Requests (on) — records every sign-in and token request. Credentials are never logged.
Leave the two "off" grants off
Client credentials and device code are disabled deliberately. Client-credentials access has no user behind it, so nothing about it is limited by a person's permissions. The device grant has the largest attack surface of the four. Enable each only when you have an application that genuinely needs it.
Before you switch it on
- Your platform must be reachable over HTTPS at a stable address — connected applications are configured against it.
- Decide what information you are willing to release.
- In a multi-tenant installation, connected applications and user consents are not shared between tenants.