OpenID Connect is built on top of the OAuth 2.0 specification. You can use an OpenID Connect provider to set up single sign-on (SSO) and multi-factor authentication (MFA) for authorization and authentication of users through external providers such as Gmail and Okta.

Prerequisites

Configure an OpenID Connect provider and add its callback URL to your browser’s allowlist.

Example URL: https://instance-url.com/s/open_id/login_check

Enabling OpenID Connect

1. Log in to Campaign Studio.

2. Click the Settings icon on the top right corner.

3. Click Configuration > User/Authentication Settings.

4. Locate the OpenID Connect Settings section.

5. Set the Enable toggle bar to Yes to enable users to log in to Campaign Studio with their OpenID Connect provider account.

   Campaign Studio displays other configuration fields.

6. Configure the following optional fields based on your requirements:

   • Set the Require users to authenticate with OpenID Connect toggle bar to Yes so that users must authenticate through OpenID Connect and prevent them from logging in through other methods.

   • Set the Allow new user registration toggle bar to Yes to enable Campaign Studio to automatically create an account for the user in the instance when they log in with their OpenID Connect provider account, provided the OpenID Connect provider account is not attached to a Campaign Studio user.

7. In Role for new users, select the default role to assign permissions to new users who register to Campaign Studio with their OpenID Connect provider account.

   You can view and select the default role only if you have already created it through the Roles page. If you do not select the default role, Campaign Studio assigns the default Administrator role to all new users.

8. Configure the following required fields:

   1. In Client URL, enter the URL of your OpenID Connect provider.

   2. In Client ID, enter the App ID of your OpenID Connect provider.

   3. In Client Secret, enter the App secret of your OpenID Connect provider.

   4. In Identifier field, keep the default value sub, which is a unique ID set by the OpenID Connect field provider.

      Caution

      Do not change the default value of this field as this field links the OpenID Connect provider account of all users to their Campaign Studio account. If you change this value, Campaign Studio deletes existing links between those two accounts of all users.

      The following are the possible scenarios if you choose to change the default value:

      • If you change this value correctly, users can log in with their OpenID Connect provider account, provided the Require users to authenticate with OpenID Connect toggle bar is set to Yes. However, they must relink their accounts.

      • If you change this value incorrectly, users cannot log in to Campaign Studio. In that case, you must create a Support ticket, and all users must relink their Campaign Studio account through OpenID Connect.

9. Click Save.

Login scenarios

When you enable OpenID Connect, the Campaign Studio login page starts displaying the Sign In with OpenID Connect button. The login process differs based on the options that you configure.

The following table lists some of the common login scenarios:

Unlinking existing user accounts

Sometimes the Campaign Studio account of a user gets linked to a wrong OpenID Connect provider account. Therefore, you must unlink the Campaign Studio account from the OpenID Connect provider account.

1. Log in to Campaign Studio as an administrator or a user with permissions to access the Edit User page of other users.

2. Click the Settings icon on the top right corner.

3. Click Users.

4. Select the user account that you want to unlink.

   Campaign Studio displays the Edit User page.

5. Locate Open ID identifier and delete the unique identifier value for the user.

6. Click Save & Close.

   Campaign Studio unlinks the user account.

   Important

   Unlinking a user account does not automatically log the user out from the instance if the user is already logged in. To deny a user’s access to Campaign Studio, you must unpublish or delete the Campaign Studio account of the user.

   If the Allow new user registration toggle bar is set to Yes, Acquia recommends you to disable the user from your OpenID Connect provider to prevent them from recreating a new Campaign Studio account and regaining access.

OpenID Connect