• Overview
• Integrating with specific Identity Providers

• Debugging

1. Create a CSV with the following formatting

2. Log into YOUR_VFUNCTION_SERVER/organization/team
3. Select Import Users from the left-hand sidebar
4. Click the blue Choose CSV File button
5. Select the CSV that you created
6. Open the file to import the users

1. SSH to the vFunction Server
2. Open the server-installation.yaml:

3. Uncomment and modify the server.authentication keys using the samples in the sections below as a guide
4. Save and close the file.
5. Run the install.sh script if configuring a new vFunction Server or the upgrade.sh script if modifying an existing vFunction Server:

1. Login into the Azure Portal
2. From the Menu Bar, select Add > App Registration
3. In the text box, select a name for the Azure OIDC Application, such as, “vfunction”
4. Under Supported Account Types, select who can use the new Azure OIDC Application, e.g. “Accounts in this organizational directory only”
5. Under the Redirect URI (optional) header, select Single-page Application (SPA) in the Select a platform dropdown
6. Type the following URLs into the text box next to Single-page application (SPA):

7. Click the blue Register button
8. In the left-hand sidebar, select API permissions under Manage
9. Select the three-horizontal-dot submenu button next to user.read and select Remove permission
10. Select Add a permission in the center pane
11. Select Microsoft Graph from the right-hand dialog box under the Microsoft APIs header
12. Select Delegated permissions
13. Check the boxes next to email, openid, and profile
14. Click the blue Add permissions button at the bottom of the dialog box
15. Click the checkbox icon on the Configured Permissions Menu Bar to Add admin consent for $organizationName
16. Click Yes in the confirmation dialog box
17. In the left-hand sidebar, select Authentication under Manage
18. Under Front-channel logout URL, input your vFunction Server’s address followed by /signout, e.g https:// $VF_SERVER_ADDRESS/signout
19. Click the blue Save button
20. Select Overview from the left-hand sidebar to gather the Tenant ID and Client ID

1. Visit the Google Console Dashboard
2. Click Credentials in the left-hand sidebar
3. Click Create Credentials at top of center pane
4. Choose OAuth Client ID from the dropdown choices. Note that this might make you fill out the Consent Screen page if it hasn’t been done already
5. Choose Web Application from the Application Type dropdown
6. Give the OAuth Client a name in the text box for Name
7. Click the ADD URI button under the Authorized JavaScript Origins** header. Input the vFunction Server’s Fully Qualified Domain Name (FQDN)
8. Click the Add Redirect URIs header. Input the FQDN/oauth/redirect
9. Click the Create button
10. Copy the Client ID and Client Secret from the dialog box where they are displayed for use on the vFunction Server

1. Visit the Google Console Dashboard
2. Click Credentials in the left-hand sidebar
3. Click Create Credentials at top of center pane
4. Choose OAuth Client ID from the dropdown choices. Note that this might make you fill out the Consent Screen page if it hasn’t been done already
5. Choose Desktop Application from the Application Type dropdown
6. Give the OAuth Client a name in the text box for Name
7. Click the Create button
8. Copy the Client ID and Client Secret from the dialog box where they are displayed as the Client Secret will not be accessible from this point forward. However, these values are not required for use with Visual Studio Code

1. Log into the Keycloak Admin Console
2. In the General Settings, select Clients from the left-hand sidebar
3. Select Create client blue button on the menu bar
4. Select OpenID Connect in the Client Type dropdown
5. Type a Client ID such as qa-vfunction
6. Type a Name for the vFunction Client
7. Click the Next blue button in the bottom center
8. In the Capability Config, ensure Client authentication is toggled to Off
9. Check Standard Flow checkbox in the Authentication Flow section
10. Select S256 in the PKCE Method dropdown
11. Click the Next blue button in the bottom center
12. In the Login Settings, type the VF Server Address in the Root URL text box, e.g. https://vfunction.myorg.com
13. Type the VF Server Address in the Home URL text box, e.g. https://vfunction.myorg.com
14. Type $VF_SERVER_ADDRESS/oauth/redirect in the Valid redirect URIs text box
15. Type $VF_SERVER_ADDRESS/signout in the Valid post logout redirect URIs text box
16. Click the Save blue button in the bottom center
17. Select Client scopes from the left-hand sidebar
18. Confirm basic, email, and profile are set to Default in the Assigned type column
19. Select Users from the left-hand sidebar
20. Select a test user from the table
21. Confirm the test user has a value in the Email field that matches the user authorized to the vFunction Server
22. Add the Keycloak vFunction Client to the vFunction Server’s server-installation.yaml following the steps below

Create the vFunction App in the Okta Admin Console

Create the vFunction App in the Okta Admin Console

The Okta examples below are taken from Okta’s documentation. Replace the values “yourOktaDomain”, “clientId” with your organization’s values.

server:
  authentication:
    authority: 'https://yourOktaDomain'
    client_id: 'clientId'
    ### Do not add the Client Secret. This field can be left blank
    client_secret: ''
    jwks_url: 'https://yourOktaDomain/oauth2/v1/keys'
    issuer: 'https://yourOktaDomain'

1. Create the vFunction App in the OIDC Provider
2. Add the OIDC Provider’s Configuration Settings to the vFunction Server-Installation.yaml
3. Run the vFunction Server’s upgrade.sh script
4. Open a browser with the F12 Network Console open
5. Visit your vFunction Server
6. The vFunction Server visits the site ISSUER/.well-known/openid-configuration to gather the URL for the authorization_endpoint. If you are never redirected to the login page of your OIDC provider, it’s most likely because the Issuer field is incorrect in the server-installation.yaml
7. After logging in to your Identity Provider, you should be redirected back to the vFunction Server. If you are caught in a loop at this stage being bounced back and forth between the vFunction Server and your Identity Provider, it is probably due to a setting in the Identity Provider’s vFunction App. If you are redirected back to the vFunction Server and an error is generated on the vFunction Server, find the /token API call
8. Copy the Encoded Token from the F12 Network Console
9. Paste the Encoded Token into https://www.jwt.io to see the Decoded Headers. Look for unexpected values in the JSON to further debug