OpenID Connect (OIDC)

This document covers how OpenID Connect works as an authentication provider for both Secure Print and Secure Print Direct.

What is OpenID Connect?

The OpenID Foundation defines OpenID Connect (OIDC) as a simple identity layer built on top of the OAuth 2.0 protocol. It allows clients to verify the identity of the end-user based on the authentication performed by an identity provider, as well as to obtain basic profile information about the end-user.

You can get more information about OpenID Connect from this website.

Benefits of OpenID Connect

Integrates with well-known identity providers like Microsoft® Entra ID, Google, etc.
Eliminates the responsibility of storing and managing user credentials.
Separates the user’s print identity from the workstation’s login identity. It does not matter what the user logs in as.

How OpenID works in HP Insights

Registration and authentication flow

When a user first launches the HP Secure Print desktop app(or sends a job on Linux), Print Scout triggers OIDC registration. The HP Insights Identity Service acts as the broker. The IdP handles all credential validation, and HP only receives the resulting tokens.

What happens during registration

When a user registers with HP Insights using OpenID Connect, the HP Insights Identity Service acts as the broker between Print Scout and your identity provider. The user's credentials never pass through Pharos. Authentication is handled entirely by your identity provider, and HP Insights receives only the resulting tokens.

The diagram below shows the authentication sequence from the moment a user clicks Login to continue through to their print identity being established.

Authentication request - Print Scout sends an authentication request to the HP Insights Identity Service, which redirects the user to the configured identity provider. The request includes the client ID, requested scopes, redirect URI, and response type.
Identity provider login - The identity provider returns its login page, displayed to the user in an embedded browser. The user enters their organizational credentials, password, or whatever the identity provider requires.

Authorization code returned - On successful authentication, the identity provider redirects back to the HP Insights Identity Service and issues a short-lived authorization code.

Token exchange - The Identity Service exchanges the authorization code for three tokens: an access token, an ID token, and a refresh token. This exchange happens server-side, the tokens are never exposed to the client.

Identity established - The Identity Service reads the email address from the ID token and registers it as the user's print identity in HP Insights. From this point, the user's email is used to attribute jobs, authenticate at devices, and link print activity across Secure Print and Secure Print Direct.

Deployment

Print Scout platform support

Print Scout must be installed on user workstations. The Print Scout installs theHP Secure Print desktop app, which enables user registration. During user registration, the Print Scout will obtain the user’s email address from the returned identity token. That email address then becomes the user’s identity for printing.

Windows - Full desktop app installed. User launches app to trigger registration.
macOS - Full desktop app installed. User launches app to trigger registration.
Linux - No desktop app. Registration begins when user submits a job to the default HP Secure Printer

OpenID Specifications

Authorization Flow

Authorization flow defines how tokens are obtained. The Identity Service uses the Authorization Code Flow by default.

Flow	Supported	Notes
Authorization Code	Supported	Default. Short-lived auth code exchanged server-side for access, ID, and refresh tokens.
Hybrid	Supported	Combines elements of authorization code and implicit flows.
Implicit	Not supported	Tokens returned directly in redirect. Not supported by HP Insights.

Default Scopes

The Identity Service requests the following scopes when redirecting to the IdP. Scopes determine which claims are returned in the ID token.

Scope	Description	Claims Supported
openid	This indicates that the Print Scout intends to use the Open ID protocol to verify a user’s identity. Required.
email	This scope returns the email claim, which contains the user’s email address. This email address is used to identify the user at the Secure Printer when releasing print jobs. Required.	email
profile	This can be used to personalize HP Insights. For example, you can request the user’s name to show in the printer. Optional

Scope

Description

Claims Supported

openid

This indicates that the Print Scout intends to use the Open ID protocol to verify a user’s identity.

Required.

This scope returns the email claim, which contains the user’s email address. This email address is used to identify the user at the Secure Printer when releasing print jobs.

Required.

profile

This can be used to personalize HP Insights. For example, you can request the user’s name to show in the printer.

Optional

Notes:

HP Insights uses the standard scopes and claims as defined in Oauth 2.0. If your identity provider uses customized scopes (e.g. your system expects mail instead of the standard email scope), contact the operations team.
Offline_access is not part of the scope list.

Related Topics: