Configure OpenID Connect for system user login

For system users signing in to the HP Insights web console

Note: This page covers OpenID Connect for system users signing in to the HP Insights web console. System users are administrators and other staff with HP Insights accounts not the people submitting and releasing print jobs. For an overview of all SSO options for system user login, see Configure SSO for system user login. For print job authentication, see Authentication Providers.

HP Insights supports two approaches for system user SSO. This document covers both paths:

  • SSO with SCIM (recommended) — System users are provisioned automatically from your identity provider based on group membership.
  • Legacy SSO — OpenID Connect authentication without SCIM. System users are created and managed manually in HP Insights and must be invited before they can sign in.

Before you begin

  • You have an OpenID Connect identity provider (for example, Microsoft Entra ID or Google) and permission to register applications in it.
  • You have registered HP Insights as an application in your identity provider and collected the Client ID, Client Secret, and Well-Known Endpoint.
  • The following redirect URIs are added to your identity provider's authorized redirect URIs list:
    • https://beacon.pharos.com/connect/external/signin-openidconnect
    • https://www.beacon.pharos.com/connect/external/signin-openidconnect
  • You have decided whether to use SSO with SCIM or legacy OIDC SSO. If unsure, use SSO with SCIM. For help deciding, see Configure SSO for system user login.

Path A — SSO with SCIM (recommended)

For full instructions on setting up OpenID Connect SSO with automatic system user provisioning, see Configure SSO with SCIM.

Path B — Legacy SSO (manual)

Legacy SSO configures OpenID Connect authentication for system user login without SCIM provisioning. System user accounts, roles, and access groups are managed manually in HP Insights. Use this path when the number of system users is small or SCIM provisioning is not required.

Note: When Enable SSO Sign-in for System Users is enabled under Account Settings → Settings, the legacy Single Sign-on Configuration tab remains visible but is inactive and displays "This feature is not applicable."

Step 1: Register

Register HP Insights as an application in your identity provider and collect the Client ID, Client Secret, and Well-Known Endpoint. For Microsoft Entra ID, see Creating an OpenID Connect application in Microsoft Entra ID.

Step 2: Configure SSO Provider Configuration

  1. Log in to the HP Insights web console.
  2. Navigate to Account Settings > Single Sign-on Configuration.
  3. Select OpenId Connect under Provider Types.
  4. Enter the following details:
Field Description
Well-Known Endpoint The OpenID Connect discovery document URL for your identity provider. Used to retrieve metadata automatically including the token endpoint, supported scopes, and key material. All URLs in the discovery document must be publicly accessible.

Examples:
https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration
https://accounts.google.com/.well-known/openid-configuration

Note: If using the common endpoint for Microsoft Entra ID, set Validate Issuer to No under Advanced Settings. Alternatively, use the tenant-specific endpoint: https://login.microsoftonline.com/{tenantid}/v2.0/.well-known/openid-configuration
Client ID

The unique identifier assigned to your HP Insights application by your identity provider. Also called the " Application ID".
Client Secret Client Secret also called “Application Password” is the secret key that the HP Insights uses to prove its identity when requesting a token.

Advanced Settings

Field Description
Scope The OAuth 2.0 scopes requested by HP Insights. The following scopes are requested by default:

openid (required) — Signals use of the OpenID Connect protocol to verify user identity.
email (required) — Returns the email claim used to identify the user in the web console.
profile (optional) — Returns the user's name.

If your identity provider uses non-standard scope names (for example, mail instead of email), contact HP Support.
Email JSON Key The name of the email claim in the ID token. Default value: email.
Response Mode Defines how the identity provider sends data back to HP Insights. Options: FormPost (default) or Query.
Response Type Defines the type of information returned by the identity provider. Options: idToken (default), CodeIdToken, or Code.
Validate Issuer Whether to validate that the user logging in comes from a known tenant. Default: Yes. Set to No when using the Microsoft Entra ID common endpoint (login.microsoftonline.com/common).

Step 3: Create and invite system users

After saving the OpenID Connect configuration, create system users in HP Insights and invite them to sign in.

  1. Navigate to Users > System Users and click Create.
  2. Enter the user's name, email address, role, and access group. The email address must exactly match their primary email in the identity provider.
  3. Click Save.
  4. Select the newly created user and click Invite, then Send. The user receives an email with a link to access the web console.

Note: Newly created system users cannot sign in until they have been invited.

Symptom: The system user authenticates with the identity provider but cannot access the HP Insights web console.

Cause: The system user's email address in the identity provider does not match their email address in HP Insights, or the system user has not been created and invited.

Resolution: Confirm the email address in Users → System Users exactly matches the primary email in the identity provider. If the system user has not been invited, send an invitation from System Users.

Symptom: Sign-in fails with an issuer validation error.

Cause: The Microsoft Entra ID common endpoint (login.microsoftonline.com/common) is being used and Validate Issuer is set to Yes.

Resolution: Set Validate Issuer to No under Advanced Settings, or switch to the tenant-specific endpoint: https://login.microsoftonline.com/{tenantid}/v2.0/.well-known/openid-configuration where {tenantid} is your Microsoft 365 tenant GUID.

Symptom: All system user logins fail simultaneously. No individual user changes have been made.

Cause: The client secret registered in HP Insights has expired.

Resolution: Generate a new client secret in your identity provider and update the Client Secret field under Account Settings → Single Sign-on Configuration. To avoid future disruption, set a calendar reminder to rotate the secret before its expiry date.

Related Topics: