Configure OpenID Connect Authentication in HP Insights

OpenID Connect (OIDC) lets print users authenticate through your organization's identity provider using token-based Single Sign-On. For an overview of how OpenID Connect works in HP Insights, see OpenID Connect (OIDC).

Before you begin, register the HP Insights application in your identity provider — see Configuring OIDC with Microsoft Entra ID for a step-by-step example. Once the application is registered, enter the OIDC settings into the web console as described below.

Required Configuration Values

You will need the following three values, collected when you registered the application in your identity provider:

  • Well-Known Endpoint — the OpenID Connect discovery document URL published by your identity provider (in Entra ID, listed under Endpoints).

  • Client ID — the identifier your identity provider assigns to the registered application (in Entra ID, the Application (Client) ID on the app Overview page).

  • Client Secret — the secret issued for the application (in Entra ID, created under Certificates & Secrets).

Entering OpenID Settings in HP Insights

After you’ve registered the HP Insights application to your OpenID provider, you can now add the client-specific OpenID Connect settings into HP Insights.

  1. Log in to the web console.

  2. Navigate to the Account Settings > Settings tab.

  3. In the User Authentication Providers section, select OpenID Connect.

  4. Enter the following details:

    • Well-Known Endpoint

    • Client ID

    • Client Secret

  1. Click Test to verify the connection to your IdP before saving.

  2. Click Save and enter the Site Encryption Key when prompted.

Note: After saving, configure Claim Mapping to control how user attributes from the IdP token map to HP Insights user properties. See Claim Mapping.

Verifying the Configuration

  • Launch the HP Secure Print desktop app on a test workstation (Windows or Mac) or submit a print job (Linux).

  • Click Login to continue and confirm you are redirected to your organisation's identity provider login page.

  • Authenticate with your organisational credentials.

  • Confirm the message "Authenticated successfully" appears.

The Test button on the settings page checks that HP Insights can reach your identity provider. It does not sign a user in, so it does not exercise the consent flow or the redirect. Complete the check above as well before treating authentication as working.

Run that check in a private or incognito browser window. An ordinary window may reuse an existing session with your identity provider and appear to succeed for you while failing for everyone else.

ImportantMicrosoft Entra ID and some other providers require an administrator consent grant before users can authenticate. The Test button does not exercise consent, so a consent problem appears only when a user actually signs in. If the check above fails with a consent-related error, grant admin consent for the HP Insights application in the identity provider, then try again.
Field Description
Well-Known Endpoint

HP Insights uses Well-Known Endpoint (also called “discovery document”) to retrieve metadata about your Identity Provider. This is used to configure user authentication sessions automatically. It returns information like the issuer name, key material, supported scopes, token endpoint URL, and so on. See the OpenID specification document (https://openid.net/specs/openid-connect-discovery-1_0.html) for more details.

Note: All URLs contained with the discovery metadata need to publicly accessible.

OpenID providers publish their metadata at a well-known URL. Here are some examples:

  • https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration
  • https://accounts.google.com/.well-known/openid-configuration
Client ID The application ID assigned to the HP Insights application in your IdP. Called 'Application ID" in Microsoft Entra ID.
Client Secret

The client secret generated for the HP Insights application in your IdP. Store this value securely, it is not displayed again after saving. If the secret expires, OIDC authentication stops for all print users until the secret is updated.

Also called "Application Password".
Redirect URI

The Redirect URI (also referred to as the reply URL or callback URL) defines the endpoint where the identity provider sends authentication responses after the user signs in.

The redirect uri looks like this:

https://<hosting-environment>/login/connect/external/signin-openidconnect

HP EU: https://api-eu.insights.hpondemand.com/login/connect/external/signin-openidconnect

HP US: https://api.insights.hpondemand.com/login/connect/external/signin-openidconnect

The user completes the OIDC login flow successfully but the HP Secure Print desktop app does not display a passcode. Reinstalling Print Scout or deleting the user registration does not resolve this. This is a known cloud configuration issue affecting individual organizations. Contact Support with your tenant GUID.

Users experience a period where OIDC authentication fails completely and then recovers on its own. The cloud logs show an error similar to: System.Security.Cryptography.CryptographicException: An error occurred during a cryptographic operation with an inner exception referencing invalid Base-64 characters.

This is a known intermittent issue in the Identity Service component. It typically resolves without intervention. If it persists beyond 30 minutes, contact Support with your tenant GUID and the approximate time of the outage so the cloud logs can be reviewed.

If the Client ID, Client Secret, or Well-Known Endpoint is changed after users have registered, existing users fail to authenticate because their stored tokens are no longer valid for the new configuration. When making any change to the OIDC configuration, purge all existing user registrations at the same time. Users must re-register from the HP Secure Print desktop app.

Related topics