Breadcrumbs

Integration Steps on Utimaco ESKM

Configuring the OpenID Server

After completing the Microsoft Entra ID configuration and obtaining the required application details, configure the OpenID Server settings in ESKM.

  1. Log in to the ESKM Administration Portal using an administrator account.

  2. Navigate to Device → Administrators → OpenID Server Configuration.

  3. Click Edit.

  4. Enable OpenID Authentication.

  5. Configure the parameters listed in the table below.

  6. Click Save to apply the configuration.

Parameter

Description

Configuration URL

https://login.microsoftonline.com/<Tenant-ID>/v2.0/.well-known/openid-configuration

Client ID

<Application Client ID>

Client Name

<Display name>

Client Secret

<Client Secret value>

Registration ID

<Application Client ID>

Scope

openid,profile,email

Username Attribute Name

email

OpenID server configuration parameters

image-20260811-134635.png


OpenID server configuration

After saving the configuration, ESKM restarts the required services and enables OIDC-based authentication.

The Configuration URL, Client ID, Registration ID, and Client Secret values are obtained from the Microsoft Entra ID application registration created in the previous section.

The value specified for Username Attribute Name must correspond to a claim provided by Microsoft Entra ID. In this example, email is used to identify authenticated users.

Creating an OIDC Administrator in ESKM

After configuring the OpenID Server settings, create an OpenID administrator account in ESKM that corresponds to a Microsoft Entra ID user.

  1. Navigate to Device → Administrators → Administrators.

  2. Click Create OpenID Administrator.

  3. In the Username field, enter the email address of the Microsoft Entra ID user that will be granted access to ESKM. Ensure that the value matches the email claim returned by Microsoft Entra ID during authentication.

  4. Assign the required administrative privileges and access rights.

  5. Click Create to create the OpenID administrator.

image-20260811-121453.png


Administrator configuration

The OpenID administrator username must exactly match the value returned by the claim specified in the Username Attribute Name field of the OpenID Server Configuration. In this guide, the Username Attribute Name is configured as email.

After completing this step, the configured user can authenticate to ESKM using Microsoft Entra ID credentials through OIDC authentication.