warning

This documentation applies only to ThingPark Enterprise SaaS. Authentication federation for self-hosted ThingPark Enterprise is documented in:

• Authentication federation for self-hosted Appliance/VM deployments,
• Authentication federation for Kubernetes deployments.

Domain-Based Access via External Identity Provider (OAuth / OIDC)

This feature allows ThingPark Enterprise or Wireless SaaS subscribers to delegate the authentication of their end-users to third-party identity providers, to support federated authentication and single sign-on (SSO) across the user's applications.

Requirements

To enable this capability, you must configure an OAuth 2.0 / OpenID Connect client in your Identity Provider (IdP). This client enables ThingPark to delegate authentication to your IdP and retrieve user identity information.

OAuth client configuration

Client Type: Confidential Client

Your IdP must support at least one of the following:

• Client secret in HTTP body (client_secret_post)
• Client secret via Authorization header (client_secret_basic)
• JWT signed with client secret (client_secret_jwt)
• JWT signed with private key (private_key_jwt)

The private_key_jwt method is preferred, with the following Set URL:

https://{your-thingpark-enterprise-domain}/auth/realms/tpw-users-actility-tpe-ope/protocol/openid-connect/certs

info

Replace {your-thingpark-enterprise-domain} either with thingparkenterprise.eu.actility.com, thingparkenterprise.au.actility.com or thingparkenterprise.us.actility.com.

Redirect URI

https://{your-thingpark-enterprise-domain}/auth/realms/tpw-users-actility-tpe-ope/broker/{identity-provider-alias}/endpoint

info

Replace {identity-provider-alias} with your configured IdP alias (e.g., customer name). This value must be agreed upon and must be unique on the ThingPark side.

Post-Logout Redirect URI

https://{your-thingpark-enterprise-domain}/auth/realms/tpw-users-actility-tpe-ope/broker/{identity-provider-alias}/endpoint/logout_response

OAuth / OIDC Flow

The IdP must implement the Authorization Code Flow (code response type):

• Grant types: authorization_code, and refresh_token.

Required scopes

The following scopes must be enabled: openid, email, and profile.

Required Claims

Your IdP must provide the following claims in the ID token and/or userinfo response:

• sub (unique user identifier)
• email
• name
• family_name
• given_name
• middle_name (if available)

Information Required for Integration

Once the OAuth client is configured, please provide the following details:

• Client ID
• Client Secret (must be shared securely, e.g., via SMS or secure channel)
• Authorized email domain(s):
  • Example: example.com
• OpenID Connect configuration endpoint:
  • Must end with /.well-known/openid-configuration

ThingPark Support will work with you to test and configure the identity provider integration.

warning

Client secrets typically have a limited lifetime (for example, up to two years in Microsoft Entra ID). Since their expiration cannot be monitored by ThingPark, please ensure that renewed credentials are shared with us through a secure channel before the current secret expires to avoid any service disruption.