Help center support eXpress
We've collected answers to popular questions to make eXpress easy and convenient to use. Didn't find the answer to your question? Contact our support team.
OpenID
- Welcome to eXpress
- eXpress Support
- Introducing eXpress & Glossary
- Installation & Updates & Requirements
- Registering & Logging In
- User Profile
- Chats, Channels & Threads
- Contacts
- Tags & Tabs
- Files
- Calls & Conferences
- Push Notifications & Counters
- Fixing Background Work on Mobile
- Bots & SmartApps
- Diagnostics, Logs, and Cache
- Admin Panel
- Admin Panel: General Information
- Users
- Chats
- Open Chats
- Calls
- Conferences
- Profile Change Request List
- Logout List
- Administrators
- Servers
- Bots
- Internal Bots
- External Clients Users
- UI Alerts
- Containers
- Audit
- Stickers
- Call Backgrounds
- Catalog
- Statistics
- Role Model
- Role Model Rules
- User Groups
- Call Reports
- Call Recordings
- Transcribings
- SMS Statuses
- Administrators Authentication
- Audit Settings
- Global Chat
- Global Bots
- Links to Chats/Calls
- Push Service
- File Service
- User Session
- Registration Settings
- Active Directory
- E-mail: self-registration
- OpenID
- Personal Data Visibility
- E-mail: sending emails
- Getting Started Instruction
- Blocked Users
- VoEx
- Server
- Support Info
- Security (CTS)
- Registration Instruction
- SmartApps
- Mobile Menu Configuration
- Activations
- SMS
- Adapters
- Masks
- Security
- CAPTCHA
- Reserved Phone Numbers
- Suggests
- Kerberos Settings & Kerberos Suggests
OpenID
- OpenID Provider
- Connection Parameters for OpenID
- Logout Settings for OpenID
- Device Authorization Method
- Attribute Mapping
CTS
eCTS
This section configures synchronization with OpenID.
OpenID Provider
- KeyCloak < 17;
- KeyCloak ≥ 17;
- Blitz;
- Beeline;
- Duende.
Connection Parameters for OpenID
| Parameter | Description |
|---|---|
| Host, port, identifiers, and other OpenID connection parameters | For detailed instructions, refer to the administrator documentation. |
| OpenID async timeout(in ms) | How long the server waits for a response from Keycloak when it refreshes the user's token or synchronizes data in the background. |
| OpenID login prefill | What to fill the login field with in Keycloak forms: E-mail or Phone of the user. The Don't prefill option leaves the field empty. If the user does not have the selected attribute, the field will also remain empty. |
Logout Settings for OpenID
| Parameter | Description |
|---|---|
| User logout request (Leave server button in web and desktop, Leave the server on Android and iOS), Logout request on user account deletion (more details), Logout request by user deleted in OpenID provider (user is deleted in the OpenID synchronization source), Administrator logout request (Logout button for the user in the admin panel) |
These logout request sources are system sources: they cannot be disabled. You can configure the auto-confirmation time for them. |
| Logout request when user is blocked | If an account is blocked in OpenID, sessions are closed automatically and a logout request is sent. |
| Logout request due to missing OpenID role | If a user doesn't have the role specified in the OpenID required role field, a request with reason openid_missing_required_role appears in the Logout List section. |
| Logout request on exclusion from OpenID sync selection | If an OpenID token has been inactive for longer than specified in the Token inactivity period for sending request (in days) field, the sessions are automatically closed and a logout request is sent. By default, the period is 30 days. This setting was introduced in version 3.62. |
| Auto-confirm after N days | For each reason, you can specify the number of days. After this time, the logout request will be confirmed without administrator involvement. Since version 3.58. To have the request confirmed immediately, select
0 days. |
| Delete user profiles when logout is confirmed | After the logout is confirmed, accounts synchronized from OpenID are automatically deleted from the corporate server. |
Device Authorization Method
This is where you select the QR code authorization method: CIBA or Device Auth Flow.
Attribute Mapping
Define which user attributes from OpenID will be used in user profiles.
What Format Should Be Used to Pass the Avatar From Keycloak?
In the Attribute Mapping section, in the Avatar field, specify the Keycloak user attribute that contains the image, for example picture. The attribute value is a JPEG image in data URI format: the string starts with data:image/jpeg;base64,, followed by the Base64-encoded image. PNG images and links to an image are not supported.