Identity as a Service:General configurations

Each application has some general configurations and feature-specific configurations. You can manage general configurations of applications on the General tab.

To access the General tab, click Applications in the menu, find the application that you want to manage, and then click Manage.

In the current version of Identity as a Service (IDaaS), administrators can enable or disable API operations and rotate secrets.

API operations

IDaaS provides a variety of API operations for each application. You can enable some API operations for an application so that the application can call these API operations to implement certain features. The following API operations are provided:

• API operations for single sign-on (SSO) based on OpenID Connect (OIDC)

• API operations for account synchronization

• API operations for permission management (coming soon)

An application must exchange its client_id and client_secret configured on the General tab for an access_token to call these API operations.

In the current version of IDaaS, administrators can enable or disable API operations and rotate secrets.

Secret rotation

You can customize the interval of secret rotation for each application.

To make secret rotation easier, IDaaS allows you to configure at most two client_secrets for an application and enable at least one client_secret.

During the rotation period, you can keep both of the client_secrets enabled. After you confirm that the old client_secret is no longer needed, you can delete the old client_secret.

To ensure security, we recommend that you rotate secrets every three months or according to specific compliance requirements. The following steps show you how to rotate secrets:

1. Create a new client_secret.

2. Replace the old client_secret with the new one.

3. Disable the old client_secret. When you disable a client_secret, you will be prompted the last time when this client_secret was used. After you confirm that the client_secret is no longer used, you can disable it.

4. Verify whether the running of the application is affected.

5. After you confirm that the running of the application is not affected, you can delete the old client_secret.

Basic Information