OpenEdge Command Center supports local authentication and external identity provider (IdP) authentication, but only one authentication mode can be active at a time.

With local authentication, OpenEdge Command Center stores user credentials and manages user roles. In local authentication mode:

  • OpenEdge Command Center creates and manages local user accounts.
  • Users sign in with a local username and password.
  • You manage users and assign roles in OpenEdge Command Center.

With IdP authentication, an OpenID Connect (OIDC)-compliant identity provider authenticates users and assigns roles.

IdP authentication can provides single sign-on (SSO), centralized user management and multi-factor authentication (MFA) managed by the organization’s identity provider.

When IdP authentication is active, users sign in through the configured identity provider instead of entering their OpenEdge Command Center credentials.

In IdP authentication mode:

  • The identity provider Administrator creates and manages users in the identity provider portal.
  • Users sign in through the identity provider.
  • The identity provider Administrator assigns app roles to users. The identity provider must include the assigned app roles in the access_token.
  • The Users page and user-management REST endpoints are unavailable.
  • OpenEdge Command Center uses the roles assigned by the identity provider to determine user access.
  • OpenEdge Command Center continues to maintain the role definitions and permissions for those roles.
  • The identity provider must provide the required OIDC scopes: openid, profile, email, and offline_access.
  • A user without an email address cannot sign in. A user without the role:oecc/oecc_admin role can sign in but cannot access OpenEdge Command Center details.

OpenEdge Command Center supports OIDC-compliant identity providers such as Microsoft Entra ID and Okta configured with a custom authorization server.

To configure IdP authentication, an OpenEdge Command Center administrator must:

  1. Configure the OpenEdge Command Center application in the identity provider portal.
  2. Create the required app roles and assign them to users.
  3. Ensure that the identity provider issues a JWT access token that contains the assigned app roles.
  4. Configure the identity provider in OpenEdge Command Center by using the SWITCHAUTHMODE command-line utility.
  5. Activate the configuration and restart the OpenEdge Command Center server. In high-availability deployments, restart each OpenEdge Command Center server so that all instances read the updated authentication configuration at startup.

You can use the SWITCHAUTHMODE utility on the OpenEdge Command Center server host to:

  • Store and activate authentication configurations.
  • Switch between authentication providers.
  • Return to local authentication when required.

You can store multiple identity provider configurations, but only one authentication configuration can be active. Inactive configurations remain stored and can be activated later without entering their values again.

A role change done by the identity provider Administrator takes effect when the user signs in again or when OpenEdge Command Center refreshes the user session or UI.