> ## Documentation Index
> Fetch the complete documentation index at: https://docs.slm.m1amdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Configuring Merchant Authentication with Vindicia IDP 1.0 and User Definition
To work with Vindicia IDP 1.0 ,there are several screens for Authentication and User Management that require configuration in Subscribe/Retain Portal 1. The order of their use is important, please follow the flow as shown below. These screens are relevant only after the merchant was created.
1. **IDP Merchant Configuration** - this screen is available for Vindicia internal admin users as part of the Admin menu in Portal 1. It serves to configure the Authentication method to be used. Several authentication IDP can be configured but only a single one can be active at a given time. It is important to first define the merchant's IDP (authentication) and only then start adding merchant users.
2. **User Management** - this screen is available for Vindicia internal admin users as part of the Admin menu in Portal 1. It serves to add merchant users to the Merchant account. When an automated integration is available for users (such as is the case for Vindicia IDP-ulm), added users will also be added in the IDP.
**Note:** If no IDP is defined and activated in the IDP Merchant Configuration screen and users are added, they'll be receiving portal-generated passwords by default.
* **[Configure Authentication (IDP) Configuration](../topics/subscribeUserAuthentication_r#)**
* **[IDP Configuration Fields](../topics/subscribeUserAuthentication_r#)**
* **[Configure Users for Vindicia IDP 1.0](../topics/subscribeUserAuthentication_r#)**
**Parent topic:**[Vindicia Portal Users and Authentication](../topics/subscribeRetainUserAuthentication)
## Configure Authentication (IDP) Configuration
* The relevant merchant must already be created in the system
* Ensure you've received External IDP credentials from merchant (MAC), if needed. For details, see [External User Authentication](https://docs.vindicia.com/bundle/subscribeImplementationGuide/page/topics/externalUserAuthenticationAbout.html).
* Ensure you have the merchant's MAC document or Retain Onboarding doc and received any guidance about increasing security for password reuse or lifetime. For details, see [Password Requirements](passwordRequirements_r)
* If planning to use Vindicia IDP, open a ticket based on [VIN-19073](https://support.corp.aws.vindicia.com/browse/VIN-19073) template with the ulm team (Amin-Eshtehardi) - one day turnaround expected. You can also include Password Settings requirements , if those were provided by Merchant., for details, see [Password Requirements](passwordRequirements_r)
* Ensure you've received Merchant's user and role list
1. Using an Admin user, access Subscribe Portal 1.0 [https://secure.staging.us-west.vindicia.com/login/secure/](https://secure.staging.us-west.vindicia.com/login/secure/)
2. Select **Admin** > **IDP Merchant Configuration**
The IDP Merchant Configuration screen appears.
3. Select the relevant Merchant from the **Merchant Name** drop-down list.
4. Select the relevant Identity Provider from the **Provider Name** drop-down list.
Available values:
* ulm - This is the Vindicia IDP value and will be the one defined for new merchants
* okta - use when configuring external user authentication with Okta Idp
* azure - use when configuring external user authentication with MS Azure
* testIdp- used for testing only
5. Define the IDP fields as needed. Refer to the tables below for guidance regarding the fields.
6. Click **Save Configuration**.
The entered configuration is saved.
**Note:** This only saves the configuration but does not activate it. Only one IDP can be active per merchant.
7. For ulm (Vindicia IDP) only, click **M2M API Configuration** and enter the Machine-to Machine details for automatic user registration in both Vindicia portal and ULM. Refer to the tables below for guidance regarding the fields.
If entered details were not required, click **Clear M2M Data**.
8. When ready, click **Activate Configuration**.
**Remember:** Only one IDP configuration can be active per merchant at one time. Inactivate any other configuration before activating new configuration.
The merchant is defined as using Single sign on to the Vindicia portal via the configured IDP. The merchant's users will be redirected to the IDP for log in authentication.
**Parent topic:**[Configuring Merchant Authentication with Vindicia IDP 1.0 and User Definition](../topics/subscribeUserAuthentication_r#)
## IDP Configuration Fields
| Provider | Field Guidance | Values |
| - | - | - |
| **ulm:** choose this to configure Vindicia IDP | The following fields are relevant: | |
| - **JSON Web Key (JWK) Endpoint URL**: JWKS is a set of keys containing the public keys used to verify any JSON Web Token (JWT) issued by the authorization server. It must exactly match the redirect URIs that is registered in ulm. **Note:** Receive this from the ticket user mapping ticket for opened for ulm | Example value: [https://merchantportal.m1amdocs.com/oidc/jwkThe](https://merchantportal.m1amdocs.com/oidc/jwkThe) \ section provides a different entry for each merchant. | |
| - **Authorization Endpoint**: To grant access, Vindicia accepts an authorization code. The authorization endpoint interacts with the Resource Owner and obtain an Authorization Grant. It must exactly match the authorization endpoint created and registered in ulm. **Note:** Receive this from the user mapping ticket opened for ulm | Example value: [https://merchantportal-ulm-pdt.m1amdocs.io/oidc/authorizeThe](https://merchantportal-ulm-pdt.m1amdocs.io/oidc/authorizeThe) \ section provides a different entry for each merchant. | |
| - **Token Endpoint**: The token that can make requests to the resource. By posting a request to the /token endpoint, the user gets the access token. **Note:** Receive this from the user mapping ticket opened for ulm | Example value: [https://merchantportal-ulm-pdt.m1amdocs.io/oidc/tokenThe](https://merchantportal-ulm-pdt.m1amdocs.io/oidc/tokenThe) \ section provides a different entry for each merchant. | |
| - **Client ID**: Client (merchant) identifier that must exactly match with the one generated in ulm. **Note:** Receive this from the user mapping ticket opened for ulm | Example value: e0c7390484ae45b999dc7525be9327be | |
| - **Password Reset Link**: Merchant's IDP User Management Portal URL in which the user can update login details. **Note:** Receive this from the user mapping ticket opened for ulm - Tenant URL | Example value: [https://merchantportal-ulm-pdt.m1amdocs.io/](https://merchantportal-ulm-pdt.m1amdocs.io/) | |
| - **Client Secret**: IDP configuration Secret generated by ulm. Once entered, it is masked for viewing for security purposes. **Note:** Receive this from the user mapping ticket opened for ulm | Example value: asd1d1d121dasd12e321dasd | |
| **ULM M2M API Configuration** | Machine-to-Machine API details are needed in order to add new users for the merchant once. Users are added in the Vindicia portal and sent automatically to ulm via API for creation.The following fields are relevant: | |
| - **M2M Client ID**: Client ID for the M2M API call, generated by ulm. **Note:** Receive this from the user mapping ticket opened for ulm | Example value: asd1d1s581dasd12e321dasd | |
| - **M2M Client Secret**: Client Secret for the M2M API call, generated by ulm. Once entered, it is masked for viewing for security purposes. **Note:** Receive this from the user mapping ticket opened for ulm | Example value: asd1d1s581dasd12e321dasd | |
| - **M2M Tenant Link**: Base URL for the API Call. **Note:** Receive this from the user mapping ticket opened for ulm | Example value: [https://merchantportal-ulm-pdt.m1amdocs.io/](https://merchantportal-ulm-pdt.m1amdocs.io/) | |
| **okta:** choose this to configure Okta IdP. You will need to receive details from the merchant (MAC). | The following fields are relevant: | |
| - **JSON Web Key (JWK) Endpoint URL**: JWKS is a set of keys containing the public keys used to verify any JSON Web Token (JWT) issued by the authorization server. It must exactly match the redirect URIs that is registered in Okta. | Example value: [https://merchant.okta.com/oauth2/ausmk34oz2PZAdU1i0x7/v1/keys](https://merchant.okta.com/oauth2/ausmk34oz2PZAdU1i0x7/v1/keys) | |
| - **Authorization Endpoint**: To grant access, Vindicia accepts an authorization code. This is the initial call that Vindicia would make when a user tries to log in.The authorization endpoint interacts with the Resource Owner (okta) and obtains an Authorization Grant. It must exactly match the authorization endpoint created by merchant in OKTA. | Example value: https//merchant.okta.com/oauth2/ausmk34oz2PZAdU1i0x7/v1/authorize | |
| - **Token Endpoint**: This is the path that Vindicia will use to validate the token. The token can make requests to the resource. By posting a request to the /token endpoint, the user gets the access token. | Example value: [https://merchant.okta.com/oauth2/ausmk34oz2PZAdU1i0x7/v1/token](https://merchant.okta.com/oauth2/ausmk34oz2PZAdU1i0x7/v1/token) | |
| - **Client ID**: Client (merchant) identifier that must exactly match with the one generated by the merchant in the Okta app. **Note:** Different Client ID may be provided for the Merchant's Staging and Production environments in Okta | Example value: 0oa1qmrashpgBdtcq2d7 | |
| - **Password Reset Link**: Merchant's IDP User Management Portal URL in which the user can update login details. | leave blank if not available | |
| - **Client Secret**: IDP configuration Secret (password) generated by merchant in the okta app. Once entered, it is masked for security purposes. **Note:** Different Client ID may be provided for the Merchant's Staging and Production environments in Okta | | |
| **azure:** choose this to configure MS Azure | The following fields are relevant: | |
| - **JSON Web Key (JWK) Endpoint URL**: JWKS is a set of keys containing the public keys used to verify any JSON Web Token (JWT) issued by the authorization server. It must exactly match the redirect URIs that is registered in Azure. | Example value: [https://login.microsoftonline.com/c3eca3ca-1246-46d5-4d2d-a0f2a028920f/discovery/v2.0/keys](https://login.microsoftonline.com/c3eca3ca-1246-46d5-4d2d-a0f2a028920f/discovery/v2.0/keys) | |
| - **Authorization Endpoint**: To grant access, Vindicia accepts an authorization code. This is the initial call that Vindicia would make when a user tries to log in.The authorization endpoint interacts with the Resource Owner (azure) and obtains an Authorization Grant. It must exactly match the authorization endpoint created by merchant in MS Azure. | Example value: [https://login.microsoftonline.com/c8eca3ca-1246-46d5-4d2d-a0f2a028920f/oauth2/v2.0/authorize](https://login.microsoftonline.com/c8eca3ca-1246-46d5-4d2d-a0f2a028920f/oauth2/v2.0/authorize) | |
| - **Token Endpoint**: This is the path that Vindicia will use to validate the token. The token can make requests to the resource. By posting a request to the /token endpoint, the user gets the access token. | Example value: [https://login.microsoftonline.com/c8eca3ca-1246-46d5-4d2d-a0f2a028920f/oauth2/v2.0/token](https://login.microsoftonline.com/c8eca3ca-1246-46d5-4d2d-a0f2a028920f/oauth2/v2.0/token) | |
| - **Client ID**: Client (merchant) identifier that must exactly match with the one generated by the merchant in the Azure. **Note:** Different Client ID may be provided for the Merchant's Staging and Production environments in MS Azure | Example Value: e0c2290484ae45b399dc7525be9327be | |
| - **Password Reset Link**: Merchant's IDP User Management Portal URL in which the user can update login details. | leave blank if not available | |
| - **Client Secret**: IDP configuration Secret (password) generated by merchant in the Azure. Once entered, it is masked for security purposes. | | |
| **Parent topic:**[Configuring Merchant Authentication with Vindicia IDP 1.0 and User Definition](../topics/subscribeUserAuthentication_r#) | | |
## Configure Users for Vindicia IDP 1.0
Users are added per merchant in the User Management screen for Vindicia IDP 1.0. For merchant users, it is best to add their work emails as the username.
**Note:** For Vindicia IDP 2.0 or basically merchants that are configured as ulm\_proxy, ULM is the source of truth for the users and their roles. Users will not be added in the Portal 1.0 screen as described here rather in Vindicia IDP 2.0 console.
If using Vindicia IDP as the main Sign in method, ULM's backend API automatically clones the user into the Vindicia IDP. This is achieved by configuring the ulm IDP screen and M2M API details.
To add merchant users:
1. Using an Admin user, access Subscribe Portal 1.0 [https://secure.staging.us-west.vindicia.com/login/secure/](https://secure.staging.us-west.vindicia.com/login/secure/)
2. Select **Admin** > **User Management**
A blank User Management screen appears.
3. From the dropdown list, select the relevant merchant.
The User Management screen appears.
4. Choose from the following:
* To add a new user, click **Add**.
* To edit an existing user, select the user and click **Edit**.
**Note:** Editing existing users will require a manual change in the Vindicia IDP Care console as well.
* To remove an existing user, select the user and click **Delete**.
5. Enter a **Username** (work email), **User Type** and select a **User Role** from the list.
**Note:** The user roles appear based on the merchant configuration. If the merchant was defined as a Retain merchant (select only) , Retain user roles appear.
6. Click **Submit**.
The new/existing user is created/updated in the Portal. If Vindicia IDP was configured, the user is also created in Vindicia IDP and an email with the access details will be sent to the user. If Vindicia IDP was configured and the user was removed, the user is also deleted in Vindicia IDP.
**Parent topic:**[Configuring Merchant Authentication with Vindicia IDP 1.0 and User Definition](../topics/subscribeUserAuthentication_r#)
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.