Configure Opti ID for CMS 12

  • Updated

Opti ID provides multiple options for managing user identity and permissions so that you can choose the best fit for your organization.

  1. Local login – Invited users set up Opti ID-specific accounts. You manage user identity and permissions within Opti ID.
  2. SSO without SCIM – Invited users log in to Opti ID through an Opti ID single sign-on (SSO) app that you add to your identity provider's (IdP's) app portal. See Overview of configuring your own SSO for Opti ID. You manage user permissions within Opti ID.
  3. SSO with SCIM – Manage user identity and permissions within your IdP and automate the information between your IdP and Opti ID. See Overview of SCIM provisioning for Opti ID.
Opti ID lets you configure up to five SSO connections for your organization.

Skip to the corresponding section for the configuration you want to implement.

Prerequisite

Provision your Optimizely Content Management System (CMS) 12 instances.

Configuration options

Option 1: Configure local login

Local login sets up Opti ID-specific accounts for invited users. You manage user identity and permissions within Opti ID.

  1. Complete the initial technical contact login. This is the person who logs into Opti ID first and configures it for the rest of your organization. Contact your Customer Success Manager (CSM) if you do not know who the technical contact is. You can change the technical contact later.
  2. (Optional) Brand your login page.
  3. Review the local user password policy and how to reset your password.
  4. (Optional) Configure multi-factor authentication (MFA).
  5. Install, enable, test, and run Opti ID for CMS 12.
    1. Install Opti ID for CMS 12.
    2. Enable Opti ID for CMS 12.
    3. Test Opti ID for CMS 12.
    4. Run Opti ID for CMS 12.
  6. Review the system roles for your Optimizely products. If you want to personalize permission levels, create custom roles.
  7. Create groups to simplify the process of giving multiple users the same level of access.
  8. Invite users, assigning them to roles or groups so that they have the appropriate access to your CMS instance.

Option 2: Configure SSO without SCIM

SSO without SCIM lets invited users log in to Opti ID through an Opti ID SSO app that you add to your IdP's app portal. You manage user permissions within Opti ID.

  1. Complete the initial technical contact login. This is the person who logs into Opti ID first and configures it for the rest of your organization. Contact your CSM if you do not know who the technical contact is. You can change the technical contact later.
  2. (Optional) Brand your login page.
  3. Configure SSO. You can configure up to five SSO connections if needed. Opti ID supports Entra ID, Okta, and PingOne.
    1. Configure the SAML or OIDC SSO connection in your IdP.
    2. (Optional) Sync groups from your IdP to Opti ID.
    3. (Optional) Configure organizational domains to automatically provision users who log in with a specific domain.
    4. (Optional) Enable IdP-initiated login for a more seamless login experience.
  4. Install, enable, test, and run Opti ID for CMS 12.
      1. Install Opti ID for CMS 12.
      2. Enable Opti ID for CMS 12.
      3. Test Opti ID for CMS 12.
      4. Run Opti ID for CMS 12.
  5. Review the system roles for your Optimizely products. If you want to personalize permission levels, create custom roles.
  6. Create groups to simplify the process of giving multiple users the same level of access.
  7. Invite users, assigning them to roles or groups so that they have the necessary access to your CMS instance.

Option 3: Configure SSO with SCIM

SSO with SCIM lets you manage user identity and permissions within your IdP and automate the information between your IdP and Opti ID.

  1. Complete the initial technical contact login. This is the person who logs into Opti ID first and configures it for the rest of your organization. Contact your CSM if you do not know who the technical contact is. You can change the technical contact later.
  2. (Optional) Brand your login page.
  3. Configure SSO. You can configure up to five SSO connections if needed. Opti ID supports Entra ID, Okta, and PingOne.
    1. Configure the SAML or OIDC SSO connection in your IdP.
    2. (Optional) Enable IdP-initiated login for a more seamless login experience.
  4. Configure SCIM in your IdP.
  5. Install, enable, test, and run Opti ID for CMS 12.
    1. Install Opti ID for CMS 12.
    2. Enable Opti ID for CMS 12.
    3. Test Opti ID for CMS 12.
    4. Run Opti ID for CMS 12.
  6. Review the system roles for your Optimizely products. If you want to personalize permission levels, create custom roles.
  7. Create groups in your SCIM app to simplify the process of giving multiple users the same level of access.
  8. Add users to your SCIM app, assigning them to roles or groups so that they have the necessary access to your CMS instance.

Install, enable, test, and run Opti ID for CMS 12

Complete this section at the designated step in your chosen Opti ID configuration (for example, step 4 of option 2).

1. Install Opti ID for CMS 12

Install the following NuGet package in your solution using the NuGet Package Manager in Visual Studio or the command line:

dotnet add package EPiServer.OptimizelyIdentity

In startup.cs in the ConfigureServices method, enable Opti ID with the following:

services.AddOptimizelyIdentity(useAsDefault: true);

Opti ID is only enabled in shell modules, preview, and edit mode by default. UseAsDefault enables Opti ID globally throughout the application. You can configure AuthenticationOptions when more control is needed over which authentication scheme is active. The namespace EPiServer.OptimizelyIdentity.OptimizelyIdentityDefaults contains constants if you must reference the scheme name while configuring.

Remove any calls to services.AddCmsAspNetIdentity<TUser>() if you are not using ASP.NET Identity.

Opti ID automatically maps the virtual roles CmsEditors and CmsAdmins. You must remove the mapping of these if you already have any.

2. Enable Opti ID for CMS 12

  1. Log into the Opti ID Admin Center.
  2. Go to Product Access > Products > Optimizely Content Management System.
  3. Select the CMS instance for which you want to enable Opti ID.
  4. Go to the Details tab and click Edit.
  5. Select Opti ID Enabled and click Save.
Checking Opti ID Enabled prepares your DXP environment but does not impact existing authentication on the site. You cannot undo this, so ensure you are ready to move forward. It can take up to an hour before Opti ID is fully provisioned.

3. Test Opti ID for CMS 12

Before testing, ensure you have assigned your user to at least one of the built-in system roles for CMS. Deploy the code changes to DXP to start testing or run the application by setting up Opti ID locally.

Edit and admin user interface (UI) are accessible on /ui/cms/ after you have installed Opti ID.

4. Run Opti ID locally

You can use Opti ID locally on any of the following URLs:

  • https://localhost:5000
  • https://localhost:5096
  • https://localhost:6921
  • https://localhost:7595

For this to work, you also need the settings below, which you can find in DXP Management Portal (PaaS Portal) > API > Opti ID dev key. You can only use keys from the integration environment locally. These settings are provided automatically when the application is deployed to Optimizely Digital Experience Platform (DXP).

In appsettings.json, add the following to run Opti ID locally:

{
  "EPiServer": {
    "Cms": {
      "OptimizelyIdentity": {
        "InstanceId": "xxx",
        "ClientId": "xxx",
        "ClientSecret": "xxx"
      }
    }
  }
}

When you confirm Opti ID works locally, deploy the code changes to DXP, then continue to the next step for your chosen configuration option.

FAQs

Can my site visitors use ASP.NET Identity or any other authentication scheme?

Yes. The Opti ID authentication scheme is enforced in protected modules, such as the edit and admin UI and add-ons. Enable any other authentication scheme and ensure Opti ID is not set as the default authentication scheme:

services.AddOptimizelyIdentity(useAsDefault: false);

Why do I get an error in Okta when testing locally?

Ensure you are using one of the allowed URLs and running your application with HTTPS enabled.

Why is the edit UI not loading and giving a 404 error?

Ensure you are accessing the CMS on the/ui/cms path.