If you wish, you can set up the same translate5 instance on different domains and configure for different clients different domains and different OpenID servers.

Examples how to use translate5 as OpenID client with different OpenID servers for Single-Sign-On (SSO) usage

• Google as OpenID server for translate5
• MS Azure ActiveDirectory as OpenID server for translate5
• MS ActiveDirectory Federation Services

Configuration within translate5

OpenID Connect is a simple identity layer on top of the OAuth 2.0 protocol, which allows computing clients to verify the identity of an end-user based on the authentication performed by an authorization server, as well as to obtain basic profile information about the end-user in an interoperable and REST-like manner. In technical terms, OpenID Connect specifies a RESTful HTTP API, using JSON as a data format.

OpenID Connect allows a range of clients, including Web-based, mobile, and JavaScript clients, to request and receive information about authenticated sessions and end-users. The specification suite is extensible, supporting optional features such as encryption of identity data, discovery of OpenID Providers, and session management.

...

To configure translate5 to work with OpenId connect is very simple. Navigate to the clients tab in your translate5 instance, and under the OpenId connect fieldsub-set tab there are OpenId configuration fields that need to be set.

...

OpenId server: OpenId authentication server url. This is the URL translate5 redirects users for authentication at the OpenId connect server (Google configuration example: https://accounts.google.com)

OpenId issuer: OpenId issuer url. In many cases this url is identical with the OPenId server url.

OpenId user name: OpenId authentication server username (Google configuration example: "Client ID" see image3)
(the user name that allows the openId client application to connect to the API of the openId server; do NOT mix this up with the username of the user, that wants to authenticate!)

...

System Roles: translate5 internal user system roles, which will be assigned to the user logged in via openid connect. If the openid server is configured to do role-based authentication/authorization, the roles coming from the response will be validated by translate5 and applied to the user..

• If the OpenID connect server is configured and able to pass roles along with the authentication, the translate5 system roles passed by the OpenID server will be set for this user in translate5.
• If the roles in the OpenID server change, on the next login they will also change in translate5.
• The OpenID server will only be able to set roles, that are checked in the OpenID Connect configuration of the corresponding client in translate5. Other roles will be ignored by translate5, even if the OpenID server claims them.
• If the OpenID Connect server is not able to or configured to claim roles, the roles checked in the OpenID Connect configuration of the corresponding client in translate5 will always automatically be set for users of this client. 

Link text on login page:  Label text on the login page of translate5. A click on it redirects the user to the configured openid server for authentication, instead of using translate5 for authentication. If the checbox "Do not show login page" below the field "Link text on login page" is checked, the user will directly be redirected to the openid server for authentication/authorization and will never see the translate5 login page.

Setup the OpenId connect server - the Google example with Google's OAuth 2.0 API

Before your translate5 application can use Google's OAuth 2.0 authentication system for user login, you must set up a project in the Google API Console to obtain OAuth 2.0 credentials, set a redirect URI, and (optionally) customize the branding information that your users see on the user-consent screen.

Obtain OAuth 2.0 credentials

You need OAuth 2.0 credentials, including a client ID and client secret, to authenticate users and gain access to Google's APIs.

To find your project's client ID and client secret, do the following:

...

1. click on Create credentials dropdown and select OAuth client ID and fill in the requested data
2. on the next window
   
   1. select Web application in the radio button options
   2. give a name to your your OAuth client ID (this is not the display name of your app) and click create
3. now the new created client id should be listed in the credentials tab (see image2)

...

1. navigate to the OAuth consent screen
2. in the Authorized domains field add you current translate5 domain without protocol (see image4)
3. click on save in the page below

...

1. click on the credentials tab, and click on the openid client
2. in the field Authorized redirect URIs add your translate5 instacne domain folowed by /login (image3) and click on save

...

Checkbox "Do not show login page: Automatically redirect to OpenID Connect server": Redirect directly to the SSO authentication provider.