Application

Available in Classic and VPC

You can register and manage applications to log in with your NAVER Cloud Platform account after creating a tenant.

Application interface

The following is a basic description of how to use applications:

View application list

You can view the information for each registered application you are managing from the list. To view the information:

1. In the NAVER Cloud Platform console, navigate to Menu > All Services > Management & Governance > Ncloud Single Sign-On.
2. Click the Application menu.
3. When the application list appears, view the summary or click any application to see more details.
   • Summary: Summary of the applications displayed in the list.
     • Application name: Name of the application.
     • Authentication: Information on the application's authentication protocol. Only the currently supported OAuth 2.0 / Open ID Connect is displayed.
     • Creation date and time (UTC+09:00): Date and time when the application was registered.
     • [Shortcut]: The URL of the application that was entered during application registration. You can go to the corresponding page by clicking the enabled button. If no URL was entered, the button is disabled.
   • Application information: Information that was entered during application registration.
     • Application description: Description of the application.
     • Application URL: The URL of the application that was entered during application registration. If entered, the [Shortcut] button is enabled in the list.
     • Scope: The scope of information that can be accessed by the application.
     • Application Type: The type of the application.
     • Application Grant Type: The method of granting permissions.
     • Redirect URIs: Redirect URI that was entered during application registration.
     • Post Logout Redirect URIs: Enter the URI to redirect users to after the SLO request is completed.
     • Access Type: The access type of the application.
       • After clicking [Reissue client secret] to issue a new client secret, you can click [Copy] in the View client secret popup that appears to copy the new client secret.
       • If the Access Type is set to Public, the [Reissue client secret] button is not displayed.
       Note

       • Note that reissuing the client secret makes the existing client secret no longer valid.
       • When the View client secret popup disappears after reissuing the client secret, you cannot view the new client secret again, so use [Copy].
     • Client Auth Method: How to authenticate the application.
     • Access Token Validity: Access token's validity period.
     • Refresh Token Validity: Refresh token's validity period.
     • Log in with the main account: Whether the application supports logging in with the main account.
     • Tag: Assign tag keys/values to easily classify SSO users.
       • View, create, edit, and delete all tags through [Tag management].
       • Only 1 tag value can be assigned to 1 tag key.
   • Client Information: URL information required for Ncloud Single Sign-On integrations.
     • [Create Authentication URL]: Click to create an authentication URL based on the URL set when creating the tenant (see Create authentication URL).
     • Client ID: The client ID for the application. Click [Copy] to copy the ID.
     • Authorize URL: The authorization URL for the application. Click [Copy] to copy the URL.
     • Token URL: The token issuance URL for the application. Click [Copy] to copy the URL.
     • Revoke URL: The token cancellation URL for the application. Click [Copy] to copy the URL.
     • Userinfo URL: The user claim request URL for the application. Click [Copy] to copy the URL.
     • End Session Endpoint URL: The URL called to sign out of all connected services at once. Click [Copy] to copy the URL.
     • OIDC configuration URL: The OpenID Connect configuration URL for the application, which is displayed if Scope is set to Open ID. Click [Copy] to copy the URL.
   • Consent page settings: The content of the consent page for providing privacy information that was set during application registration.
     • Supported language settings: The default language and displayed language selected when configuring the consent page.
     • Overseas transfer: Whether privacy information is transferred overseas.
     • Preview consent page: Click [Preview] to preview the actual page that is displayed to the user.

Register application

To register an application to be integrated with Ncloud Single Sign-On:

1. In the NAVER Cloud Platform console, navigate to Menu > All Services > Management & Governance > Ncloud Single Sign-On.
2. Click the Application menu.
3. Click [Register application].
4. When the Register application interface appears, follow the steps in order:
   • 1. Enter application information
   • 2. Configure consent page
   • 3. View client information

1. Enter application information

Select the authentication protocol for the application and enter the required information for the authentication flow. Enter all information and click [Next].

• Authentication Protocol

  Item	Required	Description
  Authentication	Required	Select the authentication protocol for Ncloud Single Sign-On integrations. Only OAuth 2.0 / Open ID Connect can be selected.

• Register application information

  Item	Required	Description
  Application name	Required	Enter the application name.
  Application description	Optional	Enter a description for the application.
  Application URL	Optional	Enter a URL that connects directly to the application. The application list provides [Shortcut] for direct access to the entered URL.
  Application Type	Required	Select either Web or App for the type of the application to be registered.
  Access Type	Required	Select 1 of the following access types for the application: Confidential: Access after authentication with Client ID and Client Secret. Public: Access after authentication with the client ID.
  Client Auth Method	Required	Select 1 of the following client authentication methods for the application: Depending on the selected Access type, there are limitations to the values that can be selected. If it is Confidential, Client secret base is automatically selected. If it is Public, None is automatically selected.
  Application Grant Type	Required	To issue an access token, which is the credential for accessing protected resources, you must select either Authorization Code or Implicit (Hybrid). Authorization Code: This is the most common flow to issue an access token using your own authorization code for authorization. Refresh Token: This is an optional selection and can be selected together with either Authorization Code or Implicit (Hybrid). Implicit (Hybrid): This is a flow that issues an access token directly without an authorization code and is optimized for client environments where it is difficult to securely store credentials.
  Scope	Required	You must select either Profile or Open ID as the scope of NAVER Cloud Platform account information that the application can access. Groups and Email are optional. The information of NAVER Cloud Platform accessible from each application after integration is completed. Login ID. Unique member identifier (user's member number and sub account number). Account type (main or sub account). User name. Group. Email.
  Redirect URIs	Required	Enter the URI to receive an authorization code or token after requesting authorization. Up to 50 URIs can be entered.
  Post Logout Redirect URIs	Required	Enter the URI to redirect users to after the SLO request is completed. Up to 50 URIs can be entered.
  Log in with the main account	Required	Select whether to allow login to the application with the main account of NAVER Cloud Platform. The value set in the Tenant menu is applied with priority, and if the setting value is Allow or Deny, it cannot be changed by each application. If the value set in the Tenant menu is Follow the settings for each application, it can be changed in each application.

• Tag management

2. Configure consent page

When logging in to the registered application, the information of the main or sub account of NAVER Cloud Platform is forwarded. At this point, configure a consent page to receive confirmation and consent from each attempted user login for the information being passed on to the application from each user. After configuring, click [Next].

• Before proceeding to the next steps, you can click [Preview] at the bottom to preview the consent page that will actually be provided to users.

• Set consent page

  Item	Required	Description
  Set the supported language	Required	Select the language to display on the privacy information consent page and the language to set as the default language by clicking the checkbox. You can select from Korean, English, and Japanese, and the page is configured according to the selected language. Only 1 language can be selected as the default language, which is the default value displayed when it cannot be displayed in the selected supported language.
  Overseas transfer	Required	If the registered application is served through an overseas IDC/CSP, you must check the checkbox to select it.

• Configure consent page

  Item	Required	Description
  Consent to providing personal information	Required	In Consent page settings, click the tab menu for the selected language and enter the following information: Recipient (input required). Purpose of use (input required). Retention and use period (input required). Required item (automatic input). Login ID. Unique member identifier. User name. Account type. Selected item (automatic input). Group. Email.
  Overseas transfer	Required	If you have selected Overseas transfer in the Consent page settings, enter the following additional information to obtain consent for overseas transfer: Country of transfer (input required). Recipient of transfer (input required). Contact information (input required). Privacy information item to be transferred (automatic input). Transfer method (automatic input). Purpose of use (automatic input). Retention period (automatic input).

3. View client information

Once all the necessary information for the application registration is entered, the client ID and client secret are issued. After viewing the ID and secret, click [Complete].

• You can copy the client ID and client secret by clicking [Copy].

Create authentication URL

You can create the authentication URL required for Ncloud Single Sign-On integrations by entering the information of the registered application. To create an authentication URL:

1. In the NAVER Cloud Platform console, navigate to Menu > All Services > Management & Governance > Ncloud Single Sign-On.
2. Click the Application menu.
3. Click [Create Authentication URL] in the Client information section after selecting the application for which you want to create the authentication URL in the application list.
4. After the Authentication URL popup appears, enter the following information and click [OK]:
   • Response Type: Depending on the Scope or Application Grant Type selected during application registration, you can select the following:
     • Code: If the Application Grant Type is Authorization Code.
     • Token: If the Application Grant Type is Implicit (Hybrid).
     • ID_Token: Selectable if the Scope is Open ID and the Application Grant Type is Implicit (Hybrid).
   • Scope: The range value of accessible information selected during application registration.
   • Redirect URI: The Redirect URI entered during application registration. It can be selected from a drop-down list if multiple URIs were entered.
   • State: A string used to prevent CSRF attacks. You can either enter a desired value or click [Generate] to create one.
   • Nonce: A string used to prevent replay attacks on access tokens. It can be entered manually or created by clicking [Generate].
     • The input field is displayed only when Open ID is selected for the Scope.
   • Code Challenge: The code_challenge value used for PKCE.
   • Code Challenge Method: The code_challenge_method value used for applying PKCE. You can select between Plain and S256.
   • Authentication URL: The authentication URL that reflects all the input values entered.
5. Click [OK] after checking the authentication URL with the entered values.
   • You can perform an authentication test by entering the created authentication URL into your browser.

Edit application

To edit the information and settings of a registered application:

1. In the NAVER Cloud Platform console, navigate to Menu > All Services > Management & Governance > Ncloud Single Sign-On.
2. Click the Application menu.
3. To edit an application from the application list, click [Edit] after selecting the application you want to edit.
4. After editing the desired items for each step, click [Save].
   • For more information about items for each step, see 1. Enter application information and 2. Configure consent page.

Delete application

To delete a registered application:

1. In the NAVER Cloud Platform console, navigate to Menu > All Services > Management & Governance > Ncloud Single Sign-On.
2. Click the Application menu.
3. To delete an application from the application list, click [Delete] after selecting the application you want to delete.
4. When the Confirm application deletion popup appears, click [Delete] and [OK].
   • Then, the application is deleted from the application list.