Configure OIDC SSO

When registering your memoQ TMS as the client of an IDP service, you need to set a callback URL. This is where the IDP can reach the OIDC backend.

• For running the OIDC backend as a Windows service, the callback URL looks like this:

  

  The OIDC backend needs a port (3) for communication with the IDPs. By default, this is port 5001. This port should be open for inbound and outbound communication. If needed, you can configure a different port in the application settings file.

• For running the OIDC backend as an IIS web application, the callback URL looks like this:

  

You can choose the callback URL’s last part (4) as needed, but:

• It must not be “login”, “logout”, or “auth”.

• If you register at more than one IDP, this part must be unique for each of them.

When you register the memoQ TMS as a client at the IDP, the memoQ TMS receives a Client ID and a Client Secret. You will need these to set up your IDP in the OIDC backend configuration.

Notes for registering the memoQ TMS in Azure AD:

• You don't need Implicit Grant options (access tokens or ID tokens)

• You need a User.Read type of delegated permission

• You should set /logout as the default logout URL.

Make sure your firewall is set up correctly: The IDP might require opening some ports on the company firewall. To learn more, search your IDP's documentation.

The OIDC backend needs to learn about the host name(s) it must answer.

Set these up in the file %PROGRAMDATA%\MemoQ Server\Oidc Backend\appsettings.User.json.

Logging details are stored in a separate file, %PROGRAMFILES%\Kilgray\MemoQ Server\Oidc\appsettings.json.

Hosts allowed to call the OIDC backend

In this example, “*” stands for any host name. If you want to limit access, edit the value of the AllowedHosts key: Enter one or more domains (for example, “*.mycompany.com”) or specific host names (for example, "machine1.mycompany.com"), separated by semicolons (;). Else, leave the AllowedHosts value unchanged.

If you changed the port number from the default, change the part after the colon (:) in the urls key:

Else, leave the urls value unchanged.

Logging

The %PROGRAMFILES%\Kilgray\MemoQ Server\Oidc\appsettings.json file defines the logging details.

Find the key "Name": "File" under Serilog.WriteTo. The keys under Args here define important parameters:

path: By default, the log is stored in the file %PROGRAMDATA%\MemoQ Server\Oidc Backend\LogFiles\log-.txt.

rollingInterval, rollOnFileSizeLimit, fileSizeLimitBytes: Logs are written to daily files (do not change this), but if the file size reaches the limit (100 MB by default), a second file will be created for that day.

retainedFileCountLimit: By default, the last 31 log files are kept on the server.

By default, logging level is Information. If you need more info, change the Serilog.MinimumLevel.Default key's value to Debug or Verbose.

Verbose lists everything, even names and secrets – use it only when it is really needed, and only if it complies to your organization's data protection policies.

These settings are not permanent: When you update memoQ TMS, its whole folder under %PROGRAMFILES% is overwritten. This means that all settings in appsettings.json will change back to their default values. We recommend not changing them - unless you really need to.

The MemoQ OIDC Backend Service is a separate Windows service next to the memoQ Server service. It is installed together with memoQ TMS, but to make it work, you need to configure it (after registering your memoQ TMS at an IDP).

1. Make sure Run as Windows service is selected at the top.

2. On the Basic settings tab, fill in these fields:

   • Backend base URL:

     

   • memoQweb URL: Use the same value as on the Address tab in the Configure server window.

   • TLS certificate thumbprint: Click Browse and select the certificate from the list.

3. At the bottom, click Apply.

4. On the Providers tab:

   1. Click Add provider.

   2. In the Add provider window, select a provider from the dropdown.

      As of version 12.5, memoQ TMS supports Azure AD (Microsoft Entra), Google, Microsoft, Okta (both standard and custom), and OneLogin instances. If your company uses another OIDC-based ID provider service, contact memoQ Business Services, who can provide the resources you need when you select Custom from this list.

   3. Some fields are populated. Fill in the empty ones.

      Generic settings

      Parameter	Description
      Name	The IDP’s name in the memoQ TMS database. Change as needed.
      DisplayName	The text on the IDP's button you’ll see on the login page. Change as needed.
      ClientId	The Client ID that the IDP generated for your memoQ TMS.
      ClientSecret	The client secret or secret key you received when registering your memoQ TMS at this IDP.
      CallbackPath	The last part of the callback URL that you registered at the IDP. You need to change the default value.

      IDP-specific settings

      Parameter	Description
      Tenant	Your Microsoft Azure tenant.
      TenantId	Your OneLogin tenant.
      OktaDomain	Your Okta domain.
      AuthServerId	Your Okta authorization server's ID.
      OktaOrg	Your Okta organization's base URL (without http://).

   4. At the bottom of the window, paste the client secret you received from the IDP.

   5. To use a custom icon for the IDP on the memoQweb login page, click Browse and navigate to the icon file. Accepted formats are PNG, SVG, JPG, and ICO.

   6. To add the provider, click Apply.

      The provider appears in the list.

   7. To add another provider, click Add provider again, and repeat the procedure.

      To change a provider's settings, select it and click Edit info.

      To remove a provider from the list, click Remove provider.

5. On the Backend service tab:

   1. Click Install.

   2. In the Install OIDC backend service window, choose an account type. Only change the default setting if it's necessary.

      Note: The account that you choose for running the service needs to have read and write access to the memoQ TMS database, and read access to the certificate. This is true for all account types (LocalSystem, NetworkService, VirtualService, or ServiceUser).

   3. After the service is installed. click Start.

   4. At the bottom, click Save.

6. At this point, you need to restart:

   • the memoQ TMS service

   • the IIS application pool that runs memoQweb.

OIDC backend is now configured on your memoQ TMS. The server accepts:

• SSO logins: Users choose an IDP service, and sign in with the usernames and passwords they have at that IDP.
• Legacy SSO logins: Users sign in with the usernames and passwords they have in the company's Windows Active Directory. From the OIDC point of view, these users behave like local logins, and they can be changed to OIDC-based SSO.
• Local logins: Users who have neither IDP credentials nor Windows AD accounts can still use their memoQ usernames and passwords.

You can now tell a memoQ admin user to start creating or updating users on the memoQ TMS (see Part 2 of this document).

1. Make sure Host in IIS is selected at the top.

2. On the Basic settings tab, fill in these fields:

   • Backend base URL:

     

   • memoQweb URL: Use the same value as on the Address tab in the Configure server window.

3. At the bottom, click Apply.

4. On the Providers tab:

   1. Click Add provider.

   2. In the Add provider window, select a provider from the dropdown.

      As of version 12.5, memoQ TMS supports Azure AD (Microsoft Entra), Google, Microsoft, Okta (both standard and custom), and OneLogin instances. If your company uses another OIDC-based ID provider service, contact memoQ Business Services, who can provide the resources you need when you select Custom from this list.

   3. Some fields are populated. Fill in the empty ones.

      Generic settings

      Parameter	Description
      Name	The IDP’s name in the memoQ TMS database. Change as needed.
      DisplayName	The text on the IDP's button you’ll see on the login page. Change as needed.
      ClientId	The Client ID that the IDP generated for your memoQ TMS.
      ClientSecret	The client secret or secret key you received when registering your memoQ TMS at this IDP.
      CallbackPath	The last part of the callback URL that you registered at the IDP. You need to change the default value.

      IDP-specific settings

      Parameter	Description
      Tenant	Your Microsoft Azure tenant.
      TenantId	Your OneLogin tenant.
      OktaDomain	Your Okta domain.
      AuthServerId	Your Okta authorization server's ID.
      OktaOrg	Your Okta organization's base URL (without http://).

   4. At the bottom of the window, paste the client secret you received from the IDP.

   5. To use a custom icon for the IDP on the memoQweb login page, click Browse and navigate to the icon file. Accepted formats are PNG, SVG, JPG, and ICO.

   6. To add the provider, click Apply.

      The provider appears in the list.

   7. To add another provider, click Add provider again, and repeat the procedure.

      To change a provider's settings, select it and click Edit info.

      To remove a provider from the list, click Remove provider.

5. On the Backend service tab:

   1. Fill in the Application name and Application pool fields. Choose a different website if needed.

   2. Click Install backend. The tool creates a web app and an application pool with the names you entered, and grants them the necessary permissions. It also starts the app pool.

6. At this point, you need to restart:

   • the memoQ TMS service

   • the IIS application pool that runs memoQweb.