Creating an OIDC application in Yandex Identity Hub for integration with 1C:Enterprise

Written by

Updated at January 20, 2026

Getting started
Create an app
Set up the integration
- Configure your OIDC application in Yandex Identity Hub
- Configure your OIDC application in 1C:Enterprise
Make sure your application works correctly

Note

This feature is at the Preview stage.

1C:Enterprise is a development platform for 1C accounting and business automation applications. It supports OpenID Connect (OIDC) authentication to provide secure SSO for your organization's users.

To authenticate your organization's users to 1C:Enterprise with OpenID Connect SSO, create an OIDC app in Yandex Identity Hub and configure it appropriately both in Identity Hub and 1C:Enterprise.

OIDC apps can be managed by users with the organization-manager.oauthApplications.admin role or higher.

For the users of your organization to be able to access 1C:Enterprise:

Getting started

To complete this tutorial, you may need a valid 1C:ITS agreement to access the extended documentation.

Create an app

Cloud Center UI

CLI

Log in to Yandex Identity Hub.
In the left-hand panel, select Apps.
In the top-right corner, click Create application and in the window that opens:
1. Select the OIDC (OpenID Connect) single sign-on method.
2. In the Name field, specify enterprise-1c-oidc-app.
3. In the Folder field, select the folder where you want to create an OAuth client for your app.
4. Click Create application.

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

See the description of the CLI command for creating an OIDC app:

yc organization-manager idp application oauth application create --help

Create an OAuth client:
```
yc iam oauth-client create \
  --name enterprise-1c-oauth-client \
  --scopes openid,email,profile
```
Where:
- --name: OAuth client name.
- --scopes: User attributes available to 1C:Enterprise. The specified attributes are:
  - openid: User ID. Required attribute.
  - email: User email address.
  - profile: Additional user details, such as first name, last name, and avatar.
Result:
```
id: ajeqqip130i1********
name: enterprise-1c-oauth-client
folder_id: b1g500m2195v********
status: ACTIVE
```
Save the id field value: you will need it to create and configure your app.

Create a secret for your OAuth client:

yc iam oauth-client-secret create \
  --oauth-client-id <OAuth_client_ID>

Result:

oauth_client_secret:
  id: ajeq9jfrmc5t********
  oauth_client_id: ajeqqip130i1********
  masked_secret: yccs__939233b8ac****
  created_at: "2025-10-21T10:14:17.861652377Z"
secret_value: yccs__939233b8ac********

Save the secret_value field value: you will need it to configure your 1C:Enterprise.

Create an OIDC app:

yc organization-manager idp application oauth application create \
  --organization-id <organization_ID> \
  --name enterprise-1c-oidc-app \
  --description "OIDC application for integration with 1C:Enterprise" \
  --client-id <OAuth_client_ID> \
  --authorized-scopes openid,email,profile \
  --group-distribution-type none

Where:

--organization-id: ID of the organization you want to create your OIDC app in. This is a required setting.
--name: OIDC app name. This is a required setting.
--description: OIDC app description. This is an optional setting.
--client-id: OAuth client ID you got in Step 2. This is a required setting.
--authorized-scopes: Specify the same attributes as when creating the OAuth client.
--group-distribution-type: Set to none as user groups are not provided to 1C:Enterprise.

Result:

id: ek0o663g4rs2********
name: enterprise-1c-oidc-app
organization_id: bpf2c65rqcl8********
group_claims_settings:
  group_distribution_type: NONE
client_grant:
  client_id: ajeqqip130i1********
  authorized_scopes:
    - openid
    - email
    - profile
status: ACTIVE
created_at: "2025-10-21T10:51:28.790866Z"
updated_at: "2025-10-21T12:37:19.274522Z"

Set up the integration

Set up the 1C:Enterprise integration with the OIDC app you created in Identity Hub.

Configure your OIDC application in Yandex Identity Hub

Get the application’s credentials

Cloud Center UI

CLI

Log in to Yandex Identity Hub.
In the left-hand panel, select Apps and then, the OIDC app.
On the Overview tab, under Identity provider (IdP) configuration, expand the Additional attributes section and copy the parameter values you need to specify in 1C:Enterprise:
- ClientID: Unique application ID.
- OpenID Configuration: URL with the configuration of all parameters required to set up the integration.
Under App secrets, click Add secret, and in the window that opens:
1. Optionally, add a description for the new secret.
2. Click Create.
The window will display the generated application secret. Save this value.

Warning

If you refresh or close the application information page, you will not be able to view the secret again.

If you closed or refreshed the page before saving the secret, click Add secret to create a new one.

To delete a secret, in the list of secrets on the OIDC app page, click in the secret row and select Delete.

Get information about your new OIDC application:
```
yc organization-manager idp application oauth application get <app_ID>
```
Where <app_ID> is your OIDC app ID you got when creating the app.

This will return the application information, including the following:
```
id: ek0o663g4rs2********
name: enterprise-1c-oidc-app
organization_id: bpf2c65rqcl8********
client_grant:
  client_id: ajeqqip130i1********
  authorized_scopes:
    - openid
    - email
    - profile
```
Save the client_id value: this is the OIDC app ID you will need to configure your 1C:Enterprise.
Get the OpenID Connect Discovery configuration URL:
```
yc organization-manager idp application oauth application get <app_ID> \
  --format json | jq -r '.client_grant.issuer_uri'
```
The result will look as follows:
```
https://auth.yandex.cloud/oauth/<OAuth_client_ID>
```
Save this URL: this is the OpenID Connect Discovery URL you will need to configure your 1C:Enterprise.
Use the OAuth client secret that you saved when creating the app in the previous step. If you have not saved the secret, create a new one:
```
yc iam oauth-client-secret create \
  --oauth-client-id <OAuth_client_ID>
```
Save the secret_value from the command output: this is the app secret you will need to configure your 1C:Enterprise.

Configure the redirect URI

Cloud Center UI

CLI

Log in to Yandex Identity Hub.
In the left-hand panel, select Apps and then, the OIDC app.
At the top right, click Edit and in the window that opens:
1. In the Redirect URI field, specify the 1C infobase URL for OIDC app response processing, formatted as follows:
```
<1C_infobase_publication_domain>/<application_name>/authform.html
```
For example, https://your.company.ru/your-app/authform.html.
1. Click Save.

Update your OIDC app by providing the redirect URI:

yc organization-manager idp application oauth application update <app_ID> \
  --redirect-uris "<1C_infobase_publication_domain>/<application_name>/authform.html"

Where:

<app_ID>: OIDC app ID you got when creating the app.
--redirect-uris: 1C infobase URL for OIDC app response processing. For example, https://your.company.ru/your-app/authform.html.

Result:

id: ek0o663g4rs2********
name: grafana-cloud-oidc-app
organization_id: bpf2c65rqcl8********
redirect_uris:
  - https://your.company.ru/your-app/authform.html

Configure your OIDC application in 1C:Enterprise

To configure OpenID Connect authentication in 1C:Enterprise, set up the infobase publication configuration, restart Apache HTTP Server, and enable OIDC authentication.

The location of the configuration file depends on your specific 1C:Enterprise setup. For example, it may be located at this path: /var/www/<app_name>/default.vrd.

Open the configuration file and add the openidconnect section within point:

<?xml version="1.0" encoding="UTF-8"?>
<point xmlns="http://v8.1c.ru/8.2/virtual-resource-system"
...
        <openidconnect>
                <providers>
              <![CDATA[[
                {
                "name": "identity-hub",
                "title": "Identity Hub",
                "discovery": "https://auth.yandex.cloud/.well-known/openid-configuration",
                "authenticationClaimName": "preferred_username",
                "authenticationUserPropertyName": "email",
                "clientconfig": {
                      "authority": "https://auth.yandex.cloud",
                      "client_id": "<app_ID>",
                      "client_secret" : "<app_secret>",
                      "redirect_uri": "https://<1C_infobase_publication_domain>/<application_name>/authform.html",
                      "response_type": "code",
                      "scope": "openid email profile",
                      "filterProtocolClaims": true,
                      "loadUserInfo": false
                      }
                }
                ]]]>
                </providers>
                <allowStandardAuthentication>true</allowStandardAuthentication>
        </openidconnect>
...
</point>

Where:

authenticationUserPropertyName: User attribute for authentication. In this example, it is email, the email address.
client_id: Unique OIDC app ID you got earlier.
client_secret: Generated OIDC app secret you got earlier.
redirect_uri: 1C infobase URL for OIDC app response processing.

Restart the Apache HTTP Server:
```
systemctl restart apache2
```
Go to 1C Configurator and enable OpenID Connect authentication for each user you need. Make sure the user's profile indicates the attribute mapped to the authenticationUserPropertyName configuration parameter.

Make sure your application works correctly

To make sure both your OIDC app and 1C:Enterprise integration work correctly, authenticate to 1C:Enterprise as one of the users for whom you have enabled the OIDC authentication.

To do this:

In your browser, navigate to the address of your 1C:Enterprise instance, e.g., https://your.company.ru.
If you were logged in to 1C:Enterprise, log out.
On the 1C:Enterprise authentication page, click Log in.
On the Yandex Cloud authentication page, enter the email address and user password.
Make sure you are logged in to 1C:Enterprise.

Creating an OIDC application in Yandex Identity Hub for integration with 1C:Enterprise

Getting startedGetting started

Create an appCreate an app

Set up the integrationSet up the integration

Configure your OIDC application in Yandex Identity HubConfigure your OIDC application in Yandex Identity Hub

Get the application’s credentialsGet the application’s credentials

Configure the redirect URIConfigure the redirect URI

Configure your OIDC application in 1C:EnterpriseConfigure your OIDC application in 1C:Enterprise

Make sure your application works correctlyMake sure your application works correctly

Was the article helpful?

Getting started

Create an app

Set up the integration

Configure your OIDC application in Yandex Identity Hub

Get the application’s credentials

Configure the redirect URI

Configure your OIDC application in 1C:Enterprise

Make sure your application works correctly