Oidc (Section)#
Path: /profiles/profile/settings/authentication-service/authenticators/authenticator/oidc
OpenID Connect methods
Parameters#
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| configuration-url | string | required | - | The url to the openid-configuration document at the OpenID Provider (must end in ‘/.well-known/openid-configuration’) |
| client-id | string | required | - | The client-id, registered at the OpenID Provider |
| use-http-basic-authentication | boolean | optional | false | Send the client credentials using HTTP Basic authentication. When false, the credentials are sent in the request-body |
| scope | string | optional | openid | Scope to ask the OpenID Provider for, space separated |
| clock-skew | uint32 | optional | 60 | The allowed clock-skew in seconds when validating the JWT from the OpenID Provider |
| authentication-context-class-reference | string (length: 1..9223372036854775807) | optional | - | The Authentication Context Class Reference (ACR) or authentication method that should be sent in the request to the OpenID Provider |
| http-client | leafref → /base:facilities/base:http/base:client/base:id | optional | - | A reference to the Http Client to use. If not defined, the default HTTP client is used |
| use-subject-for-login-hint | boolean | optional | false | If there is a previously authenticated subject, pass the subject as login_hint to the OpenID Provider. |
| prompt-login | enumeration (always, if-requested-by-client) | optional | - | Setting controlling sending of prompt=login parameter. By default, it is not sent. |
| response-mode | enumeration (query, form-post) | optional | query | The response_mode to use in the authorization request. By default, ‘query’ is used. |
| redirect-uri-override | string | optional | - | An optional override of the redirect URI that will be used in the authorization requests. The OpenID Provider will redirect to this URI, however the actual redirect URI of this authenticator will remain unchanged. This means that the authorization response has to be relayed to the actual redirect URI of this authenticator. |
Subsections#
| Name | Type | Description |
|---|---|---|
| client-authentication-method | OneOf | |
| encrypted-id-token | Section | ID Token is expected to be encrypted |
| request-object | Section | Use a Request Object when sending the authorization request to the OpenID Provider. |
| fetch-userinfo | Section | Fetch claims from the userinfo endpoint |
| parameter-mappings | Section |