...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
| Note |
|---|
Unlike other authentication methods, it's not possible to configure OpenID Connect authentication method completely with SSO Management UI, but SSO Management API is required. All the steps here are done using SSO Management API. |
Reference of OAuth 2.0 and OpenID Connect 1.0 client implementation in SSO Server authentication method OpenIDConnectMethod.
Table of Contents maxLevel 1
Registration
Process
- Create OpenIDConnectMethod authentication method in SSO Server
- PUT /sso-api/method/oidc.method.1
- Get provider metadata from your OpenID Connect provider
- GET issuer/.well-known/opened-configuration
- If provider metadata is not available then need to manually construct provider metadata with required parameters
- Register provider metadata with SSO Server
- PUT /sso-api/method/oidc.method.1/$attribute/metadata
- Read jwks_uri parameter from provider metadata, and get provider JSON Web Keys
- GET jwks_uri
- Register provider keys with SSO Server
- PUT /sso-api/method/oidc.method.1/$attribute/jwks
- Get registration request from SSO Server
- GET /sso-api/method/oidc.method.1/$attribute/registration
- If provider does not support registration protocol then this step is optional
- Send registration request to OpenID Connect provider, and receive registration response
- If provider does not support registration protocol then need other method to register SSO Server as client, and receive client_id and client_secret
- Register registration response with SSO Server
- PUT /sso-api/method/oidc.method.1/$attribute/registration
- If provider does not support registration protocol then need to manually construct registration response with required parameters
...
| Name | Description |
|---|---|
OAuth 2.0 parameters | |
| response_type | "code" |
| redirect_uri | "https://sso.example.com/uas/return/oidc.method.1/redirect" This value must be registered with OpenID Provider |
| scope | Value of registration parameter "scope" "openid" if registration parameter is not defined |
| state | Random value |
| client_id | Value of registration parameter "client_id" |
OpenID Connect parameters | |
| nonce | Random value |
| prompt | "login" if force-authn request is enabled "none" if is-passive request is enabled |
| max_age | "0" if force-authn request is enabled |
| ui_locales | SSO Server user interface locale Value of registration parameter "default_ui_locales" |
| login_hint | Pass-thru value from authorization request |
| acr_values | Value of method configuration parameter "oidc.acr" Value of registration parameter "default_acr_values" |
...
Enabled if "id_token" is present in Token Response, and if "id_token_signed_response_alg" Client Configuration value is not "none"
UserInfo
Enabled if "userinfo_endpoint" is defined in Provider Metadata..
...
| Parameter | Description | ||
|---|---|---|---|
| oidc.acr | Specifies the method filtering. This can be used for filtering method visibility within application based on the received acr_values. One of the received acr_values must values defined by this parameter. | oidc.acr_values | Specifies which acr_values will be added to authentication request. All the received acr_values are removed and replaced by the values defined by this configuration key. |