| Note |
|---|
Unlike other authentication methods, it's not possible to configure OpenID Connect authentication method completely with SSO Management UI, but SSO Management API is required. All the steps here are done using Management API. |
OpenID Connect is a subset of OAuth 2.0. Read more on configuring OAuth 2.0 in SSO from OAuth2 - SSO
Reference of OAuth 2.0 and OpenID Connect 1.0 client implementation in SSO Server authentication method OpenIDConnectMethod.
Contents
Table of Contents maxLevel 1 exclude Contents
Registration
Sequence diagram
...
Only the requests to SSO have examples as IDP is considered as an external system in this example.
1. Create OpenIDConnectMethod authentication method in SSO Server
...
7. Send registration request to OpenID Connect provider, and receive registration response
If provider does not support registration protocol then you need another method to register SSO Server as client and receive client_id and possible client_secret. Then you need to add them to the payload for next step manually.
...
/sso-api/method/{id}/$attribute/jwks
| Method | Description | Payload example |
|---|---|---|
| PUT | Register provider JSON Web Keys with SSO Server Body is JWKS formatted public keys (Content-Type: application/jwk-set+json) | { "keys": [
{
"kty": "RSA",
"e": "AQAB",
"use": "sig",
"kid": "keyid9876",
"alg": "RS256",
"n": "05Csoq8qI...aYvRL1V_8"
}
]} |
| GET | Read previously registered JWKS | |
| DELETE | Remove registered JWKS |
/sso-api/method/{id}/$attribute/registration
| Method | Description | Payload example |
|---|---|---|
| GET | Generate client registration request Or read previously registered registration response Response is JSON formatted registration request | |
| PUT | Register registration response with SSO Server Body is JSON formatted registration response | {
"redirect_uris": [
"https://sso.example.com/uas/return/oidc.aktia.1/redirect"
],
"grant_types": [
"authorization_code"
],
"response_types": [
"code"
],
"jwks_uri": "https://sso.example.com/uas/oauth2/names/ac/oidc.method.1/metadata.jwks", "scope": "openid scope1",
"id_token_signed_response_alg": "RS256",
"id_token_encrypted_response_alg": "RSA-OAEP",
"id_token_encrypted_response_enc": "A128GCM",
"request_object_signing_alg": "RS256",
"token_endpoint_auth_method": "private_key_jwt",
"client_id": "test-client",
"ubisecure_request_object_query_parameters": [
"client_id",
"scope",
"response_type",
"acr_values"
],
"ubisecure_request_parameters": {
"acr_values": "acr1"
}
} |
| DELETE | Remove any registration Use DELETE before GET to make sure a new registration request is generated |
...
| Name | Description |
|---|---|
OAuth 2.0 parameters | |
response_type | "code" |
redirect_uri | " This value must be registered with OpenID Provider |
scope | The requested scopes as a space separated list. Should be " |
state | Random value |
client_id | Value of registration parameter " |
OpenID Connect parameters | |
nonce | Random value |
prompt | " " |
max_age | "0" if force-authn request is enabled |
ui_locales | When "
When "
When " |
login_hint | Pass-thru value from authorization request |
acr_values | Value of " |
...
Enabled if "id_token" is present in Token Response, and if "id_token_signed_response_alg" Client Configuration value is not "none"
UserInfo
Enabled if "userinfo_endpoint" is defined in Provider Metadata..
...
| Parameter | Type | Since | Description |
|---|---|---|---|
| string array | 8.4.1 | When sending an authorization request as Request Object by Value, controls the claims that should be extracted outside of the request object and sent as HTTP query parameters. |
ubisecure_request_parameters | object | 8.4.1 | Controls static parameters to be sent with authorization requests. The keys on the root level of the object will be mapped as query parameters. Values will be URL encoded. Any JSON type will be accepted and passed as an authorization request parameter |
ubisecure_request_mode | string | 8.4.1 | Controls HTTP method and parameter format used for submitting the authorization request. Value form_post will use form encoded body and POST method. Value query will use query string for parameters and GET method. If not specified the default value is query. |
ubisecure_request_object_sub_claim_required | boolean | 8.9.3 | When sending an authorization request as Request Object by Value, control if sub claim representing the client ID is to be added to the JWT. Default value is false. It is not recommended to set this value to true in order to avoid Cross-JWT Confusion. |
...
| Warning | ||
|---|---|---|
| ||
Please note that when sending authorization requests using GET the request URL length might exceed the limit in some browsers. Care must be taken when sending many query parameters using HTTP GET. |
Compatibility flags
The following compatibility flags are supported for OpenID Connect authentication methods
| Flag | Since | Applies to | Description | ||
|---|---|---|---|---|---|
| 8.4.1 | Specific authentication method or system-wide | Controls JWT aud claim construction and validation policy. If set, the aud claim is required to match the provider's invoked endpoint. If not set, accepts and generates aud claim with issuer, token endpoint and invoked endpoint. | ||
| 8.4.1 | Specific authentication method or system-wide | Controls JWT claims validation of secured authorization request. If set, then implement pre 8.4.1 validation. Only iss claim is validated. If not set, then aud, sub, exp and jti claims are validated but only when present. | ||
AppleId | 8.10.0 | Specific authentication method | Changes the login UI flow for showing the login popup in Safari in Apple devices to work more reliably, especially on initial authorisation request. | ||
FinnishTrustNetwork | 8.10.0 | Specific authentication method | If set, then FTN related logic is supported. Currently, it will set
Note: this flag is also used in respective SAML configuration: SAML IDP Proxy - SSO |