Authorization code grant - SSO
- ubisebastian
- Former user (Deleted)
- Arto Vainiolehto
Authorization Request
Parameters
| Name | Description |
|---|---|
OAuth Parameters | |
response_type | "code" Must be "code", as only Authorization Code flow is currently supported by SSO Server |
| client_id | Value from client registration "client_id" value |
redirect_uri | The address where user agent is redirected after authorization F or loopback addresses , any port value is accepted It is also possible to use private-use uri schemes Client registration parameter "redirect_uris" controls allowed redirect_uri values for application |
| scope | "openid" A space separated list of scope values Should always include "openid" May also specify any number of client_id values of other registered applications, when requesting an access token for other applications Client registration parameter "scope" controls allowed scope values for application. If registration parameter is not defined then all scope values are allowed |
| state | An opaque value used by the client to maintain state between the request and callback |
OpenID Connect Parameters | |
| nonce | An opaque value used by the client to maintain state between the request and id token |
| display | Used by client to choose user interface template Template parameter "oidc.display" controls this feature |
| prompt | "none" Indicates "is-passive" request, where SSO Server will not display any user interface pages "login" Indicates "force-authn" request, where SSO Server will re-authenticate user |
| max_age | "0" Indicates "force-authn" request, where SSO Server will re-authenticate user |
| ui_locales | Used by client to choose user interface language, must match one of configured language codes Template parameter "locales" controls this feature |
| login_hint | A hint about the login identifier the user might use to log in. SSO Server will set "Username" input field to this value. Template parameter "useloginhint" controls this feature |
| acr_values | Used by client for authentication method discovery Authentication method parameter "oidc.acr" controls this feature |
| code_challenge | A challenge derived from the code verifier to be verified against when processing the subsequent token request. Required if a value is set for the key "code_challenge_method" or "token_endpoint_auth_method" is set to "none" in the Client Metadata. Otherwise optional. See RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients. |
| code_challenge_method | A method that was used to derive code challenge. Allowed values are "plain" and "S256". If not set, then the default value is the value of the key "code_challenge_method" in the Client Metadata if present, or "plain". Furthermore, if the value "S256" is set for "code_challenge_method" in the Client Metadata, the use of "plain" code_challenge_method in the authorization request is not allowed. See RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients. |
Finnish Trust Network extension parameters | |
| ftn_spname | Friendly name of the application. Ignored unless configuration string AllowFtnSpname=true is set for the application. |
Ubisecure extension parameters | |
| locale | Single-value parameter, otherwise same function as "ui_locales" above |
| template | Used by client to choose user interface template |
Signed and encrypted request
Client registration parameters "request_object_signing_alg", "request_object_encryption_alg" and "request_object_encryption_enc" control this feature
See Signed and encrypted request - SSO
Response
Authorization response is a redirect to redirect_uri with following parameters
| Name | Description |
|---|---|
| code | The authorization code generated by authorization server |
| state | Exact value from authorization request |
The client exchanges authorization code for an access token with "authorization_code" Token Request
Token Request
Parameters
| Name | Description |
|---|---|
grant_type | "authorization_code" |
| code | The authorization code received from authorization server |
| redirect_uri | Must match the redirect_uri parameter in the authorization request |
| code_verifier | A cryptographically random string that is used to match the code_challenge sent in the authorization request to the token request. See RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients. |