PUT

Register provider metadata with SSO Server

Body is JSON formatted Provider Metadata

{ "issuer":"https://oidc.provider.example.com", "authorization_endpoint":"https://oidc.provider.example.com/oidc/authorize", "token_endpoint":"https://oidc.provider.example.com/oidc/token", "jwks_uri":"https://oidc.provider.example.com/oidc/jwks", "response_types_supported":[ "code" ], "grant_types_supported":[ "authorization_code" ], "id_token_signing_alg_values_supported":[ "RS256" ], "token_endpoint_auth_methods_supported":[ "private_key_jwt" ], "scopes_supported":[ "openid" ], "claims_supported":[ "urn:oid:2.5.4.4", "urn:oid:1.2.246.575.1.14", "sub", "urn:oid:1.3.6.1.5.5.7.9.1", "urn:oid:1.2.246.21" ] }

GET

Read previously registered provider metadata

Response is JSON formatted Provider Metadata

DELETE

Remove registered provider metadata

Also removes JWKS and registration response

PUT

Register provider JSON Web Keys with SSO Server

Body is JWKS formatted public keys (Content-Type: application/jwk-set+json)

{ "keys": [ { "kty": "RSA", "e": "AQAB", "use": "sig", "kid": "keyid9876", "alg": "RS256", "n": "05Csoq8qI...aYvRL1V_8" } ]}

GET

Read previously registered JWKS

DELETE

Remove registered JWKS

GET

Generate client registration request

Or read previously registered registration response

Response is JSON formatted registration request

PUT

Register registration response with SSO Server

Body is JSON formatted registration response

{ "redirect_uris": [ "https://sso.example.com/uas/return/oidc.aktia.1/redirect" ], "grant_types": [ "authorization_code" ], "response_types": [ "code" ], "jwks_uri": "https://sso.example.com/uas/oauth2/names/ac/oidc.method.1/metadata.jwks",

"scope": "openid scope1", "id_token_signed_response_alg": "RS256", "id_token_encrypted_response_alg": "RSA-OAEP", "id_token_encrypted_response_enc": "A128GCM", "request_object_signing_alg": "RS256", "token_endpoint_auth_method": "private_key_jwt", "client_id": "test-client", "ubisecure_request_object_query_parameters": [ "client_id", "scope", "response_type", "acr_values" ], "ubisecure_request_parameters": { "acr_values": "acr1" } }

DELETE

Remove any registration

Use DELETE before GET to make sure a new registration request is generated

response_type

"code"

redirect_uri

"https://sso.example.com/uas/return/oidc.method.1/redirect"

This value must be registered with OpenID Provider

scope

The requested scopes as a space separated list.

Should be "openid" if registration parameter is not defined

state

Random value

client_id

Value of registration parameter "client_id"

nonce

Random value

prompt

"login" if force-authn request is enabled

"none" if is-passive request is enabled

max_age

"0" if force-authn request is enabled

ui_locales

When "ui_locales_supported" is a non-empty array of locale tags:

1. Best match for SSO Server user interface locale in "ui_locales_supported".

2. Value of registration parameter "default_ui_locales", provided it's also present in "ui_locales_supported".

3. First item in "ui_locales_supported".

When "ui_locales_supported" is not set:

1. SSO Server user interface locale.

2. Value of registration parameter "default_ui_locales".

When "ui_locales_supported" is set, but is an empty array, the parameter "ui_locales" will not be set.

login_hint

Pass-thru value from authorization request

acr_values

Value of "acr_values" in the extension parameter "ubisecure_request_parameters" in the client metadata.

grant_type

"code"

code

Value from authorization response

redirect_uri

"https://sso.example.com/uas/return/oidc.method.1/redirect"

oidc.acr

Specifies the method filtering. This can be used for filtering method visibility within application based on the received acr_values. One of the received acr_values must match with the values defined by this parameter.

ubisecure_request_object_query_parameters

string array

8.4.1

When sending an authorization request as Request Object by Value, controls the claims that should be extracted outside of the request object and sent as HTTP query parameters.

ubisecure_request_parameters

object

8.4.1

Controls static parameters to be sent with authorization requests. The keys on the root level of the object will be mapped as query parameters. Values will be URL encoded. Any JSON type will be accepted and passed as an authorization request parameter

ubisecure_request_mode

string

8.4.1

Controls HTTP method and parameter format used for submitting the authorization request. Value form_post will use form encoded body and POST method. Value query will use query string for parameters and GET method. If not specified the default value is query.

ubisecure_request_object_sub_claim_required

boolean

8.9.3

When sending an authorization request as Request Object by Value, control if sub claim representing the client ID is to be added to the JWT. Default value is false. It is not recommended to set this value to true in order to avoid Cross-JWT Confusion.

StrictAudiencePolicy

8.4.1

Specific authentication method or system-wide

Controls JWT aud claim construction and validation policy. If set, the aud claim is required to match the provider's invoked endpoint. If not set, accepts and generates aud claim with issuer, token endpoint and invoked endpoint.

SecuredAuthorizationRequestValidate

8.4.1

Specific authentication method or system-wide

Controls JWT claims validation of secured authorization request. If set, then implement pre 8.4.1 validation. Only iss claim is validated. If not set, then aud, sub, exp and jti claims are validated but only when present.

AppleId

8.10.0

Specific authentication method

Changes the login UI flow for showing the login popup in Safari in Apple devices to work more reliably, especially on initial authorisation request.

FinnishTrustNetwork

8.10.0

Specific authentication method

If set, then FTN related logic is supported. Currently, it will set ftn_spname authentication request parameter to value of agent friendly name (client_name metadata property of client (agent) application). The client_name property may be localized as follows:

Note: this flag is also used in respective SAML configuration: SAML IDP Proxy - SSO