mirror of https://github.com/requarks/wiki
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
97 lines
2.9 KiB
97 lines
2.9 KiB
key: oidc
|
|
title: Generic OpenID Connect / OAuth2
|
|
description: OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 protocol.
|
|
author: requarks.io
|
|
logo: https://static.requarks.io/logo/oidc.svg
|
|
icon: /_assets/icons/ultraviolet-openid.svg
|
|
color: blue-grey-8
|
|
vendor: 'OpenID Foundation'
|
|
website: 'https://openid.net/connect/'
|
|
isAvailable: true
|
|
useForm: false
|
|
usernameType: email
|
|
props:
|
|
clientId:
|
|
type: String
|
|
title: Client ID
|
|
hint: Application Client ID, as the provider issued it.
|
|
icon: key
|
|
order: 1
|
|
clientSecret:
|
|
type: String
|
|
title: Client Secret
|
|
hint: Application Client Secret, as the provider issued it.
|
|
icon: password
|
|
sensitive: true
|
|
order: 2
|
|
issuer:
|
|
type: String
|
|
title: Issuer
|
|
hint: The provider's issuer URL, e.g. https://id.example.com. Everything else is discovered from it.
|
|
icon: internet
|
|
order: 3
|
|
useDiscovery:
|
|
type: Boolean
|
|
title: Use Discovery
|
|
hint: Read the endpoints and signing keys from the issuer's /.well-known/openid-configuration. Turn off only for a provider that does not publish one, and fill in the endpoints below.
|
|
icon: rescan-document
|
|
default: true
|
|
order: 4
|
|
authorizationURL:
|
|
type: String
|
|
title: Authorization Endpoint URL
|
|
hint: Ignored while discovery is on.
|
|
icon: enter
|
|
order: 5
|
|
tokenURL:
|
|
type: String
|
|
title: Token Endpoint URL
|
|
hint: Ignored while discovery is on.
|
|
icon: exit
|
|
order: 6
|
|
userInfoURL:
|
|
type: String
|
|
title: User Info Endpoint URL
|
|
hint: Ignored while discovery is on. Optional even without it — the ID token alone can carry everything needed.
|
|
icon: contact
|
|
order: 7
|
|
jwksURL:
|
|
type: String
|
|
title: JSON Web Key Set URL
|
|
hint: Ignored while discovery is on. Where the keys that signed the ID token are published; without it the ID token cannot be verified and logins are refused.
|
|
icon: fingerprint-scan
|
|
order: 8
|
|
scopes:
|
|
type: String
|
|
title: Scopes
|
|
hint: Space-separated. `openid` is required; `email` is what an account is matched on here.
|
|
icon: rules
|
|
default: 'openid profile email'
|
|
order: 9
|
|
emailClaim:
|
|
type: String
|
|
title: Email Claim
|
|
hint: Which claim carries the email address.
|
|
icon: envelope
|
|
default: email
|
|
order: 10
|
|
displayNameClaim:
|
|
type: String
|
|
title: Display Name Claim
|
|
hint: Which claim carries the name to show. Falls back to the email address when the claim is absent.
|
|
icon: person
|
|
default: name
|
|
order: 11
|
|
logoutURL:
|
|
type: String
|
|
title: Logout URL
|
|
hint: (optional) Where to send a user after logging out, so that the session at the provider ends too.
|
|
icon: exit
|
|
order: 12
|
|
refs:
|
|
callbackUrl:
|
|
title: Authorization Callback URL
|
|
hint: Register this as the redirect URI at the provider. It is the same for every provider.
|
|
icon: back
|
|
value: '{host}/_api/auth/{id}/callback'
|