OIDC (OpenID Connect)

Name

Give your application a clear and descriptive name. This name will appear in the applications list and on authentication pages.

Description

(Optional) Add a short description for your application.

Logo

Upload an image file. The logo will be visible in the applications list and on the authentication pages.

Subject Management

Select the user attribute that uniquely identifies the user. This value will be used as the sub claim in the ID token to identify the user.

• email: the user's email address will be used to authenticate the principal.

• user_id: the unique identifier of the user will be used to authenticate the principal.

• username: the user's username will be used to authenticate the principal.

• {custom_attribute}: you can select a custom user attribute, as long as it is unique and it is added in the User Profile Definition. See User Attributes

API & Scopes

Select which APIs (resource servers) your application can access, and the scopes (permissions) it is allowed to request.

• Internal API: click View to display available scopes, then select one or more to grant access to this API.
  Each selected scope defines a specific permission your app will request during authentication.

Authentication method

Choose how your application authenticates to the Authorization Server when exchanging the authorization code for tokens. This step, called client authentication, ensures that the request comes from a trusted application and not from a malicious source.

• Client secret POST: sends the client ID and secret in the request body.

• Client secret Basic: sends the client ID and secret in the HTTP Authorization header (Base64).

• Client secret JWT: authenticates using a JWT signed with the client secret.

• Private key JWT: authenticates using a JWT signed with a private key (asymmetric cryptography).
  Import the corresponding public key by uploading a .pem file or pasting the public key content in .pem format.

Redirect URIs

Specify one or more redirect URIs where users will be sent after successful authorization. These URIs will be whitelisted to receive authorization codes or access tokens.

Make sure the URI(s) exactly match the values used by your application.

Policies

Select the authorization policy that defines the access rules for this application.

If not created click on Create a new authorization policy. More information

Access Token

An access token is a signed JWT that allows an application to access protected resources on behalf of a user.

Select the JWT signature algorithm used to sign the token:

• RS256: RSA signature with SHA-256 hashing - widely used and secure.

• RS384: RSA signature with SHA-384 hashing - stronger than RS256 but less common.

• RS512: RSA signature with SHA-512 hashing - highest security level, used when maximum strength is needed.

Backchannel settings

Enter the URL where your application will receive authentication responses and tokens. When a user approves or rejects a transaction, the IdP sends the result to this endpoint.

• Must be an HTTPS URL.

• The endpoint must be reachable by the IdP.

• This URL handles server-to-server notifications, no browser interaction is required.

SECURITY SETTINGS

Authorization Code Lifetime

Set the validity period of the authorization code (in seconds).

The authorization code is issued after the Resource Owner's authentication and is used by the application to request access tokens.

Default: 60 seconds.

Access Token Lifetime

Set the validity period of the access token (in seconds).

The access token is a signed JWT allowing the app to access protected resources on behalf of the user.

Default: 900 seconds.

Certificate

Select the certificate that secures OIDC token exchanges with your application, ensuring integrity and confidentiality.

ID Token lifetime

Set the validity period of the ID token (in seconds).

The ID token is issued by the Identity Provider and contains information about the authenticated user's identity.

Default: 86400 seconds (24 hours).

Refresh Token

Set the validity period of the refresh token (in seconds).

This token allows the application to obtain new access tokens without requiring the user to re-authenticate.

Default: 86400 seconds (24 hours).

Refresh tokens can also be disabled (enabled by default).

Allowed Origins

Enter the URLs or domains authorized to initiate authentication requests to the Identity Provider. This helps protect against unauthorized interception or redirection attacks.

APIS & SCOPES

OpenID Connect (OIDC) settings

Not fully functional – available soon

Standard OIDC scopes are supported automatically, no need to add them. Use this parameter only for custom scopes.

To add a custom scope:

1. Click + Add new OIDC scope and claims to define which user data your application can access.

2. Select or enter a scope name:

3. Choose where to include the data:

   1. token_id (included in the ID token)

   2. user_info (available through the UserInfo endpoint)

4. Select the user attributes (claims) you want to expose.

5. Click Save.

APP SETTINGS

Consent Management

Define how user consent is handled regarding their personal data.

• Skip consent: if enabled, the consent page is skipped.
  Disabled (default) means TrustBuilder handles consent.
  If you skip it, your Application or Service must handle consent itself.

• Consent lifetime: set the duration for which the user's consent remains valid (in seconds).
  Default: 86,400 seconds (24 hours).