Implicit Flow

Authenticator handling implicit flows in OIDC.

There are two locations where configuration for an OIDC OpenID Provider (OP) using the Implicit Flow can be managed:

1. Authorization Endpoint – You can modify the authorization endpoint settings here.

2. Back-Channel Endpoints – By clicking the following link, you can manage back-channel endpoints such as UserInfo.

About

No identification is done by this authenticator. It acts as a controller for issuing Json Web Tokens (JWT). Typically this authenticator is the first point of contact coming from an OpenID Connect Relying Party, requesting identification.

This authentication controller can be considered a start and end touch point. The main purpose is to handle OpenID Connect specifics.

Actual user identification is done elsewhere.

When using this authenticator, the ID token is returned in the response.

Configuration

Authenticator Type: OIDCImplicitFlow

Common Authenticator configuration can be found here.

Properties

Name	Description	Default value	Mandatory
chain	List of authenticators performing the actual authentication.	N/A
userinfo_endpoint_ttl	User info (endpoint) time to live in millisesonds.	60000
keystore	Keystore reference or json object . Used for JWT signing. If no alias is configured, the first alias will be used.	N/A
rps	List of relying parties. Must include at least one relying party.	N/A
required_request_parameters	Required parameters.	["response_type", "client_id", "redirect_uri", "scope", "nonce"]

Example

Logging

On a successful authentication, an event is logged containing the following:

• WEB_100101

• IDENTIFIER (user traceid)

• DESTINATION_SERVICE_NAME (redirect URI)

• SOURCE_ADDRESS (user IP address)

Data sent to PIPE

All data put into the shared authentication state along with the HTTP headers are exposed and sent into the pipe.

Data put into the state by this authenticator is:

OIDC request data

Expected data from PIPE

In order to use data from PIPE the response must contain one item. All data from that item will be available under the exports scope ( ${exports.mail} ) during expansion, when creating the ID token and access token.

Available data for ID_token and Access Token claims

Data is extracted with the help of expansions.

The following scopes are available:

Scope	Description	Example
request	The current authentication request including HTTP headers and params	${request.client_id}
session	The current session.	${session.sub}
exports	Exports data. Note: All pipe data is available under the exports scope.	${exports.sub}