> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/access/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/access/key-components/authenticators/protocol-managers/oidc/implicit-flow.md).

# Implicit Flow

Authenticator handling implicit flows in OIDC.

There are two locations where configuration for an OIDC **OpenID Provider (OP)** using the **Implicit Flow** can be managed:

1. **Authorization Endpoint** – You can modify the authorization endpoint settings here.
2. **Back-Channel Endpoints** – By clicking the following [link](/access/key-components/modules/oidc/oidc-module.md), you can manage back-channel endpoints such as **UserInfo**.

## About

No identification is done by this authenticator. It acts as a controller for issuing Json Web Tokens (JWT). Typically this authenticator is the first point of contact coming from an OpenID Connect Relying Party, requesting identification.

This authentication controller can be considered a start and end touch point. The main purpose is to handle OpenID Connect specifics.

Actual user identification is done elsewhere.

When using this authenticator, the ID token is returned in the response.

## Configuration

{% hint style="info" %}
**Authenticator Type:** `OIDCImplicitFlow`
{% endhint %}

Common Authenticator configuration can be found [here](/access/key-components/authenticators/common-configuration.md).

{% tabs %}
{% tab title="Properties" %}

<table data-full-width="true"><thead><tr><th>Name</th><th>Description</th><th>Default value</th><th data-type="checkbox">Mandatory</th></tr></thead><tbody><tr><td><code>chain</code></td><td>List of authenticators performing the actual authentication.</td><td>N/A</td><td>true</td></tr><tr><td><code>userinfo_endpoint_ttl</code></td><td>User info endpoint time to live in milliseconds.</td><td><code>60000</code></td><td>false</td></tr><tr><td><code>sign_ref</code></td><td>List of OIDC signing keys used for overlapping key rotation. Recommended for new configurations.</td><td>N/A</td><td>false</td></tr><tr><td><code>keystore</code></td><td>Legacy single-key keystore configuration used for JWT signing when <code>sign_ref</code> is not configured.</td><td>N/A</td><td>false</td></tr><tr><td><code>rps</code></td><td><a href="/access/key-components/modules/oidc/relying-party.md">List of relying parties. Must include at least one relying party.</a></td><td>N/A</td><td>true</td></tr><tr><td><code>required_request_parameters</code></td><td>Required parameters.</td><td><code>["response_type", "client_id", "redirect_uri", "scope", "nonce"]</code></td><td>false</td></tr><tr><td><code>request_object_audience</code></td><td>Expected <code>aud</code> value for signed request objects. If configured, the request object's audience must include this value.</td><td>N/A</td><td>false</td></tr></tbody></table>
{% endtab %}

{% tab title="Example" %}

<pre class="language-json"><code class="lang-json">{
    "id": "auth00",
    "type": "OIDCImplicitFlow",
    "config": {
        "base_path": "/test/authn",
        "failure_location": "/authn/failure.html",
        "chain": [{
            "id" : "select",
            "required" : true
        }],
        "userinfo_endpoint_ttl" : 90000,
        "required_request_parameters": ["response_type", "client_id", "redirect_uri", "scope", "nonce"],
        "sign_ref" : [
            {
                "keystore" : {
                    "path" : "/fortified_test/oidc-2026-q1.p12",
                    "password" : "secret",
                    "key_password" : "secret",
                    "alias": "oidc-2026-q1",
                    "type" : "PKCS12"
                }
            }
        ],
        "rps" : [ {
            "client_id" : "provided",
            "client_secret" : "provided",
            "redirect_uri" : ["https://auth.organisation.com/authenticate/oidcrp"],
            "post_logout_redirect_uris" : ["https://auth.organisation.com/authenticate/oidcrp/loggedout"],
            "pipe_id" : "optional_pipe_id",
            "id_token_headers" : {
                "kid" : ""
            },
<strong>            "id_token_claims" : {
</strong>                "test_claim": "static_claim",
                "email": "${item.mail}",
                "nonce": "${request.nonce}"
            },
            "access_token_claims" : {
                "userinfo_claim_test": "static_claim",
                "email": "${item.mail}",
                "email_verified": true,
                "address": {
                    "street_address": "my address", 
                    "postal_code": "my postal code"
                },
                "given_name": "${item.givenName}",
                "subject": "${item.subject}"
            }
        }]
    }
}
</code></pre>

{% endtab %}
{% endtabs %}

{% hint style="info" %}
For the OIDC signing-key model, overlapping rotation, and legacy compatibility, see [OIDC signing keys](/access/key-components/modules/oidc/signing-keys.md).
{% endhint %}

## Signed Request Objects

If the authorization request contains the OIDC `request` parameter, FortifiedID Integrity expects a signed request object.

To enable this, configure a `request_object_keystore` on the corresponding relying party. Unsigned request objects are not accepted.

Optionally configure `request_object_audience` on the authenticator to require a specific `aud` value in the signed request object.

## Logging

On a successful authentication, an event is logged containing the following:

* WEB\_100101
* IDENTIFIER (user traceid)
* DESTINATION\_SERVICE\_NAME (redirect URI)
* SOURCE\_ADDRESS (user IP address)

## Data sent to PIPE

All data put into the shared authentication state along with the HTTP headers are exposed and sent into the pipe.

Data put into the state by this authenticator is:

OIDC request data

## Expected data from PIPE

In order to use data from PIPE the response must contain one item. All data from that item will be available under the exports scope ( `${exports.mail}` ) during expansion, when creating the ID token and access token.

## Available data for ID\_token and Access Token claims

Data is extracted with the help of expansions.

The following scopes are available:

<table data-full-width="true"><thead><tr><th>Scope</th><th>Description</th><th>Example</th></tr></thead><tbody><tr><td><code>request</code></td><td>The current authentication request including HTTP <code>headers</code> and <code>params</code></td><td><code>${request.client_id}</code></td></tr><tr><td><code>session</code></td><td>The current session.</td><td><code>${session.sub}</code></td></tr><tr><td><code>exports</code></td><td>Exports data. Note: All pipe data is available under the exports scope.</td><td><code>${exports.sub}</code></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.fortifiedid.se/access/key-components/authenticators/protocol-managers/oidc/implicit-flow.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.