> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/access/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/access/key-components/authenticators/protocol-managers/oidc/oidc-relying-party.md).

# OIDC Relying Party

Configuration and usage guidance for OIDC Relying Party in Fortified ID Access.

**Note:** There are two sections related to the OIDC Relying Party. This section describes when Fortified ID Access acts as an **OIDC Relying Party (RP)**.\
If you are looking for information about when Access acts as an **OIDC** **OpenID Provider (OP)**, click the following [link](/access/key-components/modules/oidc/relying-party.md).

## Configuration

{% hint style="info" %}
**Authenticator Type:** `OIDCRP | OIDCAuthCodeFlowRP`
{% endhint %}

Common Authenticator configuration can be found [here](/access/key-components/authenticators/common-configuration.md).

{% tabs %}
{% tab title="Properties" %}

<table data-full-width="true"><thead><tr><th>Name</th><th>Description</th><th>Default value</th><th data-type="checkbox">Mandatory</th></tr></thead><tbody><tr><td><code>discovery_metadata_url</code></td><td>URL to the external OP.</td><td>N/A</td><td>true</td></tr><tr><td><code>internal_http_destination</code></td><td>ID of the internal HTTP client used to communicate with the external OP.</td><td>N/A</td><td>true</td></tr><tr><td><code>custom_identifier</code></td><td>Custom identifier to be set in the event logging entry</td><td>N/A</td><td>false</td></tr><tr><td><code>client_id</code></td><td>Client id used when communicating with the OP.</td><td>N/A</td><td>true</td></tr><tr><td><code>client_secret</code></td><td>Client secret used when communicating with the OP token endpoint. Optional when PKCE is used.</td><td>N/A</td><td>false</td></tr><tr><td><code>redirect_uri</code></td><td>Redirect URI used when communicating with the OP.</td><td>N/A</td><td>true</td></tr><tr><td><code>scope</code></td><td>OIDC scope used when communicating with the OP.</td><td><code>"openid"</code></td><td>false</td></tr><tr><td><code>use_pkce</code></td><td>Enables PKCE when the external OP advertises support for <code>S256</code>.</td><td><code>true</code></td><td>false</td></tr><tr><td><code>enable_user_info_lookup</code></td><td>If userinfo endpoint should be contacted. (The userinfo endpoint must also be part of the discovery metadata)</td><td><code>true</code></td><td>false</td></tr><tr><td><code>jwt_subject_parameter</code></td><td><p>JWT parameter used as</p><p>subject/username.</p></td><td><code>"sub"</code></td><td>false</td></tr><tr><td><code>use_raw_claims</code></td><td>If the collected claims should be presented "raw" on the global state object. Otherwise the claims will be "stringified".</td><td><code>false</code></td><td>false</td></tr><tr><td><code>id_token_header_prefix</code></td><td>Prefix to use for the id_token header claims.</td><td><code>""</code></td><td>false</td></tr><tr><td><code>id_token_payload_prefix</code></td><td>Prefix to use for the id_token payload claims.</td><td><code>""</code></td><td>false</td></tr><tr><td><code>userinfo_prefix</code></td><td>Prefix to use for the userinfo claims.</td><td><code>""</code></td><td>false</td></tr><tr><td><code>disable_nonce</code></td><td>Disables sending nonce as part of the requests.</td><td><code>false</code></td><td>false</td></tr><tr><td><code>acr_values</code></td><td>include <code>acr_values</code> in auth request query params. Multiple values must be space-separated. No <code>acr_values</code> will be sent if left empty.</td><td><code>""</code></td><td>false</td></tr><tr><td><code>cancel_on_errors</code></td><td>Maps configured error codes from OP to this authenticator's <code>cancel_location</code>. Array of strings.</td><td><code>[]</code></td><td>false</td></tr><tr><td><code>cancel_on_error_description_patterns</code></td><td>Maps configured error descriptions from OP to this authenticator's <code>cancel_location</code>. Array of strings.</td><td><code>[]</code></td><td>false</td></tr></tbody></table>
{% endtab %}

{% tab title="Example" %}

```json
{
    "id": "oidc_rp",
    "type": "OIDCRP",
    "config": {
        "base_path": "/oidcrp/authn",
        "custom_identifier": "fortifiedid",
        "discovery_metadata_url": "https://192.168.50.228/oidc/mycompany/.well-known/openid-configuration",
        "internal_http_destination": "oidcrp_httpclient",
        "client_id": "my_client_id",
        "client_secret": "my_client_secret",
        "redirect_uri": "http://127.0.0.1:8080/oidcrp/authn/oidc_rp",
        "use_pkce": true,
        "jwt_subject_parameter": "given_name"	
    }
}
```

{% endtab %}
{% endtabs %}

## PKCE and `client_secret`

`client_secret` does not enable or disable PKCE.

For `OIDCRP`, PKCE is controlled separately by the authenticator setting `use_pkce`, which defaults to `true`. When `use_pkce` is enabled and the external OP advertises support for `S256` in discovery metadata, Access sends `code_challenge` in the authorization request and `code_verifier` in the token request.

This means:

* `client_secret` can be omitted for public clients that use PKCE
* omitting `client_secret` does not turn PKCE on by itself
* if `client_secret` is omitted and PKCE is not used, the token request will not have client authentication and the flow will fail

## Cancel instead of failure on OP errors

A couple of common error codes from an OP:

* invalid\_request
* unauthorized\_client
* access\_denied
* unsupported\_response\_type
* invalid\_scope

All OP errors go to the `failure_location`, either explicitly set or inherited, unless configured to go to the `cancel_location`:

```json5
// This should only be used if you know that the specific OP you integrate 
// with uses access_denied to represent a user cancellation in your flow.
"cancel_on_errors": ["access_denied"]
```

You can also configure a regex pattern matched against the full error\_description from the OP.

```json5
"cancel_on_error_description_patterns": [
  ".*user cancelled.*",
  ".*denied by user.*"
]
```

The following applies to opt-in mapping to cancel:

* `cancel_on_errors` is checked first
* `cancel_on_error_description_patterns` is checked afterwards
* if neither matches, the callback goes to `failure_location`

This means:

* both can be used individually
* both can be used together
* neither of them needs to be configured

## Logging

On a successful authentication, an event is logged containing the following:

* `WEB_100021`
* IDENTIFIER (user traceid)
* SOURCE\_SERVICE\_NAME (issuer from metadata)
* SOURCE\_USER\_NAME (`jwt_subject_parameter` from any of the claims)
* SOURCE\_ADDRESS (user IP address)
* CUSTOMER\_IDENTIFIER (`custom_identifier` if configured)

On a failed authentication, the following event is logged:

* `WEB_100028`
* IDENTIFIER (user traceid)
* SOURCE\_SERVICE\_NAME (issuer from metadata)
* SOURCE\_ADDRESS (user IP address)
* CUSTOMER\_IDENTIFIER (`custom_identifier` if configured)

## Data exposed to global state

After successful validation, data stored in the global state are:

* id\_token header claims
* id\_token payload claims
* userinfo claims (if `enable_user_info_lookup`=`true`)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.fortifiedid.se/access/key-components/authenticators/protocol-managers/oidc/oidc-relying-party.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.