> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/access/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/access/key-components/modules/oidc/oidc-module.md).

# OIDC module

Acts as an OpenID Connect Provider.

On this page, you can manage the **Back-Channel Endpoints**.\
The configuration of the **Authorization Endpoint** depends on the selected **OIDC flow type**:

* For **Authorization Code Flow**, click [LINK](/access/key-components/authenticators/protocol-managers/oidc/authorization-code-flow.md).
* For **Implicit Flow**, click [LINK](/access/key-components/authenticators/protocol-managers/oidc/implicit-flow.md).

## Introduction

Can be configured in multiple instances allowing for multi tenancy.

Acts as an OpenID Connect provider. It acts as a controller mainly for issuing Json Web Tokens (JWT). Typically the configured authenticator is the first point of contact coming from an OpenID Connect Relying Party, requesting identification.

Fortified Integrity have achieved certifications for five OpenID Provider conformance profiles. Read more about these profiles here: <https://openid.net/certification/>

## OpenID Connect Provider Configuration

{% hint style="info" %}
**Module name:** `OIDCModule`
{% endhint %}

{% tabs %}
{% tab title="Properties" %}

<table data-full-width="true"><thead><tr><th>Name</th><th>Description</th><th>Default value</th><th data-type="checkbox">Mandatory</th></tr></thead><tbody><tr><td><code>http_context</code></td><td>Base URI for the endpoints.</td><td>N/A</td><td>true</td></tr><tr><td><code>http_port</code></td><td>Port</td><td>N/A</td><td>true</td></tr><tr><td><code>tenant_op_path</code></td><td>A tenant specific path part of the endpoint URIs. Example: http://127.0.0.1:8080/oidc/<strong>tenant1</strong>/token-endpoint</td><td>N/A</td><td>true</td></tr><tr><td><code>discovery_meta</code></td><td>Discovery data presented at the OpenID Configuration endpoint.</td><td>N/A</td><td>true</td></tr><tr><td><code>sign_ref</code></td><td>List of OIDC signing keys used for overlapping key rotation. Recommended for new configurations.</td><td>N/A</td><td>false</td></tr><tr><td><code>keystore</code></td><td>Legacy single-key keystore configuration used for JWT signing and JWKS publication when <code>sign_ref</code> is not configured.</td><td>N/A</td><td>false</td></tr><tr><td><code>rps</code></td><td><a href="/access/key-components/modules/oidc/relying-party.md">List of relying parties. Must include at least one relying party.</a></td><td>N/A</td><td>true</td></tr><tr><td><code>required_request_parameters</code></td><td>Required request parameters for the token endpoint.</td><td><code>["redirect_uri","code"]</code></td><td>false</td></tr><tr><td><code>code_verifier_hash_alg</code></td><td>Hash algorithm used for Proof Key of Code Exchange (PKCE).</td><td><code>"SHA-256"</code></td><td>false</td></tr><tr><td><code>enable_refresh_token</code></td><td>Set to <code>true</code> if using refresh tokens.</td><td><code>false</code></td><td>false</td></tr><tr><td><code>reuse_refresh_token</code></td><td>Set to <code>true</code> when the OIDC RP does not support rotating refresh tokens.</td><td><code>false</code></td><td>false</td></tr><tr><td><code>allow_userinfo_access_token_in_query</code></td><td>Allows the UserInfo endpoint to accept <code>access_token</code> as a query parameter. This is disabled by default and should only be enabled for legacy clients that cannot send bearer tokens in the Authorization header.</td><td><code>false</code></td><td>false</td></tr><tr><td><code>verbose</code></td><td>Turns on deep OIDC TRACE logging for the back-channel endpoints when the dedicated logger category <code>fortifiedid.oidc.trace</code> is set to <code>TRACE</code>. Use for troubleshooting only.</td><td><code>false</code></td><td>false</td></tr></tbody></table>
{% endtab %}

{% tab title="Example" %}

```json
{
      "name": "OIDCModule",
      "enabled": true,
      "config":{
        "providers":[
            {
              "http_context" : "/oidc",
              "http_port" : 8080,
              "discovery_meta" : {
                  "issuer" : "http://192.168.50.228:8080/oidc/tenant1",
                  "authorization_endpoint" : "http://192.168.50.228:8080/test/authn/oidc",
                  "token_endpoint" : "http://192.168.50.228:8080/oidc/tenant1/token-endpoint",
                  "userinfo_endpoint" : "http://192.168.50.228:8080/oidc/tenant1/userinfo-endpoint",
                  "introspection_endpoint" : "http://192.168.50.228:8080/oidc/tenant1/introspection-endpoint",
                  "jwks_uri" : "http://192.168.50.228:8080/oidc/tenant1/.well-known/openid-configuration/jwks",
                  "end_session_endpoint" : "http://192.168.50.228:8080/test/authn/oidc/logout",
                  "scopes_supported" : [ "openid" ],
                  "response_types_supported" : [ "code" ],
                  "grant_types_supported" : [ "authorization_code" ],
                  "subject_types_supported" : [ "public" ],
                  "id_token_signing_alg_values_supported" : [ "RS256" ],
                  "token_endpoint_auth_methods_supported" : [ "client_secret_post", "client_secret_basic" ],
                  "claims_supported" : [ "iss", "ver", "sub", "given_name", "family_name" ],
                  "request_parameter_supported" : true
              },
              "tenant_op_path" : "/tenant1",
              "sign_ref" : [
                    {
                      "keystore" : {
                            "path" : "/fortified_test/oidc-2026-q1.p12",
                            "password" : "secret",
                            "key_password" : "secret",
                            "alias" : "oidc-2026-q1",
                            "type" : "PKCS12"
                      }
                    }
              ],
              "rps" : [{
                    "client_id" : "provided",
                    "client_secret" : "provided",
                    "pipe_id":"optional_pipe_id",
                    "redirect_uri" : [ "https://auth.organisation.com/authenticate/oidcrp" ],
                    "post_logout_redirect_uris" : ["https://auth.organisation.com/authenticate/oidcrp/loggedout"]
              }]
        }]
      }
}
```

{% endtab %}
{% endtabs %}

{% hint style="info" %}
The `rps` configuration also supports per-application authorization. See [Relying Party](/access/key-components/modules/oidc/relying-party.md) for RP-specific claims, pipes and app-specific authorization.
{% endhint %}

{% hint style="info" %}
For OIDC signing-key selection, overlapping rotation, JWKS publication, and legacy compatibility, see [OIDC signing keys](/access/key-components/modules/oidc/signing-keys.md).
{% endhint %}

## Deep TRACE logging

For difficult troubleshooting of OIDC OP flows, the OIDC module can produce a deep TRACE log for incoming requests and outgoing responses on the back-channel endpoints.

This trace is intended for short-lived diagnostics only. It logs raw OIDC values and does **not** redact tokens, authorization codes, client secrets, cookies, or other credentials.

{% hint style="warning" %}
Enable this only during active troubleshooting and remove it again afterwards.
{% endhint %}

### What is covered

When enabled, the OIDC module logs detailed request/response data for OIDC OP endpoints such as:

* OpenID Configuration
* JWKS
* Token endpoint
* UserInfo endpoint
* Introspection endpoint
* Device Authorization endpoint

### How to enable it

Both of the following must be true:

1. The dedicated logger category must be set to `TRACE`
2. The OIDC module instance must have `verbose: true`

Example Log4j configuration:

```xml
<AsyncLogger name="fortifiedid.oidc.trace" level="TRACE" />
```

Example OIDC module configuration:

```json
{
  "name": "OIDCModule",
  "enabled": true,
  "config": {
    "verbose": true,
    "providers": [
      {
        "http_context": "/oidc",
        "http_port": 8080,
        "tenant_op_path": "/tenant1"
      }
    ]
  }
}
```

### Authorization endpoint and logout tracing

If you also want deep TRACE logging for the authorization endpoint flow, redirects, and logout handling, set `verbose: true` on the OIDC **Authorization Code Flow** authenticator as well.

See [Authorization Code Flow](/access/key-components/authenticators/protocol-managers/oidc/authorization-code-flow.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.fortifiedid.se/access/key-components/modules/oidc/oidc-module.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.