# OIDC module Documentation owner: product `access`; documentation version: `3.9.1`. Source: `content/products/access/3.9.1/key-components/modules/oidc/oidc-module.mdx` at commit `eaf7a020437971baeee95e87eaf963636040ac71`. On this page, you can manage the **Back-Channel Endpoints**.\ The configuration of the **Authorization Endpoint** depends on the selected **OIDC flow type**: * For **Authorization Code Flow**, click [LINK](/products/access/key-components/authenticators/protocol-managers/oidc/authorization-code-flow/). * For **Implicit Flow**, click [LINK](/products/access/key-components/authenticators/protocol-managers/oidc/implicit-flow/). ## Introduction Can be configured in multiple instances allowing for multi tenancy. Acts as an OpenID Connect provider. It acts as a controller mainly for issuing Json Web Tokens (JWT). Typically the configured authenticator is the first point of contact coming from an OpenID Connect Relying Party, requesting identification. Fortified Integrity have achieved certifications for five OpenID Provider conformance profiles. Read more about these profiles here: [https://openid.net/certification/](https://openid.net/certification/) ## OpenID Connect Provider Configuration :::note **Module name:** `OIDCModule` ::: ### Properties | Name | Description | Default value | Mandatory | | --- | --- | --- | --- | | `http_context` | Base URI for the endpoints. | N/A | true | | `http_port` | Port | N/A | true | | `tenant_op_path` | A tenant specific path part of the endpoint URIs. Example: http://127.0.0.1:8080/oidc/**tenant1**/token-endpoint | N/A | true | | `discovery_meta` | Discovery data presented at the OpenID Configuration endpoint. | N/A | true | | `sign_ref` | List of OIDC signing keys used for overlapping key rotation. Recommended for new configurations. | N/A | false | | `keystore` | Legacy single-key keystore configuration used for JWT signing and JWKS publication when `sign_ref` is not configured. | N/A | false | | `rps` | [List of relying parties. Must include at least one relying party.](/products/access/key-components/modules/oidc/relying-party/) | N/A | true | | `required_request_parameters` | Required request parameters for the token endpoint. | `["redirect_uri","code"]` | false | | `code_verifier_hash_alg` | Hash algorithm used for Proof Key of Code Exchange (PKCE). | `"SHA-256"` | false | | `enable_refresh_token` | Set to `true` if using refresh tokens. | `false` | false | | `reuse_refresh_token` | Set to `true` when the OIDC RP does not support rotating refresh tokens. | `false` | false | | `allow_userinfo_access_token_in_query` | Allows the UserInfo endpoint to accept `access_token` as a query parameter. This is disabled by default and should only be enabled for legacy clients that cannot send bearer tokens in the Authorization header. | `false` | false | | `verbose` | Turns on deep OIDC TRACE logging for the back-channel endpoints when the dedicated logger category `fortifiedid.oidc.trace` is set to `TRACE`. Use for troubleshooting only. | `false` | false | ### Example ```json { "name": "OIDCModule", "enabled": true, "config":{ "providers":[ { "http_context" : "/oidc", "http_port" : 8080, "discovery_meta" : { "issuer" : "http://192.168.50.228:8080/oidc/tenant1", "authorization_endpoint" : "http://192.168.50.228:8080/test/authn/oidc", "token_endpoint" : "http://192.168.50.228:8080/oidc/tenant1/token-endpoint", "userinfo_endpoint" : "http://192.168.50.228:8080/oidc/tenant1/userinfo-endpoint", "introspection_endpoint" : "http://192.168.50.228:8080/oidc/tenant1/introspection-endpoint", "jwks_uri" : "http://192.168.50.228:8080/oidc/tenant1/.well-known/openid-configuration/jwks", "end_session_endpoint" : "http://192.168.50.228:8080/test/authn/oidc/logout", "scopes_supported" : [ "openid" ], "response_types_supported" : [ "code" ], "grant_types_supported" : [ "authorization_code" ], "subject_types_supported" : [ "public" ], "id_token_signing_alg_values_supported" : [ "RS256" ], "token_endpoint_auth_methods_supported" : [ "client_secret_post", "client_secret_basic" ], "claims_supported" : [ "iss", "ver", "sub", "given_name", "family_name" ], "request_parameter_supported" : true }, "tenant_op_path" : "/tenant1", "sign_ref" : [ { "keystore" : { "path" : "/fortified_test/oidc-2026-q1.p12", "password" : "secret", "key_password" : "secret", "alias" : "oidc-2026-q1", "type" : "PKCS12" } } ], "rps" : [{ "client_id" : "provided", "client_secret" : "provided", "pipe_id":"optional_pipe_id", "redirect_uri" : [ "https://auth.organisation.com/authenticate/oidcrp" ], "post_logout_redirect_uris" : ["https://auth.organisation.com/authenticate/oidcrp/loggedout"] }] }] } } ``` :::note The `rps` configuration also supports per-application authorization. See [Relying Party](/products/access/key-components/modules/oidc/relying-party/) for RP-specific claims, pipes and app-specific authorization. ::: :::note For OIDC signing-key selection, overlapping rotation, JWKS publication, and legacy compatibility, see [OIDC signing keys](/products/access/key-components/modules/oidc/signing-keys/). ::: ## Deep TRACE logging For difficult troubleshooting of OIDC OP flows, the OIDC module can produce a deep TRACE log for incoming requests and outgoing responses on the back-channel endpoints. This trace is intended for short-lived diagnostics only. It logs raw OIDC values and does **not** redact tokens, authorization codes, client secrets, cookies, or other credentials. :::caution Enable this only during active troubleshooting and remove it again afterwards. ::: ### What is covered When enabled, the OIDC module logs detailed request/response data for OIDC OP endpoints such as: * OpenID Configuration * JWKS * Token endpoint * UserInfo endpoint * Introspection endpoint * Device Authorization endpoint ### How to enable it Both of the following must be true: 1. The dedicated logger category must be set to `TRACE` 2. The OIDC module instance must have `verbose: true` Example Log4j configuration: ```xml ``` Example OIDC module configuration: ```json { "name": "OIDCModule", "enabled": true, "config": { "verbose": true, "providers": [ { "http_context": "/oidc", "http_port": 8080, "tenant_op_path": "/tenant1" } ] } } ``` ### Authorization endpoint and logout tracing If you also want deep TRACE logging for the authorization endpoint flow, redirects, and logout handling, set `verbose: true` on the OIDC **Authorization Code Flow** authenticator as well. See [Authorization Code Flow](/products/access/key-components/authenticators/protocol-managers/oidc/authorization-code-flow/).