# Configuration reference

Documentation owner: product `access`; documentation version: `next`.
Source: `content/products/access/next/authenticators/protocol-managers/oidc/openid-federation-configuration.md` at commit `eaf7a020437971baeee95e87eaf963636040ac71`.

This reference lists the settings that are specific to Access as an OIDC RP in OpenID Federation. Start with [Set up a federated RP in Management Center](/products/access/next/authenticators/protocol-managers/oidc/openid-federation-management-center/) for the UI workflow. Common authenticator settings and ordinary OIDC RP behavior are documented on [OIDC Relying Party](/products/access/next/authenticators/protocol-managers/oidc/oidc-relying-party/).

The paths below are relative to each resource's `config` object. Values in the **Default** column describe Access runtime behavior unless a Management Center template is mentioned explicitly. A named HTTP listener or client is only usable if that resource actually exists in the deployment.

## Management Center field map

| Resource and tab | UI field | Configuration path |
| --- | --- | --- |
| Federation Entity · Overview | Entity ID | `entity_id` |
| Federation Entity · Relying party | OIDCRP authenticator | `oidc_rp_authenticator` |
| Federation Entity · Relying party | RP metadata profile | `rp_metadata_profile` |
| Federation Entity · Federation trust | Trust chain resolution method | `resolver_strategy` |
| Federation Entity · Federation trust | Authority hints | `authority_hints` |
| Federation Entity · Federation trust | Trust anchor | `trust_anchor` |
| Federation Entity · Federation trust | Required OP trust marks | `required_trust_marks` |
| Federation Entity · Signing | Federation signing keys | `sign_ref` |
| Federation Entity · Signing | Entity Configuration lifetime (seconds) | `entity_statement_ttl_seconds` |
| Federation Entity · Advanced | HTTP listener / Outbound HTTP client | `http_listener` / `internal_http_destination` |
| Federation Entity · Advanced | Registration store | `explicit_registration_store` |
| OIDC RP · Overview | Provider discovery | `provider_discovery_mode` |
| OIDC RP · Provider & registration | Federation Entity / OP Entity ID / Client registration | `federation_entity_id` / `federation_op_entity_id` / `federation_client_registration_type` |
| OIDC RP · Request & authentication | Token endpoint authentication / Client authentication signing keys | `token_endpoint_auth_method` / `private_key_jwt.sign_ref` |
| OIDC RP · Advanced | Outbound HTTP client | `internal_http_destination` |

The two entity references use different identifiers: `federation_entity_id` on the OIDC RP stores the Federation Entity's **public Entity ID**; `oidc_rp_authenticator` on the Federation Entity stores the authenticator's **Access resource ID**. Management Center synchronizes these references when the OIDC RP is saved.

The trust-chain selector maps **One-hop trust chain** to `direct`, **Bottom-up trust chain resolution** to `federation_chain`, and **Single point of trust resolution** to `federation_resolver`. Choose the method that matches the federation's topology; the generated `direct` value is only a starting value.

## Federation entity module

:::note
**Module name:** `OIDCFederationEntityModule`
:::

| Name | Description | Default | Mandatory |
| --- | --- | --- | --- |
| `entity_id` | Public HTTPS identifier for the Access federation entity. The Entity Configuration route is derived from its path. | `""` | Yes |
| `http_listener` | Named Access HTTP listener that publishes the Entity Configuration. | `"default"` | No |
| `http_context` | Listener context used when attaching the public route. | `"/"` | No |
| `internal_http_destination` | Named `HttpClient` destination used for federation fetch, resolve, trust-mark status and explicit-registration calls. Management Center's generated template uses `"default"`; select an existing client. | `"oidcrp_httpclient"` at runtime | No |
| `sign_ref` | Federation signing key references. Management Center generates the first key when it creates the entity; include overlapping entries during rotation. | `[]` at runtime | true for managed entities |
| `keystore` | Legacy single federation-signing keystore supported by Access runtime for existing direct JSON configurations. Management Center rejects this field; use `sign_ref` in managed configuration. | `{}` | No |
| `sign_jwt_keystore_alias` | Alias for a legacy direct-JSON single-key configuration. | `""` | No |
| `sign_jwt_keystore_password` | Private-key password for a legacy direct-JSON single-key configuration. | `""` | No |
| `entity_statement_ttl_seconds` | Lifetime of a newly issued Entity Configuration. Values below 60 are raised to 60. | `3600` | No |
| `resolver_strategy` | Required trust topology: `direct`, `federation_chain` or `federation_resolver`. The generated template suggests `direct`, but runtime configuration has no fallback when the field is absent. | `None` | Yes |
| `authority_hints` | Federation entity IDs for immediate superiors. Required by topologies and registration policies that use them. | `[]` | No |
| `trust_anchor` | Pinned trust root containing `entity_id`, public `jwks` and the endpoint required by the resolver strategy. | `{}` | true* |
| `required_trust_marks` | Trust marks that the selected OP must present and that Access must verify. | `[]` | No |
| `oidc_rp_authenticator` | Access resource ID of the `OIDCRP` that supplies the published `openid_relying_party` metadata. | `""` | true** |
| `rp_metadata_profile` | Effective RP metadata and protocol profile: `generic` or `sweden_connect`. | `"generic"` | No |
| `metadata` | Advanced static entity metadata. Do not duplicate the linked RP role here. | `{}` | No |
| `explicit_registration_request_ttl_seconds` | Positive lifetime of an explicit-registration request Entity Configuration. | `60` | No |
| `explicit_registration_renewal_lead_seconds` | Non-negative interval before effective expiry when Access attempts renewal. | `60` | No |
| `explicit_registration_store` | Persistent store for OP-assigned client credentials, used only by `federation_client_registration_type: explicit`. Automatic and pre-registered clients do not use it. | `file` store template | true*** |

<p><em>* mandatory when the entity resolves an OP<br>** mandatory when the entity publishes a linked RP role<br>*** mandatory when the linked RP uses explicit registration</em></p>

For direct JSON configuration, provide a working federation signing key through `sign_ref` or the legacy `keystore` fields. For Management Center, use the generated `sign_ref` key; the legacy fields are not accepted by its editor. Federation signing keys sign the Entity Configuration and are distinct from the OIDC RP's `private_key_jwt` keys.

### Trust Anchor

| Name | Description | Default | Mandatory |
| --- | --- | --- | --- |
| `trust_anchor.entity_id` | Public HTTPS entity ID of the Trust Anchor. | `""` | Yes |
| `trust_anchor.jwks` | Pinned public Federation Entity Keys for the Trust Anchor. The key set must not be empty. | `{}` | Yes |
| `trust_anchor.federation_fetch_endpoint` | Absolute HTTPS fetch endpoint. | `""` | true* |
| `trust_anchor.federation_resolve_endpoint` | Absolute HTTPS resolver endpoint. | `""` | true** |

<p><em>* mandatory with <code>direct</code> and <code>federation_chain</code><br>** mandatory with <code>federation_resolver</code></em></p>

### Required trust marks

Each array entry in `required_trust_marks` has this shape:

```json
{
  "type": "https://federation.example/trust-marks/approved-op",
  "issuer_entity_id": "https://accreditation.example",
  "require_status": true
}
```

| Name | Description | Default | Mandatory |
| --- | --- | --- | --- |
| `type` | Trust-mark identifier required on the OP. | `""` | Yes |
| `issuer_entity_id` | Federation entity ID of the accepted trust-mark issuer. Access resolves the issuer to the same Trust Anchor. | `""` | Yes |
| `require_status` | Require a signed active response from the issuer's verified trust-mark status endpoint. | `false` | No |

`required_trust_marks` can also be used with `resolver_strategy: federation_resolver`. Access resolves and verifies each configured trust-mark issuer through the Trust Anchor before accepting the OP.

## Federated OIDC RP

:::note
**Authenticator type:** `OIDCRP`
:::

| Name | Description | Default | Mandatory |
| --- | --- | --- | --- |
| `provider_discovery_mode` | `openid_connect` for ordinary discovery or `openid_federation` for verified federation resolution. | `"openid_connect"` | true* |
| `federation_entity_id` | Public entity ID of the linked Access federation entity. This is not the module resource ID. | `""` | true* |
| `federation_op_entity_id` | Public entity ID of the OP that the RP will call. | `""` | true* |
| `federation_client_registration_type` | `pre_registered`, `automatic` or `explicit`. | `None` | true* |
| `token_endpoint_auth_method` | `auto`, `private_key_jwt`, `client_secret_post` or `client_secret_basic`. Automatic registration requires `private_key_jwt`; explicit registration requires an explicit non-`auto` value. | `"auto"` | true** |
| `private_key_jwt` | RP protocol-signing key configuration for client assertions and published RP JWKS. Management Center generates `private_key_jwt.sign_ref` on save when the linked federated RP uses `private_key_jwt` and has no key yet. | `{}` | true*** |
| `client_id` | OP-issued client identifier for `pre_registered`. Automatic registration uses the RP Entity ID instead; explicit registration uses credentials obtained from the OP. | `""` | true for pre-registered clients |
| `client_secret` | OP-issued secret for pre-registered clients using `client_secret_post` or `client_secret_basic`. Not used for automatic registration. | `""` | true with secret-based pre-registration |
| `private_key_jwt_assertion_ttl_seconds` | Lifetime of each client assertion. | `60` | No |
| `federation_request_object_ttl_seconds` | Positive lifetime of the signed authorization Request Object used by automatic registration. | `60` | No |
| `rp_metadata` | Publishable presentation and federation-extension metadata. Runtime protocol fields are derived and cannot be overridden; required fields depend on the selected profile. | `{}` | No |
| `redirect_uri` | HTTPS callback URI published in RP metadata and used by the authorization code flow. | `""` | true* |
| `response_type` | The federated Auth Code RP currently supports exactly `code`. | `"code"` | No |
| `internal_http_destination` | Named `HttpClient` destination for OP protocol calls. Management Center selects an existing client when the OIDC RP is created. Use the same network and WebPKI policy as the federation entity unless the deployment requires deliberate separation. | `"oidcrp_httpclient"` in the Access runtime template | Yes |

<p><em>* mandatory when configuring the authenticator for OpenID Federation<br>** mandatory with automatic or explicit registration; pre-registered clients may use the existing <code>auto</code> behavior<br>*** mandatory when the effective token endpoint authentication method is <code>private_key_jwt</code></em></p>

Published RP metadata is derived from the authenticator. It includes `client_id`, `redirect_uris`, `response_types`, `grant_types`, `token_endpoint_auth_method` and public `jwks`; the `client_id` configuration field in the table above applies only to pre-registered clients. Values such as `client_secret`, private JWK parameters and `null` values are rejected in `rp_metadata`.

## Response encryption

| Name | Description | Default | Mandatory |
| --- | --- | --- | --- |
| `id_token_encrypted_response_alg` | Expected ID-token JWE key-management algorithm: `RSA-OAEP` or `RSA-OAEP-256`. | `""` | true* |
| `id_token_encrypted_response_enc` | Expected ID-token content encryption: `A128GCM`, `A192GCM` or `A256GCM`. | `""` | true* |
| `userinfo_encrypted_response_alg` | Expected UserInfo JWE key-management algorithm. | `""` | true* |
| `userinfo_encrypted_response_enc` | Expected UserInfo content-encryption algorithm. | `""` | true* |
| `encryption_ref` | One or more RP response-decryption keystores. Their public keys are added to the RP JWKS with `use: enc`. | `[]` | true** |

<p><em>* mandatory as a complete <code>alg</code>/<code>enc</code> pair for each enabled response type<br>** mandatory when either response-encryption pair is configured</em></p>

Example:

```json
{
  "id_token_encrypted_response_alg": "RSA-OAEP",
  "id_token_encrypted_response_enc": "A256GCM",
  "userinfo_encrypted_response_alg": "RSA-OAEP",
  "userinfo_encrypted_response_enc": "A256GCM",
  "encryption_ref": [
    {
      "keystore": {
        "type": "PKCS12",
        "path": "${system.customer_home}/resources/oidcf/rp-response-encryption.p12",
        "password": "${secrets.oidcf_encryption_keystore_password}",
        "key_password": "${secrets.oidcf_encryption_key_password}",
        "alias": "rp-response-encryption"
      }
    }
  ]
}
```

## Key rotation

Add the new key next to the old key in the relevant `sign_ref`, `private_key_jwt.sign_ref` or `encryption_ref` list. Every public key must have a distinct `kid`.

Publish a new federation signing key for at least one full `entity_statement_ttl_seconds` before it becomes active. Keep old public keys available while a valid Entity Statement, Request Object, client assertion or encrypted response can still refer to them. A pinned Trust Anchor root-key change requires a controlled configuration update; automatic Trust Anchor bootstrap and rollover are not currently implemented.

## Invalid combinations

Access fails closed at configuration or use time for combinations including:

* federation mode without `federation_entity_id`, `federation_op_entity_id` or an explicit registration type
* federation mode with `response_type` other than exactly `code`
* automatic registration without `private_key_jwt`
* explicit registration with `token_endpoint_auth_method: auto`
* secret-based pre-registration without `client_secret`
* a response-encryption `alg` without its matching `enc`, or vice versa
* `encryption_ref` without an encrypted response type
* inline `federation_trust_anchor` on the RP
* a resolver endpoint or fetch endpoint that is not absolute HTTPS
* an unknown resolver strategy, RP profile, store type or database product

See [Set up a federated RP in Management Center](/products/access/next/authenticators/protocol-managers/oidc/openid-federation-management-center/) for the UI workflow, [OpenID Federation RP](/products/access/next/authenticators/protocol-managers/oidc/openid-federation-rp/) for direct JSON configuration and [Explicit registration and clustering](/products/access/next/authenticators/protocol-managers/oidc/openid-federation-explicit-registration/) for store-specific settings.