OIDC module

Acts as an OpenID Connect Provider.

On this page, you can manage the Back-Channel Endpoints.
The configuration of the Authorization Endpoint depends on the selected OIDC flow type:

For Authorization Code Flow, click LINK.
For Implicit Flow, click LINK.

Introduction

Can be configured in multiple instances allowing for multi tenancy.

Acts as an OpenID Connect provider. It acts as a controller mainly for issuing Json Web Tokens (JWT). Typically the configured authenticator is the first point of contact coming from an OpenID Connect Relying Party, requesting identification.

Fortified Integrity have achieved certifications for five OpenID Provider conformance profiles. Read more about these profiles here: https://openid.net/certification/

OpenID Connect Provider Configuration

Properties
Example

Name	Description	Default value	Mandatory
`http_context`	Base URI for the endpoints.	N/A	true
`http_port`	Port	N/A	true
`tenant_op_path`	A tenant specific path part of the endpoint URIs. Example: http://127.0.0.1:8080/oidc/tenant1/token-endpoint	N/A	true
`discovery_meta`	Discovery data presented at the OpenID Configuration endpoint.	N/A	true
`sign_ref`	List of OIDC signing keys used for overlapping key rotation. Recommended for new configurations.	N/A	false
`keystore`	Legacy single-key keystore configuration used for JWT signing and JWKS publication when `sign_ref` is not configured.	N/A	false
`rps`	List of relying parties. Must include at least one relying party.	N/A	true
`required_request_parameters`	Required request parameters for the token endpoint.	`["redirect_uri","code"]`	false
`code_verifier_hash_alg`	Hash algorithm used for Proof Key of Code Exchange (PKCE).	`"SHA-256"`	false
`enable_refresh_token`	Set to `true` if using refresh tokens.	`false`	false
`reuse_refresh_token`	Set to `true` when the OIDC RP does not support rotating refresh tokens.	`false`	false
`allow_userinfo_access_token_in_query`	Allows the UserInfo endpoint to accept `access_token` as a query parameter. This is disabled by default and should only be enabled for legacy clients that cannot send bearer tokens in the Authorization header.	`false`	false
`verbose`	Turns on deep OIDC TRACE logging for the back-channel endpoints when the dedicated logger category `fortifiedid.oidc.trace` is set to `TRACE`. Use for troubleshooting only.	`false`	false

{
      "name": "OIDCModule",
      "enabled": true,
      "config":{
        "providers":[
            {
              "http_context" : "/oidc",
              "http_port" : 8080,
              "discovery_meta" : {
                  "issuer" : "http://192.168.50.228:8080/oidc/tenant1",
                  "authorization_endpoint" : "http://192.168.50.228:8080/test/authn/oidc",
                  "token_endpoint" : "http://192.168.50.228:8080/oidc/tenant1/token-endpoint",
                  "userinfo_endpoint" : "http://192.168.50.228:8080/oidc/tenant1/userinfo-endpoint",
                  "introspection_endpoint" : "http://192.168.50.228:8080/oidc/tenant1/introspection-endpoint",
                  "jwks_uri" : "http://192.168.50.228:8080/oidc/tenant1/.well-known/openid-configuration/jwks",
                  "end_session_endpoint" : "http://192.168.50.228:8080/test/authn/oidc/logout",
                  "scopes_supported" : [ "openid" ],
                  "response_types_supported" : [ "code" ],
                  "grant_types_supported" : [ "authorization_code" ],
                  "subject_types_supported" : [ "public" ],
                  "id_token_signing_alg_values_supported" : [ "RS256" ],
                  "token_endpoint_auth_methods_supported" : [ "client_secret_post", "client_secret_basic" ],
                  "claims_supported" : [ "iss", "ver", "sub", "given_name", "family_name" ],
                  "request_parameter_supported" : true
              },
              "tenant_op_path" : "/tenant1",
              "sign_ref" : [
                    {
                      "keystore" : {
                            "path" : "/fortified_test/oidc-2026-q1.p12",
                            "password" : "secret",
                            "key_password" : "secret",
                            "alias" : "oidc-2026-q1",
                            "type" : "PKCS12"
                      }
                    }
              ],
              "rps" : [{
                    "client_id" : "provided",
                    "client_secret" : "provided",
                    "pipe_id":"optional_pipe_id",
                    "redirect_uri" : [ "https://auth.organisation.com/authenticate/oidcrp" ],
                    "post_logout_redirect_uris" : ["https://auth.organisation.com/authenticate/oidcrp/loggedout"]
              }]
        }]
      }
}

Deep TRACE logging

For difficult troubleshooting of OIDC OP flows, the OIDC module can produce a deep TRACE log for incoming requests and outgoing responses on the back-channel endpoints.

This trace is intended for short-lived diagnostics only. It logs raw OIDC values and does not redact tokens, authorization codes, client secrets, cookies, or other credentials.

What is covered

When enabled, the OIDC module logs detailed request/response data for OIDC OP endpoints such as:

OpenID Configuration
JWKS
Token endpoint
UserInfo endpoint
Introspection endpoint
Device Authorization endpoint

How to enable it

Both of the following must be true:

The dedicated logger category must be set to TRACE
The OIDC module instance must have verbose: true

Example Log4j configuration:

<AsyncLogger name="fortifiedid.oidc.trace" level="TRACE" />

Example OIDC module configuration:

{
  "name": "OIDCModule",
  "enabled": true,
  "config": {
    "verbose": true,
    "providers": [
      {
        "http_context": "/oidc",
        "http_port": 8080,
        "tenant_op_path": "/tenant1"
      }
    ]
  }
}

Authorization endpoint and logout tracing

If you also want deep TRACE logging for the authorization endpoint flow, redirects, and logout handling, set verbose: true on the OIDC Authorization Code Flow authenticator as well.

See Authorization Code Flow.