Configuration reference

This reference lists the settings that are specific to Access as an OIDC RP in OpenID Federation. Start with Set up a federated RP in Management Center for the UI workflow. Common authenticator settings and ordinary OIDC RP behavior are documented on OIDC Relying Party.

The paths below are relative to each resource's config object. Values in the Default column describe Access runtime behavior unless a Management Center template is mentioned explicitly. A named HTTP listener or client is only usable if that resource actually exists in the deployment.

Management Center field map

Resource and tab	UI field	Configuration path
Federation Entity · Overview	Entity ID	entity_id
Federation Entity · Relying party	OIDCRP authenticator	oidc_rp_authenticator
Federation Entity · Relying party	RP metadata profile	rp_metadata_profile
Federation Entity · Federation trust	Trust chain resolution method	resolver_strategy
Federation Entity · Federation trust	Authority hints	authority_hints
Federation Entity · Federation trust	Trust anchor	trust_anchor
Federation Entity · Federation trust	Required OP trust marks	required_trust_marks
Federation Entity · Signing	Federation signing keys	sign_ref
Federation Entity · Signing	Entity Configuration lifetime (seconds)	entity_statement_ttl_seconds
Federation Entity · Advanced	HTTP listener / Outbound HTTP client	http_listener / internal_http_destination
Federation Entity · Advanced	Registration store	explicit_registration_store
OIDC RP · Overview	Provider discovery	provider_discovery_mode
OIDC RP · Provider & registration	Federation Entity / OP Entity ID / Client registration	federation_entity_id / federation_op_entity_id / federation_client_registration_type
OIDC RP · Request & authentication	Token endpoint authentication / Client authentication signing keys	token_endpoint_auth_method / private_key_jwt.sign_ref
OIDC RP · Advanced	Outbound HTTP client	internal_http_destination

The two entity references use different identifiers: federation_entity_id on the OIDC RP stores the Federation Entity's public Entity ID; oidc_rp_authenticator on the Federation Entity stores the authenticator's Access resource ID. Management Center synchronizes these references when the OIDC RP is saved.

The trust-chain selector maps One-hop trust chain to direct, Bottom-up trust chain resolution to federation_chain, and Single point of trust resolution to federation_resolver. Choose the method that matches the federation's topology; the generated direct value is only a starting value.

Federation entity module

Note

Module name: OIDCFederationEntityModule

Name	Description	Default	Mandatory
entity_id	Public HTTPS identifier for the Access federation entity. The Entity Configuration route is derived from its path.	""
http_listener	Named Access HTTP listener that publishes the Entity Configuration.	"default"
http_context	Listener context used when attaching the public route.	"/"
internal_http_destination	Named HttpClient destination used for federation fetch, resolve, trust-mark status and explicit-registration calls. Management Center's generated template uses "default"; select an existing client.	"oidcrp_httpclient" at runtime
sign_ref	Federation signing key references. Management Center generates the first key when it creates the entity; include overlapping entries during rotation.	[] at runtime	true for managed entities
keystore	Legacy single federation-signing keystore supported by Access runtime for existing direct JSON configurations. Management Center rejects this field; use sign_ref in managed configuration.	{}
sign_jwt_keystore_alias	Alias for a legacy direct-JSON single-key configuration.	""
sign_jwt_keystore_password	Private-key password for a legacy direct-JSON single-key configuration.	""
entity_statement_ttl_seconds	Lifetime of a newly issued Entity Configuration. Values below 60 are raised to 60.	3600
resolver_strategy	Required trust topology: direct, federation_chain or federation_resolver. The generated template suggests direct, but runtime configuration has no fallback when the field is absent.	None
authority_hints	Federation entity IDs for immediate superiors. Required by topologies and registration policies that use them.	[]
trust_anchor	Pinned trust root containing entity_id, public jwks and the endpoint required by the resolver strategy.	{}	true*
required_trust_marks	Trust marks that the selected OP must present and that Access must verify.	[]
oidc_rp_authenticator	Access resource ID of the OIDCRP that supplies the published openid_relying_party metadata.	""	true**
rp_metadata_profile	Effective RP metadata and protocol profile: generic or sweden_connect.	"generic"
metadata	Advanced static entity metadata. Do not duplicate the linked RP role here.	{}
explicit_registration_request_ttl_seconds	Positive lifetime of an explicit-registration request Entity Configuration.	60
explicit_registration_renewal_lead_seconds	Non-negative interval before effective expiry when Access attempts renewal.	60
explicit_registration_store	Persistent store for OP-assigned client credentials, used only by federation_client_registration_type: explicit. Automatic and pre-registered clients do not use it.	file store template	true***

* mandatory when the entity resolves an OP
** mandatory when the entity publishes a linked RP role
*** mandatory when the linked RP uses explicit registration

For direct JSON configuration, provide a working federation signing key through sign_ref or the legacy keystore fields. For Management Center, use the generated sign_ref key; the legacy fields are not accepted by its editor. Federation signing keys sign the Entity Configuration and are distinct from the OIDC RP's private_key_jwt keys.

Trust Anchor

Name	Description	Default	Mandatory
trust_anchor.entity_id	Public HTTPS entity ID of the Trust Anchor.	""
trust_anchor.jwks	Pinned public Federation Entity Keys for the Trust Anchor. The key set must not be empty.	{}
trust_anchor.federation_fetch_endpoint	Absolute HTTPS fetch endpoint.	""	true*
trust_anchor.federation_resolve_endpoint	Absolute HTTPS resolver endpoint.	""	true**

* mandatory with direct and federation_chain
** mandatory with federation_resolver

Required trust marks

Each array entry in required_trust_marks has this shape:

{
  "type": "https://federation.example/trust-marks/approved-op",
  "issuer_entity_id": "https://accreditation.example",
  "require_status": true
}

Name	Description	Default	Mandatory
type	Trust-mark identifier required on the OP.	""
issuer_entity_id	Federation entity ID of the accepted trust-mark issuer. Access resolves the issuer to the same Trust Anchor.	""
require_status	Require a signed active response from the issuer's verified trust-mark status endpoint.	false

required_trust_marks can also be used with resolver_strategy: federation_resolver. Access resolves and verifies each configured trust-mark issuer through the Trust Anchor before accepting the OP.

Federated OIDC RP

Note

Authenticator type: OIDCRP

Name	Description	Default	Mandatory
provider_discovery_mode	openid_connect for ordinary discovery or openid_federation for verified federation resolution.	"openid_connect"	true*
federation_entity_id	Public entity ID of the linked Access federation entity. This is not the module resource ID.	""	true*
federation_op_entity_id	Public entity ID of the OP that the RP will call.	""	true*
federation_client_registration_type	pre_registered, automatic or explicit.	None	true*
token_endpoint_auth_method	auto, private_key_jwt, client_secret_post or client_secret_basic. Automatic registration requires private_key_jwt; explicit registration requires an explicit non-auto value.	"auto"	true**
private_key_jwt	RP protocol-signing key configuration for client assertions and published RP JWKS. Management Center generates private_key_jwt.sign_ref on save when the linked federated RP uses private_key_jwt and has no key yet.	{}	true***
client_id	OP-issued client identifier for pre_registered. Automatic registration uses the RP Entity ID instead; explicit registration uses credentials obtained from the OP.	""	true for pre-registered clients
client_secret	OP-issued secret for pre-registered clients using client_secret_post or client_secret_basic. Not used for automatic registration.	""	true with secret-based pre-registration
private_key_jwt_assertion_ttl_seconds	Lifetime of each client assertion.	60
federation_request_object_ttl_seconds	Positive lifetime of the signed authorization Request Object used by automatic registration.	60
rp_metadata	Publishable presentation and federation-extension metadata. Runtime protocol fields are derived and cannot be overridden; required fields depend on the selected profile.	{}
redirect_uri	HTTPS callback URI published in RP metadata and used by the authorization code flow.	""	true*
response_type	The federated Auth Code RP currently supports exactly code.	"code"
internal_http_destination	Named HttpClient destination for OP protocol calls. Management Center selects an existing client when the OIDC RP is created. Use the same network and WebPKI policy as the federation entity unless the deployment requires deliberate separation.	"oidcrp_httpclient" in the Access runtime template

* mandatory when configuring the authenticator for OpenID Federation
** mandatory with automatic or explicit registration; pre-registered clients may use the existing auto behavior
*** mandatory when the effective token endpoint authentication method is private_key_jwt

Published RP metadata is derived from the authenticator. It includes client_id, redirect_uris, response_types, grant_types, token_endpoint_auth_method and public jwks; the client_id configuration field in the table above applies only to pre-registered clients. Values such as client_secret, private JWK parameters and null values are rejected in rp_metadata.

Response encryption

Name	Description	Default	Mandatory
id_token_encrypted_response_alg	Expected ID-token JWE key-management algorithm: RSA-OAEP or RSA-OAEP-256.	""	true*
id_token_encrypted_response_enc	Expected ID-token content encryption: A128GCM, A192GCM or A256GCM.	""	true*
userinfo_encrypted_response_alg	Expected UserInfo JWE key-management algorithm.	""	true*
userinfo_encrypted_response_enc	Expected UserInfo content-encryption algorithm.	""	true*
encryption_ref	One or more RP response-decryption keystores. Their public keys are added to the RP JWKS with use: enc.	[]	true**

* mandatory as a complete alg/enc pair for each enabled response type
** mandatory when either response-encryption pair is configured

Example:

{
  "id_token_encrypted_response_alg": "RSA-OAEP",
  "id_token_encrypted_response_enc": "A256GCM",
  "userinfo_encrypted_response_alg": "RSA-OAEP",
  "userinfo_encrypted_response_enc": "A256GCM",
  "encryption_ref": [
    {
      "keystore": {
        "type": "PKCS12",
        "path": "${system.customer_home}/resources/oidcf/rp-response-encryption.p12",
        "password": "${secrets.oidcf_encryption_keystore_password}",
        "key_password": "${secrets.oidcf_encryption_key_password}",
        "alias": "rp-response-encryption"
      }
    }
  ]
}

Key rotation

Add the new key next to the old key in the relevant sign_ref, private_key_jwt.sign_ref or encryption_ref list. Every public key must have a distinct kid.

Publish a new federation signing key for at least one full entity_statement_ttl_seconds before it becomes active. Keep old public keys available while a valid Entity Statement, Request Object, client assertion or encrypted response can still refer to them. A pinned Trust Anchor root-key change requires a controlled configuration update; automatic Trust Anchor bootstrap and rollover are not currently implemented.

Invalid combinations

Access fails closed at configuration or use time for combinations including:

• federation mode without federation_entity_id, federation_op_entity_id or an explicit registration type
• federation mode with response_type other than exactly code
• automatic registration without private_key_jwt
• explicit registration with token_endpoint_auth_method: auto
• secret-based pre-registration without client_secret
• a response-encryption alg without its matching enc, or vice versa
• encryption_ref without an encrypted response type
• inline federation_trust_anchor on the RP
• a resolver endpoint or fetch endpoint that is not absolute HTTPS
• an unknown resolver strategy, RP profile, store type or database product

See Set up a federated RP in Management Center for the UI workflow, OpenID Federation RP for direct JSON configuration and Explicit registration and clustering for store-specific settings.