oidc-provider
Create or update a provider
This endpoint creates or updates a Provider.
Method | Path |
---|---|
POST | identity/oidc/provider/:name |
Parameters
name
(string: <required>)
– The name of the provider. This parameter is specified as part of the URL.issuer
(string: <optional>)
- Specifies what will be used as thescheme://host:port
component for theiss
claim of ID tokens. This defaults to a URL with Vault'sapi_addr
as thescheme://host:port
component and/v1/:namespace/identity/oidc/provider/:name
as the path component. If provided explicitly, it must point to a Vault instance that is network reachable by clients for ID token validation.allowed_client_ids
([]string: <optional>)
– The client IDs that are permitted to use the provider. If empty, no clients are allowed. If"*"
is provided, all clients are allowed.scopes_supported
([]string: <optional>)
– The scopes available for requesting on the provider.
Sample payload
Sample request
Read provider by name
This endpoint queries the OIDC provider by its name.
Method | Path |
---|---|
GET | /identity/oidc/provider/:name |
Parameters
name
(string: <required>)
– The name of the provider.
Sample request
Sample response
List providers
This endpoint returns a list of all OIDC providers.
Method | Path |
---|---|
LIST | /identity/oidc/provider |
Query parameters
allowed_client_id
(string: <optional>)
– Filters the list of OIDC providers to those that allow the given client ID in their set of allowed_client_ids.
Sample request
Sample response
Delete provider by name
This endpoint deletes an OIDC provider.
Method | Path |
---|---|
DELETE | /identity/oidc/provider/:name |
Parameters
name
(string: <required>)
– The name of the provider.
Sample request
Create or update a scope
This endpoint creates or updates a scope.
Method | Path |
---|---|
POST | identity/oidc/scope/:name |
Parameters
name
(string: <required>)
– The name of the scope. This parameter is specified as part of the URL. Theopenid
scope name is reserved.template
(string: <optional>)
- The JSON template string for the scope. This may be provided as escaped JSON or base64 encoded JSON.description
(string: <optional>)
– A description of the scope.
Sample payload
Sample request
Read scope by name
This endpoint queries a scope by its name.
Method | Path |
---|---|
GET | /identity/oidc/scope/:name |
Parameters
name
(string: <required>)
– The name of the scope.
Sample request
Sample response
List scopes
This endpoint returns a list of all configured scopes.
Method | Path |
---|---|
LIST | /identity/oidc/scope |
Sample request
Sample response
Delete scope by name
This endpoint deletes a scope.
Method | Path |
---|---|
DELETE | /identity/oidc/scope/:name |
Parameters
name
(string: <required>)
– The name of the scope.
Sample request
Create or update a client
This endpoint creates or updates a client.
Method | Path |
---|---|
POST | identity/oidc/client/:name |
Parameters
name
(string: <required>)
– The name of the client. This parameter is specified as part of the URL.key
(string: "default")
– A reference to a named key resource. This key will be used to sign ID tokens for the client. This cannot be modified after creation. If not supplied, defaults to the built-in default key.redirect_uris
([]string: <optional>)
- Redirection URI values used by the client. One of these values must exactly match theredirect_uri
parameter value used in each authentication request.assignments
([]string: <optional>)
– A list of assignment resources associated with the client. Client assignments limit the Vault entities and groups that are allowed to authenticate through the client. By default, no Vault entities are allowed. To allow all Vault entities to authenticate through the client, supply the built-in allow_all assignment.client_type
(string: "confidential")
– The client type based on its ability to maintain confidentiality of credentials. This cannot be modified after creation. The following list details the differences between confidential and public clients in Vault:confidential
- Capable of maintaining the confidentiality of its credentials
- Has a client secret
- Uses the
client_secret_basic
orclient_secret_post
client authentication method - May use Proof Key for Code Exchange (PKCE) for the authorization code flow
public
- Not capable of maintaining the confidentiality of its credentials
- Does not have a client secret
- Uses the
none
client authentication method - Must use Proof Key for Code Exchange (PKCE) for the authorization code flow
id_token_ttl
(int or duration: "24h")
– The time-to-live for ID tokens obtained by the client. Accepts duration format strings. The value should be less than theverification_ttl
on the key.access_token_ttl
(int or duration: "24h")
– The time-to-live for access tokens obtained by the client. Accepts duration format strings.
Sample payload
Sample request
Read client by name
This endpoint queries a client by its name.
Method | Path |
---|---|
GET | /identity/oidc/client/:name |
Parameters
name
(string: <required>)
– The name of the client.
Sample request
Sample response
List clients
This endpoint returns a list of all configured clients.
Method | Path |
---|---|
LIST | /identity/oidc/client |
Sample request
Sample response
Delete client by name
This endpoint deletes a client.
Method | Path |
---|---|
DELETE | /identity/oidc/client/:name |
Parameters
name
(string: <required>)
– The name of the client.
Sample request
Create or update an assignment
This endpoint creates or updates an assignment.
Method | Path |
---|---|
POST | identity/oidc/assignment/:name |
Parameters
name
(string: <required>)
– The name of the assignment. This parameter is specified as part of the URL.entity_ids
([]string: <optional>)
- A list of Vault entity IDs.group_ids
([]string: <optional>)
– A list of Vault group IDs.
Sample payload
Sample request
Read assignment by name
This endpoint queries an assignment by its name.
Method | Path |
---|---|
GET | /identity/oidc/assignment/:name |
Parameters
name
(string: <required>)
– The name of the assignment.
Sample request
Sample response
List assignments
This endpoint returns a list of all configured assignments.
Method | Path |
---|---|
LIST | /identity/oidc/assignment |
Sample request
Sample response
Delete assignment by name
This endpoint deletes an assignment.
Method | Path |
---|---|
DELETE | /identity/oidc/assignment/:name |
Parameters
name
(string: <required>)
– The name of the assignment.
Sample request
Read provider OpenID configuration
Returns OpenID Connect Metadata for a named OIDC provider. The response is a compliant OpenID Provider Configuration Response.
Method | Path |
---|---|
GET | /identity/oidc/provider/:name/.well-known/openid-configuration |
Parameters
name
(string: <required>)
– The name of the provider. This parameter is specified as part of the URL.
Sample request
Sample response
Read provider public keys
Query this path to retrieve the public portion of keys for an OIDC provider. Clients can use them to validate the authenticity of an identity token.
Method | Path |
---|---|
GET | /identity/oidc/provider/:name/.well-known/keys |
Parameters
name
(string: <required>)
– The name of the provider. This parameter is specified as part of the URL.
Sample request
Sample response
Authorization endpoint
Provides the Authorization Endpoint for an OIDC provider. This allows OIDC clients to request an authorization code to be used for the Authorization Code Flow.
Method | Path |
---|---|
GET/POST | /identity/oidc/provider/:name/authorize |
Parameters
name
(string: <required>)
- The name of the provider. This parameter is specified as part of the URL.scope
(string: <required>)
- A space-delimited list of scopes to be requested. Theopenid
scope is required.response_type
(string: <required>)
- The OIDC authentication flow to be used. The following response types are supported:code
.client_id
(string: <required>)
- The ID of the requesting client.redirect_uri
(string: <required>)
- The redirection URI to which the response will be sent.state
(string: <optional>)
- A value used to maintain state between the authentication request and client.nonce
(string: <optional>)
- A value that is returned in the ID token nonce claim. It is used to mitigate replay attacks, so we strongly encourage providing this optional parameter.max_age
(integer: <optional>)
- The allowable elapsed time in seconds since the last time the end-user was actively authenticated.code_challenge
(string: <optional>)
- The PKCE code challenge derived from the client's code verifier. Optional forconfidential
clients. Required forpublic
clients.code_challenge_method
(string: "plain")
- The method that was used to derive the PKCE code challenge. The following methods are supported:S256
,plain
.
Sample request
Sample response
Token endpoint
Provides the Token Endpoint for an OIDC provider.
Method | Path |
---|---|
POST | /identity/oidc/provider/:name/token |
Parameters
name
(string: <required>)
- The name of the provider. This parameter is specified as part of the URL.code
(string: <required>)
- The authorization code received from the provider's authorization endpoint.grant_type
(string: <required>)
- The authorization grant type. The following grant types are supported:authorization_code
.redirect_uri
(string: <required>)
- The callback location where the authorization request was sent. This must match theredirect_uri
used when the original authorization code was generated.client_id
(string: <optional>)
- The ID of the requesting client. This parameter is required forpublic
clients which do not have a client secret orconfidential
clients using theclient_secret_post
client authentication method.client_secret
(string: <optional>)
- The secret of the requesting client. This parameter is required forconfidential
clients using theclient_secret_post
client authentication method.code_verifier
(string: <optional>)
- The code verifier associated with the givencode
. Required for authorization codes that were granted using PKCE. Required forpublic
clients.
Headers
Authorization: Basic
(string: <optional>)
- An HTTP Basic authentication scheme header including theclient_id
andclient_secret
as described in the client_secret_basic authentication method. This header is only required forconfidential
clients using theclient_secret_basic
client authentication method.
Sample request
Sample response
UserInfo endpoint
Provides the UserInfo Endpoint for an OIDC provider. The UserInfo Endpoint is an OAuth 2.0 Protected Resource that returns Claims about the authenticated End-User.
Method | Path |
---|---|
POST | /identity/oidc/provider/:name/userinfo |
Parameters
name
(string: <required>)
- The name of the provider. This parameter is specified as part of the URL.
Headers
- Access Token
(string: <required>)
- The access token provided by theAuthorization: Bearer <access_token>
HTTP header acquired from the authorization endpoint.
Sample request
Sample response