OpenID Provider Configuration

You can configure AM's OAuth 2.0 provider service to double as an OpenID provider service.

To configure the OAuth 2.0 provider, follow the steps in "To Configure the OAuth 2.0 Provider Service". When you are finished, see "Additional Configuration" for OpenID Connect-specific configuration.

Additional Configuration

The OpenID provider is highly configurable:

  • To access the OAuth 2.0 provider configuration in the AM console, go to Realms > Realm Name > Services, and then select OAuth2 Provider.

  • To adjust global defaults, in the AM console, go to Configure > Global Services, and then click OAuth2 Provider.

See the "OAuth2 Provider" reference section for details on each of the fields in the provider.

OpenID Connect Configuration Options

Configure the public keys for the provider

OpenID providers sign ID tokens so that clients can ensure their authenticity. AM exposes the URI where clients can check the signing public keys to verify the ID token signatures.

By default, AM exposes an internal endpoint with keys, but you can configure the URI of your secrets API instead.


Enable the OpenID Connect Discovery Endpoint

The discovery endpoint is disabled by default when you configure the OAuth 2.0 provider. Enable the endpoint if your clients need to discover the URL of the provider for a given user.

"OpenID Connect Discovery"

Configure pairwise subject types for dynamic registration

To provide different values to the sub claim in the ID token for different clients (see Subject Identifier Types), configure the Subject Types Supported map.

Also, ensure that the value of the Subject Identifier Hash Salt field is different from changeme.


Configure whether AM must return scope-derived claims in the ID token

Scope-derived claims, such as those returned when requesting the profile scope, are not returned in the ID token by default.


Configure how AM maps scopes to claims and user profile attributes

AM lets you map different user profile attributes to claims and scopes by using the AM scripting engine.


Configure the OpenID provider for discovery and dynamic client registration/management

AM supports several methods of dynamic registration that offer different security measures.

You can also register the clients manually.

"OpenID Connect Discovery"

Add authentication requirements to the ID Tokens

Require the end users to satisfy different authentication rules or conditions when authenticating to the OpenID provider, such as using a specific authentication tree.

Adding Authentication Requirements to ID Tokens

Configure AM as part of a GSMA Mobile Connect deployment

Configure the OAuth 2.0 authorization server to double as a Mobile Connect provider.

"To Configure AM for Mobile Connect"

Configure the OpenID provider to encrypt ID tokens

ID tokens are only signed by default. Consider encryption to protect them if they carry sensitive information about your end users.

"Encrypting OpenID Connect ID Tokens"

Configure the methods and algorithms available for signed or encrypted JWTs in the request parameter

If your clients send request parameters to the authorization endpoint as a JWT instead of as HTTP parameters, configure the Request parameter signing algorithm field in the OpenID provider.

Note that the alias mapped to the encryption algorithms are defined in the secret stores.

Secret ID Mappings for Decrypting OpenID Connect Request Parameters

Read a different version of :