Client configuration reference

Whether the provider is enabled.

The attribute the social identity provider uses to identify an authenticated individual. For example, id, sub, and user_id.

The client_id parameter as described in section 2.2 of The OAuth 2.0 Authorization Framework specification.

The client_secret parameter as described in section 2.3 of The OAuth 2.0 Authorization Framework specification.

An identifier used to create a secret label for mapping to a secret in a secret store.

The URL to the social provider’s endpoint handling authentication as described in section 3.1 of The OAuth 2.0 Authorization Framework. For example, https://accounts.google.com/oauth2/v2/auth.

The URL to the endpoint handling access tokens as described in section 3.2 of The OAuth 2.0 Authorization Framework specification. For example, https://www.googleapis.com/oauth2/v4/token.

The user profile URL that returns profile information. For example, https://www.googleapis.com/oauth2/v3/userinfo.

The URL to the endpoint handling access token validation, as described in the OAuth 2.0 Token Introspection specification. For example, https://oauth2.googleapis.com/tokeninfo.

The URL to which the identity provider will redirect the user after authenticating, as described in Section 3.1.2 of The OAuth 2.0 Authorization Framework specification.

The URL of a custom login page or application. Advanced Identity Cloud will send processed form post data related to social login authentication to that URL as the value of the form_post_entry query parameter.

The delimiter used to separate scope values. For example, a blank space (), or a comma character (,).

The list of scopes to request from the provider.

How the client should authenticate to the provider. Possible values are:

Specifies the PKCE transformation method PingOne Advanced Identity Cloud uses when making requests to the provider’s authorization endpoint, as specified in Section 4.2 of the Proof Key for Code Exchange by OAuth Public Clients specification.

(OIDC providers only) Specifies whether PingOne Advanced Identity Cloud should provide a request object JWT to the provider. Possible values are:

Specifies whether the request parameter must be encrypted when Request Parameter JWT Option is set to REFERENCE or VALUE.

(OIDC providers only) A space-separated list, in order of preference, of the client’s acr values.

(OIDC providers only) The URL for retrieving information about the provider, such as endpoints, and public keys. For example, https://accounts.google.com/.well-known/openid-configuration.

(OIDC providers only) The intended audience (aud) of the request object when the Request Parameter JWT Option field is set to VALUE or REFERENCE.

(OIDC providers only) Whether the provider encrypts ID Tokens.

(OIDC providers only) The issuer of ID Tokens.

(OIDC providers only) When enabled, the provider native SDK must include a nonce claim in the ID token. The value of the claim must be the value of the nonce claim sent in the Authentication Request.

(OIDC providers only) The format in which the provider’s userinfo endpoint returns data.

The URI that contains the public keys of the identity provider. PingOne Advanced Identity Cloud will use these keys to verify signatures or to encrypt objects.

Any claims on the request object, in JSON format. These claims must conform to the claims request parameter, as defined in the OpenID Connect specification.

The signing algorithm supported by the provider that Advanced Identity Cloud uses to sign the following:

The encryption algorithm supported by the provider that PingOne Advanced Identity Cloud should use to encrypt client authentication JWTs when Client Authentication Method is set to PRIVATE_KEY_JWT, and (OIDC providers only) request JWTs when Request Parameter JWT Option is set to VALUE or REFERENCE.

The encryption algorithm supported by the provider that PingOne Advanced Identity Cloud should use to encrypt the following:

Specifies the amount of time, in seconds, that PingOne Advanced Identity Cloud will cache the client authentication JWT before creating a new one.

(OIDC providers only) Specify the way the provider will return ID tokens to PingOne Advanced Identity Cloud. Possible values are:

Specify one or more options to be used by the TLS certificate revocation checking mechanism.

Specifies whether a custom truststore is used to verify the server certificate of the .well-known endpoint or JWKs URI of an OpenID provider (OP) in a TLS handshake.

(Apple SSO) When enabled, this flag indicates that the native app can send the user’s userinfo in JSON format.

if (nodeState.get('nameEmptyOrNull')) {
  action.goTo("true");
} else {
  action.goTo("false");
}

var fr = JavaImporter(org.forgerock.openam.auth.node.api.Action);

if (nodeState.get('nameEmptyOrNull')) {
  action = fr.Action.goTo("true").build();
} else {
action = fr.Action.goTo("false").build();
}

Specifies a map of properties defined and consumed in the UI. The map affects how the identity provider’s logo will show on the login page.

A script to convert the provider’s raw profile object into a normalized object.

(function () {
    var frJava = JavaImporter(
        org.forgerock.json.JsonValue
    );

    var normalizedProfileData = frJava.JsonValue.json(frJava.JsonValue.object());

    normalizedProfileData.put('id', rawProfile.get('sub'));
    normalizedProfileData.put('displayName', rawProfile.get('name'));
    normalizedProfileData.put('givenName', rawProfile.get('given_name'));
    normalizedProfileData.put('familyName', rawProfile.get('family_name'));
    normalizedProfileData.put('photoUrl', rawProfile.get('picture'));
    normalizedProfileData.put('email', rawProfile.get('email'));
    normalizedProfileData.put('username', rawProfile.get('email'));
    normalizedProfileData.put('locale', rawProfile.get('locale'));

    return normalizedProfileData;
}());

(OIDC providers only) Determines how the expected issuer value should match the actual value of the iss claim: