Client configuration reference

Whether the provider is enabled.

The attribute the social identity provider uses to identify an authenticated individual. For example, id, sub, and user_id.

The client_id parameter as described in section 2.2 of The OAuth 2.0 Authorization Framework specification.

The client_secret parameter as described in section 2.3 of The OAuth 2.0 Authorization Framework specification.

An identifier used to create a secret label for mapping to a secret in a secret store.

The URL to the social provider’s endpoint handling authentication as described in section 3.1 of The OAuth 2.0 Authorization Framework. For example, https://accounts.google.com/oauth2/v2/auth.

The URL to the endpoint handling access tokens as described in section 3.2 of The OAuth 2.0 Authorization Framework specification. For example, https://www.googleapis.com/oauth2/v4/token.

The user profile URL that returns profile information. For example, https://www.googleapis.com/oauth2/v3/userinfo.

The URL to the endpoint handling access token validation, as described in the OAuth 2.0 Token Introspection specification. For example, https://oauth2.googleapis.com/tokeninfo.

The URL the identity provider will redirect the user to after authenticating, as described in Section 3.1.2 of The OAuth 2.0 Authorization Framework specification.

The URL of a custom login page or application. AM will send processed form post data related to social login authentication to that URL as the value of the form_post_entry query parameter.

The delimiter used to separate scope values. For example, a blank space (), or a comma character (,).

The list of scopes to request from the provider.

Specifies how the client should authenticate to the provider. Possible values are:

The PKCE transformation method AM uses when making requests to the provider’s authorization endpoint, as specified in Section 4.2 of the Proof Key for Code Exchange by OAuth Public Clients specification.

(OpenID Connect providers only) Specifies whether AM should provide a request object JWT to the provider. Possible values are:

Specifies whether the request parameter must be encrypted when Request Parameter JWT Option is set to REFERENCE or VALUE.

(OpenID Connect providers only) Specifies a space-separated list, in order of preference, of the client’s acr values.

(OpenID Connect providers only) The URL for retrieving information about the provider, such as endpoints, and public keys. For example, https://accounts.google.com/.well-known/openid-configuration.

(OpenID Connect providers only) The intended audience (aud) of the request object when the Request Parameter JWT Option field is set to VALUE or REFERENCE.

(OpenID Connect providers only) Specifies whether the provider encrypts ID Tokens.

(OpenID Connect providers only) The issuer of ID Tokens.

(OpenID Connect providers only) When enabled, the provider native SDK must include a nonce claim in the ID token. The value of the claim must be the value of the nonce claim sent in the Authentication Request.

(OpenID Connect providers only) The format in which the provider’s userinfo endpoint returns data.

The URI that contains the public keys of the identity provider. AM will use these keys to verify signatures, or to encrypt objects.

Any claims on the request object, in JSON format. These claims must conform to the claims request parameter, as defined in the OpenID Connect specification.

The signing algorithm supported by the provider that AM use to sign the following:

The encryption algorithm supported by the provider that AM should use to encrypt client authentication JWTs when Client Authentication Method is set to PRIVATE_KEY_JWT, and (OpenID Connect providers only) request JWTs when Request Parameter JWT Option is set to VALUE or REFERENCE.

The encryption algorithm supported by the provider that AM should use to encrypt the following:

The amount of time, in seconds, that AM will cache the client authentication JWT before creating a new one.

(OpenID Connect providers only) Specify the way the provider will return ID tokens to AM. Possible values are:

Specify one or more options to be used by the TLS certificate revocation checking mechanism.

Specifies whether a custom truststore is used to verify the server certificate of the .well-known endpoint or JWKs URI of an OpenID provider (OP) in a TLS handshake.

(Apple SSO) When enabled, this flag indicates that the native app can send the user’s userinfo in JSON format.

if (nodeState.get('nameEmptyOrNull')) {
  action.goTo("true");
} else {
  action.goTo("false");
}

var fr = JavaImporter(org.forgerock.openam.auth.node.api.Action);

if (nodeState.get('nameEmptyOrNull')) {
  action = fr.Action.goTo("true").build();
} else {
action = fr.Action.goTo("false").build();
}

Specifies a map of properties defined and consumed in the UI. The map affects how the identity provider’s logo will show on the login page.

A script to convert the provider’s raw profile object into a normalized object.

import static org.forgerock.json.JsonValue.field
import static org.forgerock.json.JsonValue.json
import static org.forgerock.json.JsonValue.object

return json(object(
  field("id", rawProfile.sub),
  field("displayName", rawProfile.name),
  field("givenName", rawProfile.given_name),
  field("familyName", rawProfile.family_name),
  field("photoUrl", rawProfile.picture),
  field("email", rawProfile.email),
  field("username", rawProfile.email),
  field("locale", rawProfile.locale)))

(OpenID Connect providers only) Determines how the expected issuer value should match the actual value of the iss claim: