OIDC Authentication Requirements for IDP Configuration

To allow end users to authenticate through an IDP using Open ID Connect protocol, the following parameters must be configured on the IDP.

OIDC Application Configuration

• The Identity Provider (IDP) must be set up with a valid OIDC application.

• The application must include a redirect URI in the following format, provided the IDP validates the redirect_uri in the incoming request.

  https://<LB_URL>/portal/oidcAuthCodeCallback
  

• The <LB_URL> must correspond to the value found in one of the following HTTP headers in the request sent to Unified Access Gateway.

  • X-Forwarded-Host
  • Host

• If both X-Forwarded-Host and Host are present, X-Forwarded-Host is used.

Discovery Document Requirements

When Unified Access Gateway requests the OIDC discovery endpoint (usually /.well-known/openid-configuration), the IDP must respond with at least the following fields.

Token Endpoint Response Requirements

The response from the token_endpoint must include the following information.

The id_token must include the following claims.

*If any of preferred_username or email or name are absent in the id_token, they must be obtained from the userinfo_endpoint.

Userinfo Endpoint Requirements

If utilized, the userinfo_endpoint must return the following claims.

Sample Token

{
  "sub": "00ukuzchb1ZY7krC85d7",
  "name": "firstname lastname",
  "email": "test@domain.com",
  "ver": 1,
  "iss": "https://test.okta.com",
  "aud": "client-id",
  "iat": 1748414018,
  "exp": 1748417618,
  "jti": "ID.8hVUu3gS920KVfDWXmqgrlVoJ4BAmysH1r37DUI96qc",
  "amr": [
    "pwd"
  ],
  "idp": "00okuy73u8S5TYsaz5d7",
  "preferred_username": "test@domain.com",
  "auth_time": 1748413974,
  "at_hash": "iBpNiNV69JpmmrhV1xfn_g"
}