Integration with applications over OpenID Connect and OAuth 2.0

To integrate Identity Provider with applications over the OpenID Connect and OAuth 2.0 protocols, use the following parameters of the am/idp/app-settings.json configuration file.

To get the server metadata, follow the link: https://<server_dns>/am/idp/.well-known/openid-configuration.

Parameter	Description
`CustomAttributes`	The block specifies the `ServiceProvider` and `Attributes` attributes (with the `Name` and `UserNameFormat` parameters).
`ServiceProvider`	The parameter value corresponds to `ClientId` from the `OIDC` section.
`Name`	Defines the key the transmitted attribute is displayed with as a result of decrypting the IdToken value or a request to Userinfo. If the `Name` parameter does not match one of the possible values (`email`, `name`, `family_name`, `given_name`, `middle_name`), the transmitted attribute is not displayed in the response to the Userinfo request, but it is displayed in the IdToken decryption.
`UserNameFormat`	Defines the user information transmitted to the OIDC client. This parameter accepts a strictly defined list of values: Id, ObjectGUID, Name, CanonicalName, PrincipalName, SamCompatibleName, DistinguishedName, Sid, FirstName, MiddleName, LastName, Email, Phone.
`CertificateThumbprint`	The thumbprint of the Identity Provider certificate. The certificate is loaded into the store of the computer where Identity Provider is installed.
`Clients`	The block specifies the settings for each client application. There can be several client applications.
`ClientId`	A unique identifier used to define the client application when exchanging tokens, as well as for user authentication and authorization. When a client application requests access to protected resources, it provides its `ClientId` along with other credentials to obtain an access token. Default value: example-client.
`ClientSecret`	A string of characters known only to the client application and the IDP server. `ClientSecret` is used in the token exchange process to confirm the identity of the client application. When requesting an access token, the client must provide its `ClientId` and `ClientSecret` for authentication. Default value: secret_secret_secret.
`DisplayName`	The name of the client application. Used to display information in the client interface. Default value: Example client application.
`Permissions`	The block specifies the attributes allowed for the application. After successful authentication and granting of permissions, the application can use the obtained data. The data specified in `Permissions` can be transmitted in the response over the OIDC protocol (ept — Endpoints, gt — GrantTypes, rst — ResponseTypes, scp — Scopes).
`ept:authorization`	Initiating authorization.
`ept:logout`	Terminating the session associated with the token by identifier.
`ept:token`	Used to obtain a token.
`gt:authorization_code`	Used to obtain tokens (ID Token and Access Token) with an intermediate authorization code.
`gt:refresh_token`	Used to obtain a new access token without re-authenticating the user.
`rst:code`	Used to obtain an authorization code.
`scp:email`	The user email address.
`scp:profile`	The user profile information includes the following components: `name`, `given_name`, `family_name`, `middle_name`.
`scp:openid`	Indicates that the client application requests user authentication.
`scp:offline_access`	Allows the client application to request a refresh token.
`PostLogoutRedirectUris`	Contains the valid URLs the user is redirected to after logging out of the client application.
`RedirectUris`	Contains the valid URLs the user is redirected to after a successful login to the client application.
`Requirements`	Defines additional requirements for client requests that must be met for successful user authentication and authorization.

The following table lists the attributes that Identity Provider transmits to the client application after successful user authentication.

Parameter	Description
`exp`	Defines the time after which the ID Token is not accepted.
`iat`	The time the JWT was issued.
`sub`	A unique subject identifier. The user identifier is specified as the value.
`iis`	The organization that issued the token. A URL is specified.
`aud`	The token recipient; the `client_id` of the application that sent the authentication request is specified.

For more information about configuring integration with applications over the OpenID Connect and OAuth 2.0 protocols, see the knowledge base articles Configuring OIDC using Keycloak as an example and Configuring NextCloud + OIDC.