OpenID Connect Discovery

Alongside auth code flow and mTLS, Itential Platform 6 has implemented support for OpenID Connect ("OIDC") Discovery, an extension of OAuth 2.0 for authenticating and authorizing end-users when they login to access applications and websites. Added support for OpenID Connect Discovery facilitates connecting to an OpenID Provider by retrieving necessary configuration details, such as the authorization endpoint, token endpoint, and supported scopes.

OIDC Schema

In the securitySchemes object of an example integration model, the OpenIDConnectScheme must set the authentication type ("openIdConnect") and a discovery endpoint that points to the OIDC identity provider's publicly available URL, openIdConnectUrl.

In the example schema, the public endpoint issued by the Microsoft identity platform is shown.

{
  ...
  "components": {
    "securitySchemes": {
      "OpenIDConnectScheme": {
        "type": "openIdConnect",
        "openIdConnectUrl": "https://login.microsoftonline.com/common/.well-known/openid-configuration"
      }
    }
  }
}

OIDC Discovery

After creating an Integration instance, Itential Platform reaches out to the discovery endpoint (the openIdConnectUrl) and auto-populates the instance with those values. Any of these retrieved values may be overridden after instance creation; however, Itential recommends that you keep most of these values the same. A portion of a newly created integration using the Microsoft discovery endpoint from an Integration Model example is shown below (Figure 1).

Figure 1: OIDC Discovery

OIDC Authorization Code Grant Flow

Itential supports Authorization Code Grant Flow ("auth code flow") for OIDC. The specifics are the same as summarized in the auth code flow for OAuth2 documented in "Integration Model - OAuth2 Authentication/Authorization"; however, there are a few variable name differences:

• tokenUrl and token_url becomes token_endpoint

• authorizationUrl becomes authorization_endpoint

• scopes object is enumerated by the scopes_supported array, without descriptions

Related Reading

• OpenID Specifications