Version 1.1 by messines on 2022/04/22 15:01
Show last authors
1 == Abstract ==
2
3 The first version of this documentation explained how to create an OIDC Client using the native keycloak API. It was a bit complex for users, they had to fetch a specific developer access token, then create the client, and store for ever the registrationAccessToken and save a new one after every updated. There was also limitations on scopes editions. There was not any notion of ownership and it was not possible to manage access to the OIDC client.
4 \\All these issue are solved with the new OIDC API provide with the Collaboratory API. Now you will be able with your usual collab access token, to create and manage your OIDC Client without storing any registrationAccessToken. You can also provide a list of maintainers that will be allow to update the client and you will be able to choose who can access your client.
5
6 == Endpoints ==
7
8 (% class="box infomessage" %)
9 (((
10 POST :     https:~/~/wiki.ebrains.eu/rest/v1/oidc/clients
11 PUT :     https:~/~/wiki.ebrains.eu/rest/v1/oidc/clients/{clientId}
12 GET   :     https:~/~/wiki.ebrains.eu/rest/v1/oidc/clients/{clientId}
13 )))
14
15 The POST/PUT Api use the same JSON format to describe the client
16
17 The GET also return a valid format usable if you want then update your client. It's the recommended way to update, first fetch your client info and then edit them to be sure to not erase any information.
18
19 == JSON Format ==
20
21 ----
22
23 {{code language="json"}}
24 {
25 "client": {
26 "clientId": "tutorialOidcApi",
27 "name": "Tutorial OIDC API",
28 "description": "A sample client demo for the OIDC API documentation",
29 "rootUrl": "https://example.org",
30 "baseUrl": "https://example.org",
31 "redirectUris": [
32 "https://example.org/login/*"
33 ],
34 "bearerOnly": false,
35 "consentRequired": true,
36 "standardFlowEnabled": true,
37 "implicitFlowEnabled": false,
38 "directAccessGrantsEnabled": false,
39 "attributes": {
40 "contacts": "first.contact@example.com; second.contact@example.com"
41 },
42 "defaultClientScopes": ["openid", "email"],
43 "optionalClientScopes": ["profile","team","group"]
44 },
45 "maintainers": ["messines","bougault"],
46 "featureAuthenticate" : false,
47 "accessDeniedToGuests" : false
48 }
49 {{/code}}