OpenID Connect rule fields

With Use OpenID Connect enabled, the Generic OAuth2 rule includes the following fields:
Field Description
When this rule should be applied An expression that defines one or more conditions that must be true for the rule to execute.

Default value: N/A

Example: The expression request.method == "POST" causes the rule to execute only on POST requests.

Use OpenID Connect

Select to use an OpenID Connect (OIDC) vendor as the 3rd-party IdP.

OpenID Discovery Document URL

Required. The OIDC discovery document URL.

Login URL

Required. The login URL for the client. REVIEWERS: for the client, or the login URL for the OIDC provider?

JWS Algorithm

The algorithm used to generate the JSON Web Service token. The Discovery Document contains an id_token_signing_alg_values_supported element that specifies the supported algorithms.

Select one of the following algorithm types:
  • HS256
  • HS384
  • HS512
  • RS256
  • RS384
  • RS512

Default value: RS256

Required Scopes

Required. The list of scopes required to get information about a user. The list of scopes becomes a list of roles and your Policy needs to authorize one with the Authorize by Role rule rule. If the open discovery document doesn't define a role, APIM defaults to the openid role. Click the plus icon to add the name of one or more scopes.

Access Token URL

Required. The provider’s access token URL.

Example: https://github.com/login/oauth/access_token

Client ID

Required. The ID of the SnapLogic application registered with the OAuth2 provider.

Client Secret

Required. The client secret for the SnapLogic application registered with the OAuth2 provider.

Redirect URI The URI of the Snaplex load-balancer appended with /api/1/rest/oauth2/callback

Example: https://groundplex.example.com/api/1/rest/oauth2/callback

Session: Time-To-Live in Seconds

Required. The number of seconds for which the session is active. Refer to OAuth session management for information on manually closing sessions.

Default value: 86400

Example: 90000

OAuth State: Time-To-Live in Seconds

Required. The number of seconds for which the OAuth state is active.

Default value: 300

Example: 1000

Description Use this rule to authenticate a client by delegating the authentication to an OAuth2 provider.

Default value: Authorizes requests using specified OAuth service.