Skip to content

oidc.md

Latest commit

 

History

History
555 lines (371 loc) · 15.8 KB

oidc.md

File metadata and controls

555 lines (371 loc) · 15.8 KB
Raw

OIDC

14 operation(s). Part of the API index.

Call these as $client-><service>-><method>(...). <service> is the client field for this group — the README lists the field name for every service. These pages group operations the way the OpenAPI specification tags them, which is not always one field per page.

deleteDynamicClient

DELETE /api/oidc/{OIDCAppName}/register/{clientID}

Delete a Dynamic Client

Deletes a dynamically registered OAuth 2.0/OIDC client per RFC 7592. Requires the registration_access_token issued at registration time. Returns 204 No Content on success.

Example

function callDeleteDynamicClient($client) {
    $oIDCAppName = '<oIDCAppName>'; //Required
    $clientID = '<clientID>'; //Required

    try {
        $response = $client->oidc->deleteDynamicClient(oIDCAppName: $oIDCAppName, clientID: $clientID);
        echo $response;
    } catch (\LoginRadius\Sdk\Internal\OpenApi\ApiException $e) {
        $lr = \LoginRadius\Sdk\Client::toLoginRadiusException($e);
        echo $lr->description();
    }
}

Parameters

Name In Type Required Description
OIDCAppName path string yes OIDC App Name
clientID path string yes The client_id of the dynamically registered OAuth client.

getDynamicClient

GET /api/oidc/{OIDCAppName}/register/{clientID}

Get a Dynamic Client

Retrieves the metadata of a dynamically registered OAuth 2.0/OIDC client per RFC 7592 (OAuth 2.0 Dynamic Client Registration Management Protocol). Requires the registration_access_token issued at registration time.

Example

function callGetDynamicClient($client) {
    $oIDCAppName = '<oIDCAppName>'; //Required
    $clientID = '<clientID>'; //Required

    try {
        $response = $client->oidc->getDynamicClient(oIDCAppName: $oIDCAppName, clientID: $clientID);
        echo $response;
    } catch (\LoginRadius\Sdk\Internal\OpenApi\ApiException $e) {
        $lr = \LoginRadius\Sdk\Client::toLoginRadiusException($e);
        echo $lr->description();
    }
}

Parameters

Name In Type Required Description
OIDCAppName path string yes OIDC App Name
clientID path string yes The client_id of the dynamically registered OAuth client.

Returns

OAuthDynamicClientResponse

getOAuthAuthorizationServerMetadataOIDC

GET /service/oidc/{OIDCAppName}/.well-known/oauth-authorization-server

OAuth Authorization Server Metadata (OIDC app)

Returns OAuth 2.0 Authorization Server Metadata (RFC 8414) for the given OIDC app. Use this endpoint for OAuth 2.0 client discovery when using the OIDC flow path. Response does not include OpenID Connect-specific fields (e.g. userinfo_endpoint, claims_supported).

Example

function callGetOAuthAuthorizationServerMetadataOIDC($client) {
    $oIDCAppName = '<oIDCAppName>'; //Required

    try {
        $response = $client->oidc->getOAuthAuthorizationServerMetadataOIDC(oIDCAppName: $oIDCAppName);
        echo $response;
    } catch (\LoginRadius\Sdk\Internal\OpenApi\ApiException $e) {
        $lr = \LoginRadius\Sdk\Client::toLoginRadiusException($e);
        echo $lr->description();
    }
}

Parameters

Name In Type Required Description
OIDCAppName path string yes OIDC App Name

Returns

OAuthAuthorizationServerMetadata

getOIDCDeviceCode

POST /api/oidc/{OIDCAppName}/device

Retrieve OIDC device code

Initiates the OAuth 2.0 Device Authorization Grant per RFC 8628. Returns a device_code and user_code that the client displays to the end-user for out-of-band authorization on a secondary device. The client then polls the token endpoint with the device_code until the user completes authorization.

Example

function callGetOIDCDeviceCode($client) {
    $oIDCAppName = '<oIDCAppName>'; //Required
    $oIDCDeviceCode = new \LoginRadius\Sdk\Internal\OpenApi\Model\OIDCDeviceCode(['clientId' => '<clientId>']); //Required

    try {
        $response = $client->oidc->getOIDCDeviceCode($oIDCDeviceCode, oIDCAppName: $oIDCAppName);
        echo $response;
    } catch (\LoginRadius\Sdk\Internal\OpenApi\ApiException $e) {
        $lr = \LoginRadius\Sdk\Client::toLoginRadiusException($e);
        echo $lr->description();
    }
}

Parameters

Name In Type Required Description
OIDCAppName path string yes OIDC App Name

Request body

OIDCDeviceCode as application/json.

Returns

OIDCDeviceCodeResponse

getOIDCDiscoveryConfig

GET /service/oidc/{OIDCAppName}/.well-known/openid-configuration

OpenID Connect Discovery endpoint

Returns the OpenID Provider Configuration Information per OpenID Connect Discovery 1.0 (Section 4). Clients use this endpoint to dynamically discover the issuer, supported endpoints, scopes, response types, claims, and signing algorithms. The response includes the authorization_endpoint, token_endpoint, userinfo_endpoint, jwks_uri, and other metadata needed to configure an OIDC Relying Party.

Example

function callGetOIDCDiscoveryConfig($client) {
    $oIDCAppName = '<oIDCAppName>'; //Required

    try {
        $response = $client->oidc->getOIDCDiscoveryConfig(oIDCAppName: $oIDCAppName);
        echo $response;
    } catch (\LoginRadius\Sdk\Internal\OpenApi\ApiException $e) {
        $lr = \LoginRadius\Sdk\Client::toLoginRadiusException($e);
        echo $lr->description();
    }
}

Parameters

Name In Type Required Description
OIDCAppName path string yes OIDC App Name

Returns

OIDCDiscoveryResponse

getOIDCJWKSConfig

GET /service/oidc/{OIDCAppName}/jwks

Retrieve JSON Web Key Set

Retrieves the JSON Web Key Set (JWKS) for verifying token signatures.

Example

function callGetOIDCJWKSConfig($client) {
    $oIDCAppName = '<oIDCAppName>'; //Required

    try {
        $response = $client->oidc->getOIDCJWKSConfig(oIDCAppName: $oIDCAppName);
        echo $response;
    } catch (\LoginRadius\Sdk\Internal\OpenApi\ApiException $e) {
        $lr = \LoginRadius\Sdk\Client::toLoginRadiusException($e);
        echo $lr->description();
    }
}

Parameters

Name In Type Required Description
OIDCAppName path string yes OIDC App Name

Returns

JWKSResponse

getOIDCTokens

POST /api/oidc/{OIDCAppName}/token

Retrieve OIDC tokens

Retrieves OpenID Connect (OIDC) tokens for User authentication.

Example

function callGetOIDCTokens($client) {
    $oIDCAppName = '<oIDCAppName>'; //Required
    $getOAuthTokensRequest = new \LoginRadius\Sdk\Internal\OpenApi\Model\GetOAuthTokensRequest([]); //Required

    try {
        $response = $client->oidc->getOIDCTokens($getOAuthTokensRequest, oIDCAppName: $oIDCAppName);
        echo $response;
    } catch (\LoginRadius\Sdk\Internal\OpenApi\ApiException $e) {
        $lr = \LoginRadius\Sdk\Client::toLoginRadiusException($e);
        echo $lr->description();
    }
}

Parameters

Name In Type Required Description
OIDCAppName path string yes OIDC App Name

Request body

object as application/json.

Returns

OIDCTokenResponse

getOIDCUserinfo

GET /service/oidc/{OIDCAppName}/userinfo

Retrieve OIDC User info

Retrieves User information using OpenID Connect (OIDC) standards.

Example

function callGetOIDCUserinfo($client) {
    $oIDCAppName = '<oIDCAppName>'; //Required

    try {
        $response = $client->oidc->getOIDCUserinfo(oIDCAppName: $oIDCAppName);
        echo $response;
    } catch (\LoginRadius\Sdk\Internal\OpenApi\ApiException $e) {
        $lr = \LoginRadius\Sdk\Client::toLoginRadiusException($e);
        echo $lr->description();
    }
}

Parameters

Name In Type Required Description
OIDCAppName path string yes OIDC App Name

Returns

OIDCUserinfoResponse

getOIDCUserinfoByPost

POST /service/oidc/{OIDCAppName}/userinfo

Retrieve OIDC User info via POST

Retrieves User information using OpenID Connect (OIDC) standards via the POST method.

Example

function callGetOIDCUserinfoByPost($client) {
    $oIDCAppName = '<oIDCAppName>'; //Required
    $oIDCUserinfo = new \LoginRadius\Sdk\Internal\OpenApi\Model\OIDCUserinfo(['accessToken' => '<accessToken>']); //Required

    try {
        $response = $client->oidc->getOIDCUserinfoByPost($oIDCUserinfo, oIDCAppName: $oIDCAppName);
        echo $response;
    } catch (\LoginRadius\Sdk\Internal\OpenApi\ApiException $e) {
        $lr = \LoginRadius\Sdk\Client::toLoginRadiusException($e);
        echo $lr->description();
    }
}

Parameters

Name In Type Required Description
OIDCAppName path string yes OIDC App Name

Request body

OIDCUserinfo as application/json.

Returns

OIDCUserinfoResponse

introspectOIDCToken

POST /api/oidc/{OIDCAppName}/introspect

Introspect OIDC token

Returns the active state and metadata of an OIDC access or refresh token per RFC 7662 (OAuth 2.0 Token Introspection). The client must authenticate using either HTTP Basic authentication (Authorization: Basic base64(client_id:client_secret)) or by including client_id and client_secret in the POST body, depending on the token_endpoint_auth_method configured for the OIDC application. Returns active: true with associated claims for valid tokens, or active: false for invalid, expired, or revoked tokens.

Example

function callIntrospectOIDCToken($client) {
    $oIDCAppName = '<oIDCAppName>'; //Required
    $oAuthRevokeRefreshToken = new \LoginRadius\Sdk\Internal\OpenApi\Model\OAuthRevokeRefreshToken(['clientId' => '<clientId>', 'clientSecret' => '<clientSecret>', 'token' => '<token>']); //Required

    try {
        $response = $client->oidc->introspectOIDCToken($oAuthRevokeRefreshToken, oIDCAppName: $oIDCAppName);
        echo $response;
    } catch (\LoginRadius\Sdk\Internal\OpenApi\ApiException $e) {
        $lr = \LoginRadius\Sdk\Client::toLoginRadiusException($e);
        echo $lr->description();
    }
}

Parameters

Name In Type Required Description
OIDCAppName path string yes OIDC App Name

Request body

OAuthRevokeRefreshToken as application/json.

Returns

OIDCTokenIntrospectResponse

oIDCDynamicClientRegistration

POST /api/oidc/{OIDCAppName}/register

OIDC dynamic client registration

Registers a new OAuth 2.0/OIDC client dynamically per RFC 7591 (OAuth 2.0 Dynamic Client Registration Protocol). The client submits desired metadata (redirect_uris, client_name, grant_types, etc.) and receives the registered client metadata including the assigned client_id and client_secret. This feature must be explicitly enabled on the OIDC application configuration.

Example

function callOIDCDynamicClientRegistration($client) {
    $oIDCAppName = '<oIDCAppName>'; //Required
    $dynamicClientRegistrationRequest = new \LoginRadius\Sdk\Internal\OpenApi\Model\DynamicClientRegistrationRequest(['redirectUris' => '<redirectUris>', 'clientName' => '<clientName>', 'clientUri' => '<clientUri>']); //Required

    try {
        $response = $client->oidc->oIDCDynamicClientRegistration($dynamicClientRegistrationRequest, oIDCAppName: $oIDCAppName);
        echo $response;
    } catch (\LoginRadius\Sdk\Internal\OpenApi\ApiException $e) {
        $lr = \LoginRadius\Sdk\Client::toLoginRadiusException($e);
        echo $lr->description();
    }
}

Parameters

Name In Type Required Description
OIDCAppName path string yes OIDC App Name

Request body

DynamicClientRegistrationRequest as application/json.

Returns

DynamicClientRegistrationResponse

oIDCPushedAuthorizationRequest

POST /api/oidc/{OIDCAppName}/par

OIDC Pushed Authorization Request (PAR)

Accepts an OIDC authorization request and stores it server-side per RFC 9126 (OAuth 2.0 Pushed Authorization Requests). Returns a short-lived request_uri that the client passes as the sole parameter to the authorization endpoint, keeping all sensitive request parameters out of the browser URL. This feature must be explicitly enabled on the OIDC application configuration.

Example

function callOIDCPushedAuthorizationRequest($client) {
    $oIDCAppName = '<oIDCAppName>'; //Required
    $pARRequest = new \LoginRadius\Sdk\Internal\OpenApi\Model\PARRequest(['clientId' => '<clientId>', 'redirectUri' => '<redirectUri>', 'responseType' => '<responseType>', 'scope' => '<scope>']); //Required

    try {
        $response = $client->oidc->oIDCPushedAuthorizationRequest($pARRequest, oIDCAppName: $oIDCAppName);
        echo $response;
    } catch (\LoginRadius\Sdk\Internal\OpenApi\ApiException $e) {
        $lr = \LoginRadius\Sdk\Client::toLoginRadiusException($e);
        echo $lr->description();
    }
}

Parameters

Name In Type Required Description
OIDCAppName path string yes OIDC App Name

Request body

PARRequest as application/json.

Returns

PARResponse

revokeOIDCRefreshToken

POST /api/oidc/{OIDCAppName}/revoke

Revoke OIDC refresh token

Revokes an OIDC refresh token per RFC 7009 (OAuth 2.0 Token Revocation), invalidating it and preventing any further use. The client must authenticate using client_id and client_secret via HTTP Basic or POST body.

Example

function callRevokeOIDCRefreshToken($client) {
    $oIDCAppName = '<oIDCAppName>'; //Required
    $oAuthRevokeRefreshToken = new \LoginRadius\Sdk\Internal\OpenApi\Model\OAuthRevokeRefreshToken(['clientId' => '<clientId>', 'clientSecret' => '<clientSecret>', 'token' => '<token>']); //Required

    try {
        $response = $client->oidc->revokeOIDCRefreshToken($oAuthRevokeRefreshToken, oIDCAppName: $oIDCAppName);
        echo $response;
    } catch (\LoginRadius\Sdk\Internal\OpenApi\ApiException $e) {
        $lr = \LoginRadius\Sdk\Client::toLoginRadiusException($e);
        echo $lr->description();
    }
}

Parameters

Name In Type Required Description
OIDCAppName path string yes OIDC App Name

Request body

OAuthRevokeRefreshToken as application/json.

updateDynamicClient

PUT /api/oidc/{OIDCAppName}/register/{clientID}

Update a Dynamic Client

Updates the metadata of a dynamically registered OAuth 2.0/OIDC client per RFC 7592. Requires the registration_access_token issued at registration time.

Example

function callUpdateDynamicClient($client) {
    $oIDCAppName = '<oIDCAppName>'; //Required
    $clientID = '<clientID>'; //Required
    $oAuthDynamicClientRequest = new \LoginRadius\Sdk\Internal\OpenApi\Model\OAuthDynamicClientRequest(['clientName' => '<clientName>', 'redirectUris' => '<redirectUris>']); //Required

    try {
        $response = $client->oidc->updateDynamicClient($oAuthDynamicClientRequest, oIDCAppName: $oIDCAppName, clientID: $clientID);
        echo $response;
    } catch (\LoginRadius\Sdk\Internal\OpenApi\ApiException $e) {
        $lr = \LoginRadius\Sdk\Client::toLoginRadiusException($e);
        echo $lr->description();
    }
}

Parameters

Name In Type Required Description
OIDCAppName path string yes OIDC App Name
clientID path string yes The client_id of the dynamically registered OAuth client.

Request body

OAuthDynamicClientRequest as application/json.

Returns

OAuthDynamicClientResponse