{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"redocly_category":"Guides","product":"Identity Management","type":"markdown"},"seo":{"title":"Configure OIDC clients","description":"Everything about Mosaic Journeys, SDKs, and APIs","siteUrl":"https://developer.transmitsecurity.com"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"configure-oidc-clients","__idx":0},"children":["Configure OIDC clients"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this guide to create an OIDC user authentication client for a web or native app. For backend-based authentication through Mosaic APIs or SDKs without an OIDC/SAML login flow, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#backend-based-authentication"},"children":["Backend-based authentication"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"before-you-start","__idx":1},"children":["Before you start"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/create_new_application"},"children":["Create a Mosaic application"]}," for the client."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For OIDC login, prepare the redirect URIs that receive the authorization response."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/login_experience"},"children":["Choose your login experience"]},". For journey-orchestrated login, prepare an ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/sso_orchestration/sso_journeys"},"children":["SSO journey"]}," and an ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/sso_orchestration/sso_config_service#client-groups"},"children":["SSO client group"]},", or create the group inline."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applications"]}," > your app > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Clients"]},", click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Add client"]}," and select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User authentication client"]},". Follow the steps below for protocol-based OIDC authentication."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1---general","__idx":2},"children":["Step 1 - General"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client name"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client name to display when needed."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client description"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Short description of your client."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2---authentication-flow","__idx":3},"children":["Step 2 - Authentication flow"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Does your login use OIDC or SAML authentication?"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Enabled by default. Leave it enabled for protocol-based authentication, then select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OIDC"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SAML"]},". Disable it for backend-based authentication through Mosaic APIs or SDKs."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Protocol"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Setting to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OIDC"]}," defines that this client is OIDC-based."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client type"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Whether the client is a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["web app"]}," (default) or a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["native app"]}," (e.g., mobile). This is used to adapt validations and configuration according to client type when relevant (such as validations for redirect URIs)."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Redirect URIs"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["List of URIs approved for redirects for your customer-facing application (e.g., URI to redirect to when an authentication is completed). The required format of the redirect URI depends upon client type: web clients must use HTTPS unless using a local environment, while native apps must use HTTPS unless using a local environment or custom scheme. Custom schemes are only allowed in the format of reverse domain schemes (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["[domain]://[scheme]"]},")."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3---login-experience","__idx":4},"children":["Step 3 - Login Experience"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journey-orchestrated"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application-controlled"]},". For the journey-orchestrated path, select the required ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/sso_orchestration/sso_config_service#client-groups"},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SSO client group"]}]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Journey"]},". When the group uses Mosaic-hosted screens, select a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Style"]}," or use the default Mosaic style. The journey and style are configured per client. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/login_experience"},"children":["Choose your login experience"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For the path that skips this step, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#backend-based-authentication"},"children":["Backend-based authentication"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-4---advanced-settings","__idx":5},"children":["Step 4 - Advanced settings"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Enforce FAPI 2.0 compliance"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["For highly-regulated industries, consider enabling \"Enforce FAPI 2.0 compliance\". This will automatically disable client settings that aren't FAPI 2.0-compliant and prompt you to configure your client in accordance with FAPI principles, for example by enforcing mTLS, PKCE, and PAR. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/fapi_flows"},"children":["FAPI 2.0"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication method"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Enforces client authentication using a specific method:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Secret"]},": (default) Allows authenticating using Client ID and Client Secret. For security purposes, the secret can be rotated later without changing the client ID."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Private key JWT"]},": Allows authenticating using client JWT assertion signed by your private key. If selected, provide ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://datatracker.ietf.org/doc/html/rfc7517"},"children":["JWKS"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["mTLS (self-signed)"]},": Allows leveraging an mTLS handshake for authentication. If selected, provide the self-signed certificate in the JWKS format."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["mTLS (CA-signed)"]},": Allows leveraging an mTLS handshake for authentication. If selected, provide the certificate chain in the PEM format. For requirements, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/auth_fapi_mtls#step-1-obtain-certificates"},"children":["Authenticate using mutual TLS"]},". Optionally, define ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Subject DN"]}," attributes (Common name (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CN"]},"), Organization (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["O"]},"), and others) to enforce certificate validation against these values."]}]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Enable token binding"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Enabling this ensures that tokens are cryptographically bound to client certificate in the mTLS and private key JWT flows."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Enforce PAR"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Enforces the usage of the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/user/oidc.openapi/other/pushedauthorizationrequest"},"children":["PAR"]}," endpoint for auth requests. For implementation details, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/auth_oidc_par"},"children":["Integrate login using PAR"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["PKCE support"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Whether the client requires the proof key of code exchange (PKCE) for authentication. For implementation details, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/auth_oidc_pkce"},"children":["Secure login with PKCE"]},".",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Allow PKCE alongside client credentials"]},": (default) Allows auth requests with and without PKCE, provided that they use client credentials."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Enforce PKCE alongside client credentials"]},": Requires all authentication requests to include PKCE in addition to client credentials."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Enforce PKCE instead of client credentials"]},": Retrieves user access tokens only. For security reasons, Mosaic doesn't recommend using PKCE as a standalone method for authenticating users without the Client Secret."]}]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access token expiration"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The access token time-to-live. By default, 60 minutes."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Refresh token expiration"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The refresh token time-to-live. By default, 2 weeks."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Max refresh time"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The maximum period of time when the refresh token can be rotated. By default, 2 weeks."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Session expiration"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The validity period during which you can silently authenticate the session. By default, 8760 hours (1 year). This session is tied to the tokens issued to this client: it limits how long the client can renew tokens without a new login. It's separate from the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/sso_orchestration/sso_config_service#session-timeout"},"children":["session timeout"]}," of an SSO client group, which controls when users must sign in again across the group's clients."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Same Site"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Defines the client cookie policy for requests made from a different site (cross-site).",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["LAX"]},": Allows Mosaic session cookies to be sent during standard navigation flows while blocking most cross-site requests (iframes and POSTs). This provides strong CSRF protection with minimal impact on typical sign-in experiences."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["None"]},": Allows sharing Mosaic session cookies. This option can only be used for HTTPS redirect URIs."]}]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Supported prompt values"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["List of OIDC prompt values to be enforced by the OIDC authorization server. Note that only selected prompt values can be included in the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/user/oidc.openapi/other/oidcauthenticate"},"children":["authorization requests"]},", requests containing unselected prompt values will be rejected.",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login"]},": Forces the user to authenticate."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Consent"]},": Obtains user's consent. Required to obtain a refresh token."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["None"]},": Checks for an existing session."]}]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Resources"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["List of URIs the client can explicitly request access to. This allows the client to manage dedicated access for a resource, including the token expiration. For example, a website can have a shorter lifetime for the page used to manage the user's payment methods. Before a resource can be added to a client, it must first be created from the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Resources"]}," tab of the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applications"]}," page (see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/manage_resources"},"children":["Resources"]},")."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["ID token — Pre-defined custom claims"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Dropdown for selecting the claim values that Mosaic should return by default in the user's ID token. These claims do not need to be explicitly requested in the OIDC ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/user/oidc.openapi/other/oidcauthenticate"},"children":["authorization"]}," request. Pre-defined ID token custom claim list is available ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#id-token---pre-defined-custom-claims-list"},"children":["below this table"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Return ID token claims on UserInfo as well"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Checkbox that makes the UserInfo endpoint return the same default claims selected in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["ID Token - Pre-defined Custom Claims"]},". When selected, ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User info - Pre-defined Custom Claims"]}," is disabled because UserInfo uses the ID token claim selection."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User info — Pre-defined custom claims"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Dropdown for selecting the claim values that Mosaic should return by default from the UserInfo endpoint. These claims do not need to be explicitly requested during the OIDC flow. Pre-defined UserInfo custom claim list is available ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#user-info---pre-defined-custom-claims-list"},"children":["below this table"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["ID token encryption"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Allows encrypting ID tokens using the customer-provided key. Upload a JWKS containing an RSA public key (RSA-OAEP) and rotate it as necessary. Encrypted tokens will be returned in a JWE form."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Token exchange"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Lets clients exchange user access tokens using ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://datatracker.ietf.org/doc/html/rfc8693"},"children":["OAuth 2.0 Token Exchange (RFC 8693)"]},". Both options are disabled by default.",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Initiate token exchange"]},": Allows this client to call ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/oidc/token"]}," with the token exchange grant, as the exchanging client."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Delegate tokens issued by this client"]},": Controls which clients may exchange user access tokens issued to this client, as the source client. When enabled, choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["All clients within the Application"]}," (every client in the same Mosaic application, including dynamically registered clients) or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Specific clients / DCR Authorities"]}," (manually registered clients you select, and optionally Client authorities, so that clients registered through them can exchange tokens)."]}]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"id-token---pre-defined-custom-claims-list","__idx":6},"children":["ID Token - Pre-defined Custom claims list"]},{"$$mdtype":"Tag","name":"details","attributes":{},"children":[{"$$mdtype":"Tag","name":"summary","attributes":{},"children":[{"$$mdtype":"Tag","name":"b","attributes":{},"children":["Click to open the list "]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["tid"]},": ID of the Mosaic tenant"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["fname"]},": User's first name"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["lname"]},": User's last name"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["mname"]},": User's middle name"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["email"]},": User's primary email"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["email_verified"]},": Indicates if the user's primary email is verified"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["phone_number"]},": User's primary phone number"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["phone_number_verified"]},": Indicates if the user's primary phone number is verified"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["groups"]},": Groups to which the user belongs"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["new_user"]},": Indicates if a new user was created as part of the authentication flow"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["birthday"]},": User's birthday as YYYY-MM-DD"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["language"]},": The language of the user"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["city"]},": User's city of residence"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["address"]},": User's address"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["country"]},": User's country of residence"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["street_address"]},": User's street address"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["address_type"]},": Type of user's address"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["webauthn"]},": Returned only if WebAuthn was used"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["roles"]},": List of role IDs assigned to the user"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ts_roles"]},": Transmit Security platform roles assigned to the user through Transmit Security RBAC. These are distinct from the Mosaic application-level roles in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["roles"]}," claim"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["role_values"]},": Main and custom roles assigned to the user"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ts_permissions"]},": Transmit Security platform permissions assigned to the user through Transmit Security RBAC. These are distinct from the Mosaic application-level permissions in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["permissions"]}," claim"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["permissions"]},": List of permissions delegated to the user"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["approval_data"]},": Returned only in transaction signing flows. Contains approval-related transaction data"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["custom_group_data"]},": Custom data object for group info"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["username"]},": Username used to identify the user for password login"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["secondary_phone_numbers"]},": List of user's secondary phone numbers"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["secondary_emails"]},": List of user's secondary emails"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["picture"]},": The picture of user, specified as a URL"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["created_at"]},": Date user was created in the tenant"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["last_auth"]},": Date user last authenticated"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["auth_time"]},": Time the user was authenticated"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["external_account_id"]},": User identifier in an app, set by the app"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["external_user_id"]},": A unique identifier in a tenant"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["app_name"]},": Name of the app the user is associated with"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["custom_data"]},": Custom data object for tenant user info"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["custom_app_data"]},": Custom data object for app-related user info"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"user-info---pre-defined-custom-claims-list","__idx":7},"children":["User info - Pre-defined Custom claims list"]},{"$$mdtype":"Tag","name":"details","attributes":{},"children":[{"$$mdtype":"Tag","name":"summary","attributes":{},"children":[{"$$mdtype":"Tag","name":"b","attributes":{},"children":["Click here to open the list"]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["tid"]},": ID of the Mosaic tenant"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["fname"]},": User's first name"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["lname"]},": User's last name"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["mname"]},": User's middle name"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["email"]},": User's primary email"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["email_verified"]},": Indicates if the user's primary email is verified"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["phone_number"]},": User's primary phone number"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["phone_number_verified"]},": Indicates if the user's primary phone number is verified"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["groups"]},": Groups to which the user belongs"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["new_user"]},": Indicates if a new user was created as part of the authentication flow"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["birthday"]},": User's birthday as YYYY-MM-DD"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["language"]},": The language of the user"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["city"]},": User's city of residence"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["address"]},": User's address"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["country"]},": User's country of residence"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["street_address"]},": User's street address"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["address_type"]},": Type of user's address"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["webauthn"]},": Returned only if WebAuthn was used"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["roles"]},": List of role IDs assigned to the user"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ts_roles"]},": Transmit Security platform roles assigned to the user through Transmit Security RBAC. These are distinct from the Mosaic application-level roles in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["roles"]}," claim"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["role_values"]},": Main and custom roles assigned to the user"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ts_permissions"]},": Transmit Security platform permissions assigned to the user through Transmit Security RBAC. These are distinct from the Mosaic application-level permissions in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["permissions"]}," claim"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["permissions"]},": List of permissions delegated to the user"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["approval_data"]},": Returned only in transaction signing flows. Contains approval-related transaction data"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["custom_group_data"]},": Custom data object for group info"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["username"]},": Username used to identify the user for password login"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["secondary_phone_numbers"]},": List of user's secondary phone numbers"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["secondary_emails"]},": List of user's secondary emails"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["picture"]},": The picture of user, specified as a URL"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["created_at"]},": Date user was created in the tenant"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["last_auth"]},": Date user last authenticated"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["auth_time"]},": Time the user was authenticated"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["external_account_id"]},": User identifier in an app, set by the app"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["external_user_id"]},": A unique identifier in a tenant"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["app_name"]},": Name of the app the user is associated with"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["custom_data"]},": Custom data object for tenant user info"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["custom_app_data"]},": Custom data object for app-related user info"]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Customizing claims"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Claims such as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["org_id"]}," do not appear in these dropdowns. When authentication runs in the context of an organization, Mosaic adds ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["org_id"]}," automatically to the ID token and UserInfo response."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To add custom key/value claims in journey flows, configure ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/enrich_access_and_id_token"},"children":["Enrich Access and ID Token"]}," or ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/enrich_sso_tokens"},"children":["Enrich SSO Token"]}," in your journey."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-5---client-roles","__idx":8},"children":["Step 5 - Client roles"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The last step lets you assign one or more client roles to the client. "]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client roles"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Assign one or more client roles to the client. If you don't select a role, the client implicitly receives the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["App Admin"]}," role. Exception: clients that were configured in the Admin Portal's ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SSO & Federation"]}," section, now deprecated, have no roles when none is assigned and can only perform authentication. To grant more permissions, assign client roles explicitly."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client roles"]}," > ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Add role"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Opens the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add role"]}," flow: ",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Step 1 - Details"]},": enter the required ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Role name"]}," and optional ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Description"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Step 2 - Setup"]},": assign permissions from the permission tree under the Mosaic capability areas ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identity management"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Platform Administration"]},", and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Fraud Prevention"]},", each expanding into more granular categories."]}]}," For more details, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/manage_client_roles"},"children":["Manage client roles"]},"."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"after-saving","__idx":9},"children":["After saving"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Complete the wizard and save the client. The client details page contains its credentials and configuration."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Important"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Upon OIDC client creation, Mosaic will autogenerate a unique Client ID and Client Secret."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client ID"]},": Client identifier for API requests, automatically generated when the client is created. It cannot be edited."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Secret"]},": Client secret used to authorize API requests on behalf of the client (either directly or by using it to generate client access tokens). It is automatically generated when the client is created, and you can rotate it later without changing the Client ID. During rotation, Mosaic can keep up to two active secrets so you can update your backend before revoking the old one."]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"backend-based-authentication","__idx":10},"children":["Backend-based authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For user authentication through Mosaic APIs or SDKs without an OIDC or SAML login flow, select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User authentication client"]},", then turn off ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Does your login use OIDC or SAML authentication?"]}," in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication flow"]},". The saved client is still an OIDC client."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This path uses ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["General"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication flow"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Advanced settings"]}," (step 3), and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client roles"]}," (step 4). It skips ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Login Experience"]},". Configure the authentication method and token settings shown for this path, then assign the required client roles (see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#step-5---client-roles"},"children":["Step 5 - Client roles"]},"; on this path it's step 4). ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Enforce PAR"]}," is not available on this path; the protocol-based settings above do not all apply."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Follow the setup requirements in the guide for the authentication method you integrate. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/auth_overview"},"children":["Backend authentication"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"related-guides","__idx":11},"children":["Related guides"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/sso_orchestration/sso_quickstart_hosted_ui_oidc"},"children":["Launch OIDC SSO with the Mosaic-hosted experience"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/manage_clients"},"children":["Manage clients"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/manage_client_roles"},"children":["Manage client roles"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/login_experience"},"children":["Choose your login experience"]}]}]}]},"headings":[{"value":"Configure OIDC clients","id":"configure-oidc-clients","depth":1},{"value":"Before you start","id":"before-you-start","depth":2},{"value":"Step 1 - General","id":"step-1---general","depth":2},{"value":"Step 2 - Authentication flow","id":"step-2---authentication-flow","depth":2},{"value":"Step 3 - Login Experience","id":"step-3---login-experience","depth":2},{"value":"Step 4 - Advanced settings","id":"step-4---advanced-settings","depth":2},{"value":"ID Token - Pre-defined Custom claims list","id":"id-token---pre-defined-custom-claims-list","depth":3},{"value":"User info - Pre-defined Custom claims list","id":"user-info---pre-defined-custom-claims-list","depth":3},{"value":"Step 5 - Client roles","id":"step-5---client-roles","depth":2},{"value":"After saving","id":"after-saving","depth":2},{"value":"Backend-based authentication","id":"backend-based-authentication","depth":2},{"value":"Related guides","id":"related-guides","depth":2}],"frontmatter":{"title":"OIDC clients","markdown":{"toc":{"depth":2}},"seo":{"title":"Configure OIDC clients"}},"lastModified":"2026-10-16T09:43:07.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/user/configure_oidc_client","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}