BEbeyondidentity
Identity Provider

Creates a new identity provider.

Changed on

Creates a new identity provider.

post/v1/tenants/{tenant_id}/realms/{realm_id}/identity-providers

Request

Headers

x-correlation_idstring required

Correlation ID. If supplied with the request, the response must contain the same value. If not supplied with the request, it is generated by the server and returned in the response.

Parameters

#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/1 (unresolved $ref)
#/paths/~1v1~1tenants~1%7Btenant_id%7D~1realms~1%7Brealm_id%7D~1sso-configs/get/parameters/2 (unresolved $ref)

Request body

idstring

A unique identifier identifying an identity provider within a realm. This is automatically set on creation. This field is immutable and read-only.

tenant_idstring

A unique identifier for the identity's tenant. This is automatically set on creation. This field is immutable and read-only.

realm_idstring

A unique identifier for the identity's realm. This is automatically set on creation. This field is immutable and read-only.

display_namestring required

The human-readable name associated with the identity provider.

Example request

{
  "tenant_id": "0001f1f460b1ace6",
  "realm_id": "8f5bec58229e6f29",
  "protocol_config": {
    "pkce": "s256"
  }
}

Response

The identity provider has been created.

type'oidc_idp' required
client_idstring required

The OIDC client id. This value is from the identity provider.

client_secretstring required

The OIDC client secret. This value is from the identity provider.

token_scopesstring[] required

The scopes which to request from the identity provider.

identity_attribute'id' | 'email' | 'username' | 'external_id' required

Defines which field should be used to populate the subject field of an id token.

  • id - The user ID is used.
  • email - The user email is used.
  • username - The username is used.
pkce'disabled' | 'plain' | 's256' required

PKCE code challenge methods supported for applications, as defined by RFC-7636. Allowable values are:

  • disabled : PKCE is disabled for this application. This is the default state if the pkce field is left blank. Please note that public OIDC and OAuth2 configured applications MUST enable PKCE support. Confidential clients can leave PKCE disabled if they choose.
  • plain : PKCE is enabled for this application. The server will correlate the code_challenge and code_verifier between the authorize and token requests. In this configuration, those fields are required to be identical. This is the lower security option for PKCE support and should only be used by legacy clients, or clients that don't support s256.
  • s256 : PKCE is enabled for this application, and the server will correlate the code_challenge and code_verifier between the authorize and token requests. In this configuration, those fields are required to equate as follows: code_challenge = base64url(sha256(ascii(code_verifier))). This is the higher security option and should always be preferred if it is supported by the client.
jwks_urlstring required

The URL that points to the ".well-known/jwks.json" of the identity provider. Must be a URL.

token_urlstring required

The URL that points to the "/token" endpoint of the identity provider. Must be a URL.

authorize_urlstring required

The "/authorize" URL to authenticate against inside of the identity provider. Must be a URL.

redirect_urlstring required

Redirect URL provided by Beyond Identity that the IdP can redirect end users to after successful authorize call. This is an OIDC-compliant callback.

identifying_claim_namestring required

The name of the claim that specifies the user's identity inside of a token.

oauth_2_par_enabledboolean required

Whether to enable OAuth 2.0 Pushed Authorization Request (PAR) support. See https://datatracker.ietf.org/doc/html/rfc9126 for more details.

oauth_2_par_endpointstring nullable

If oauth_2_par_enabled is true, this field is required and must be a valid URL. The URL to send the PAR request to. See https://datatracker.ietf.org/doc/html/rfc9126 for more details.

claimsstring

Claims to request from the identity provider. See https://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter for more details. If this field is empty, no claims will be requested.

token_endpoint_auth_method'client_secret_basic' | 'client_secret_post' required

The authentication method to use when calling the token endpoint. Supports client_secret_basic (HTTP Basic Auth) and client_secret_post (credentials in POST body).

Example response

{
  "pkce": "s256"
}

Changes

  • 42f3cac49392Revision changes
    • breaking

      added the new required request property /////////

    • info

      added the new optional request property /////////

    • info

      added the new optional request property /////////

    • info

      added the new required request property ///////// with a default value

    • info

      added the optional property //// to the response with the status

    • info

      added the optional property //// to the response with the status

    • info

      added the required property //// to the response with the status

    • info

      added the required property //// to the response with the status