Sign in
Account Management

OpenID Connect authentication

Lists the supported OpenID Connect providers (OP). OpenID Connect Providers MUST support OpenID Connect Discovery.

It is highly RECOMMENDED to implement OpenID Connect for public services in favor of Basic authentication.

openEO clients MUST use the access token as part of the Bearer token for authorization in subsequent API calls (see also the information about Bearer tokens in this document). Clients MUST NOT use the id token or the authorization code. The access token provided by an OpenID Connect Provider does not necessarily provide information about the issuer (i.e. the OpenID Connect provider) and therefore a prefix MUST be added to the Bearer Token sent in subsequent API calls to protected endpoints. The Bearer Token sent to protected endpoints MUST consist of the authentication method (here oidc), the provider ID and the access token itself. All separated by a forward slash /. The provider ID corresponds to the value specified for id for each provider in the response body of this endpoint. The header in subsequent API calls for a provider with id ms would look as follows: Authorization: Bearer oidc/ms/TOKEN (replace TOKEN with the actual access token received from the OpenID Connect Provider).

Back-ends MAY request user information (including Claims) from the OpenID Connect Userinfo endpoint using the access token (without the prefix described above). Therefore, both openEO client and openEO back-end are relying parties (clients) to the OpenID Connect Provider.

get/credentials/oidc

Response

Lists the OpenID Connect Providers.

Example response

{
  "providers": [
    {
      "issuer": "https://accounts.google.com",
      "links": [
        {
          "rel": "related",
          "href": "https://openeo.example",
          "type": "text/html",
          "title": "openEO"
        }
      ]
    }
  ]
}

Changes