Dynamic client registration with new OpenID Connect provider

Before you begin

It is based on OpenID Connect Dynamic Client Registration 1.0 specifications.

New OIDC applications are created by a tenant administrator or a user with administrative access to the tenant. Now, OIDC applications can also be created dynamically through dynamic client registration.

Dynamic client registration endpoint is located here: https://{{tenant}}/oauth2/register.

About this task

Configure the dynamic client registration settings and then dynamically register the new OIDC application by using the registration API. The application is either a "OpenID Connect" or "OpenID Connect for Open Banking" application.

Dynamic client registration settings

The dynamic client registration settings can be configured to set the default values for dynamic client registration. See Configuring OIDC dynamic client registration settings.

The relevant settings are described in the following table.

Refer to Configuring OIDC dynamic client registration settings for the 'Software statement', 'Request authorization', and 'Registration access token' sections of the settings.

Require bearer token authentication for dynamic client registration

If the request authorization is configured to require bearer token authorization for dynamic client registration, an initial access token is required.

Create an API Client with the Manage OIDC client registration dynamically entitlement. To create the API Client, see Managing application API access.

After the API Client is created, use the client_credentials flow to get the access token. The following code is an example:

curl -ki -v https://{{tenant}}/v1.0/endpoint/default/token -d "grant_type=client_credentials&client_id=<clientId>&client_secret=<clientSecret>"

The dynamic client registration request requires the bearer token to be supplied in the authorization header.

Require MTLS for dynamic client registration

If the request authorization is configured to require mutual TLS, a valid certificate must be presented by the client for the request.

Register new application by using the registration API

The following table shows the list of client metadata that are currently supported.

Example for registering a new application

The following code is a sample request when dynamic client registration is configured to require bearer token authorization.

curl -ki -H "Authorization: bearer <access-token>" -H "Content-Type:application/json" -X POST https://{{tenant}}/oauth2/register --data-binary '{"redirect_uris":["https://www.redirect.com"],"client_name":"MyApplication"}'

response

{
	"grant_types": [
		"authorization_code"
	],
	"client_secret_expires_at": "0",
	"registration_client_uri": "https://{{tenant}}/oauth2/register/<clientId>",
	"client_secret": "<client_secret>",
	"redirect_uris": [
		"https://www.redirect.com"
	],
	"client_id_issued_at": "1586933118",
	"client_name": "MyApplication",
	"registration_access_token": "<access_token>",
	"client_id": "<clientId>",
	"id_token_signed_response_alg": "RS256"
}

Further configuration of application

After the application is created, you can configure more options for the application, for example, attribute mapping, access policy, identity sources, entitled users, and others. To configure these options, see Configuring single sign-on in the OpenID Connect application or Configuring single sign-on in the OpenID Connect for Open Banking applications.

Update OIDC application by using registration API

The following code is an example of using the registration_access_token from the previous step as the authorization bearer token and sending a PUT request to modify the client. Note that changes made to the OIDC application configuration would be overwritten.

curl -ki -H "Authorization: bearer <registration_access_token>" -H "Content-Type:application/json" -X PUT https://{{tenant}}/oauth2/register/<client-id> --data-binary '{"redirect_uris":["https://www.redirect.com/callback"],"client_name":"MyApplication2"}'

Read OIDC application by using registration API

The registration API also provides a way to read the OIDC application again.

curl -ki -H "Authorization: bearer <registration-access-token>" https://{{tenant}}/oauth2/register/<clientId>

Delete OIDC application by using the registration API

The registration API also provides a way to delete the OIDC application.

curl -ki -H "Authorization: bearer <registration-access-token>" -X DELETE https://{{tenant}}/oauth2/register/<clientId>

Registration access token expired

If the registration access token expires, acquire a new access token by using the client ID and secret of the client that was registered. See Acquire initial access token.