Identity as a Service:Configure SSO for a self-developed application

​

Field

Description

Example

Basic configuration (required)

Logon

Redirect URI

The allowlist of redirect URIs. When the application requests logon, it includes the redirect_uri parameter. The value must be in the allowlist for IDaaS to redirect the user after authentication.

http://www.xxxx/oidc/sso

http://www.xxxx/oidc/sso2

Authorization scope

For more information, see Common single sign-on instructions.

Select: Accessible to all users

Advanced configuration (optional)

User information

scopes

The UserInfo endpoint provides information about the logged-on user after the user logs on.

• openid

• email

• phone

• profile

Multi-select: openid

Multi-select: email

Multi-select: profile

access_token

validity period

access_token is used to call IDaaS API operations. The default value is 20 minutes, the minimum value is 5 minutes, and the maximum value is 24 hours. After it expires, use refresh_token to refresh it or log on again.

20 minutes

id_token

validity period

id_token identifies the user. It uses the JWT format, which allows the application to verify the user identity with a public key. After it expires, use refresh_token to refresh it or log on again.

id_token format: see Types of token in IDaaS.

10 hours

refresh_token

validity period

Used to obtain a new access_token and id_token. After refresh_token expires, the user must log on again.

30 days

Extended id_token

fields

Extend the payload fields in id_token to return non-sensitive basic user information and reduce repeated calls to the UserInfo endpoint. Note: Fields added to the payload are publicly visible. Use them as needed.

-

SSO initiator

The OIDC protocol natively supports application-initiated SSO.

If you select Support portal-initiated and application-initiated, you must specify the next field: Portal logon initiation address.

Support portal-initiated and application-initiated

Logon initiation address

The application address that IDaaS accesses when it initiates an SSO request. After this address receives the request, it must immediately initiate an /authorize request to the authorization endpoint.

http://www.xxxx/oidc/login

id_token signature algorithm

id_token is signed by using an asymmetric algorithm. Currently, only the RSA-SHA256 algorithm is supported.

SHA256

Logoff callback address

The allowlist of application addresses that IDaaS calls back after the user logs off. The application can include one of these addresses when it initiates an SLO request.

http://www.xxxx.com

Field name

Description

Example

Issuer

id_token field that identifies the source of the token. Issuer is also the baseUrl of the following API operations.

https://xxxxx.aliyunidaas.com/oidc1

Discovery endpoint

Discovery

Obtains the endpoint information and supported modes and parameters of the current IDaaS. It is publicly accessible.

https://xxxxx.aliyunidaas.com/oidc1/.well-known/openid-configuration

Authorization endpoint

Authorization

The address that the application uses to initiate single sign-on.

https://xxxxx.aliyunidaas.com/oidc/authorize

Token endpoint

token

The address of the API operation that the application calls from the backend to exchange the authorization code code for a token during single sign-on.

https://xxxxx.aliyunidaas.com/oauth2/token

Token revocation endpoint

Revocation

Revokes a specific token that has taken effect.

https://xxxxx.aliyunidaas.com/oauth2/revoke

Signature verification public key endpoint

JWKS

The public key endpoint used to verify id_token and complete the SSO flow. Public keys may be rotated.

https://xxxxx.aliyunidaas.com/oidc1/slo

UserInfo endpoint

Userinfo

The endpoint called with access_token to obtain basic user information after logon.

https://xxxxx.aliyunidaas.com/oidc1/userinfo

End session endpoint

SLO

Logs the user off from the primary IDaaS logon session.

-