Oidc Authentication Properties

The allowed clock skew, in seconds, when validating token timestamps.

Whether additional authentication diagnostics are enabled. Enables additional diagnostic detail in server-side failure responses and in the client login form.

The optional audiences accepted by the application during token validation.

The scopes requested during authentication. The server requires the openid scope and treats an empty list as openid alone; the profile scope supplies the preferred_username claim that the authenticated username derives from by default.

The token claim whose value becomes the authenticated username. A blank value is treated as preferred_username by the server; a login fails when the configured claim is not present in the token. This is resolved on every login under every PrincipalResolutionPolicy, including Principal, so a missing claim fails login even for an already fully-provisioned user.

CLIENT_SECRET_BASIC), PropertyOrder(16

The client authentication method used at the token endpoint: CLIENT_SECRET_BASIC, CLIENT_SECRET_POST, or PUBLIC. A blank value is treated as CLIENT_SECRET_BASIC. PUBLIC is the standard OAuth2/OIDC "public client" pattern for an application that cannot keep a secret confidential - it is not a reduced-security option, and Dodeca always uses Authorization Code + PKCE for every OIDC login regardless of this setting.

The client identifier issued by the identity provider for this application.

The name of the tenant token containing the client secret. The secret value is stored as a tenant token on the server and is never stored in application metadata. Leave blank when ClientAuthenticationType is PUBLIC.

The callback URL registered with the identity provider, in the form \{metadata service URL}/sso-launch/{tenant}/{application}. The value must exactly match a redirect URL pre-registered with the identity provider.

The issuer URL used for OIDC discovery and issuer validation. The value must match the issuer in the provider’s discovery document exactly, including any trailing slash. When set, the provider’s endpoints are discovered automatically and the Endpoints properties should be left blank.

An explicit authorization endpoint URL, used only when the identity provider does not support discovery. Leave blank when IssuerUrl provides discovery; when specified, TokenEndpointUrl and JwkSetUrl must also be specified.

An explicit JSON Web Key Set (JWKS) URL, used only when the identity provider does not support discovery. The key set publishes the provider’s public signing keys used to validate tokens. Leave blank when IssuerUrl provides discovery; when specified, AuthorizationEndpointUrl and TokenEndpointUrl must also be specified.

An explicit token endpoint URL, used only when the identity provider does not support discovery. Leave blank when IssuerUrl provides discovery; when specified, AuthorizationEndpointUrl and JwkSetUrl must also be specified.

An optional explicit user-info endpoint URL, used only when the identity provider does not support discovery.

true

Whether the hosted browser should attempt to allow single sign on using the operating system’s logged in account.

The identity provider attribute that should be mapped to an authenticated username. If omitted, the authenticated username matches the Dodeca username for the client session.

false

Whether the authentication provider should set the authenticated username for the client session.

400, 600

Sets the default width and height of the authentication form. When Authentication Form Size Policy is AutoSize, only the width is used; the height is determined automatically from the page content.