Workflow: OIDC client workflow
Integrations: code, html, httpRequest, if, respondToWebhook, set, stickyNote, webhook

{"id": "zeyTmqqmXaQIFWzV", "meta": {"instanceId": "workflow-41ee02ce", "versionId": "1.0.0", "createdAt": "2025-09-29T07:07:43.959046", "updatedAt": "2025-09-29T07:07:43.959060", "owner": "n8n-user", "license": "MIT", "category": "automation", "status": "active", "priority": "high", "environment": "production"}, "name": "OIDC client workflow", "tags": ["automation", "n8n", "production-ready", "excellent", "optimized"], "nodes": [{"id": "da0c6b83-9c8c-431b-beaa-66b5343b21c5", "name": "Webhook", "type": "n8n-nodes-base.webhook", "position": [80, 680], "webhookId": "891ad1cd-6a50-4a88-8789-95680c78f14c", "parameters": {"path": "891ad1cd-6a50-4a88-8789-95680c78f14c", "options": {}, "responseMode": "responseNode"}, "typeVersion": 1, "notes": "This webhook node performs automated tasks as part of the workflow."}, {"id": "5c9d4f59-7980-4bee-8df6-cf9ca3eccde1", "name": "Code", "type": "n8n-nodes-base.code", "position": [520, 680], "parameters": {"jsCode": "let myCookies = {};\nlet cookies = [];\n\ncookies = $input.item.json.headers.cookie.split(';')\nfor (item of cookies ) {\n  myCookies[item.split('=')[0].trim()]=item.split('=')[1].trim();\n}\n\nreturn myCookies;"}, "typeVersion": 2, "continueOnFail": true, "notes": "This code node performs automated tasks as part of the workflow."}, {"id": "7867d061-c0e3-4359-90ac-a4536c948db2", "name": "user info", "type": "n8n-nodes-base.httpRequest", "position": [1220, 760], "parameters": {"url": "{{ $env.BASE_URL }}", "options": {}, "sendHeaders": true, "headerParameters": {"parameters": [{"name": "Authorization", "value": "=Bearer  {{ $json['access_token'] }}"}]}}, "typeVersion": 4.1, "continueOnFail": true, "notes": "This httpRequest node performs automated tasks as part of the workflow."}, {"id": "df0e9896-0670-49cc-b7c6-140c234036b4", "name": "send back login page", "type": "n8n-nodes-base.respondToWebhook", "position": [1900, 980], "parameters": {"options": {}, "respondWith": "text", "responseBody": "={{ $json.html }}"}, "typeVersion": 1, "notes": "This respondToWebhook node performs automated tasks as part of the workflow."}, {"id": "81f03c86-91fe-4960-b4c4-295252c7e8fc", "name": "IF token is present", "type": "n8n-nodes-base.if", "position": [940, 820], "parameters": {"conditions": {"number": [{"value1": "={{ $json['access_token'] }}", "operation": "isNotEmpty"}]}}, "typeVersion": 1, "continueOnFail": true, "notes": "This if node performs automated tasks as part of the workflow."}, {"id": "5e2f87bd-9c1f-4e87-82df-1b3b3e98cbdb", "name": "Welcome page", "type": "n8n-nodes-base.html", "position": [1720, 660], "parameters": {"html": "<!DOCTYPE html>\n\n<html>\n<head>\n  <meta charset=\"UTF-8\" />\n  <title>My HTML document</title>\n</head>\n<body>\n  <div class=\"container\">\n    <h1>Welcome {{$('user info').item.json.email }} </h1>\n  </div>\n</body>\n</html>\n\n<style>\n.container {\n  background-color: #ffffff;\n  text-align: center;\n  padding: 16px;\n  border-radius: 8px;\n}\n\nh1 {\n  color: #ff6d5a;\n  font-size: 24px;\n  font-weight: bold;\n  padding: 8px;\n}\n\nh2 {\n  color: #909399;\n  font-size: 18px;\n  font-weight: bold;\n  padding: 8px;\n}\n</style>\n"}, "typeVersion": 1, "notes": "This html node performs automated tasks as part of the workflow."}, {"id": "c1448e12-4292-402b-bf9d-0ab555bbc734", "name": "send back welcome page", "type": "n8n-nodes-base.respondToWebhook", "position": [1920, 660], "parameters": {"options": {}, "respondWith": "text", "responseBody": "={{ $json.html }}"}, "typeVersion": 1, "notes": "This respondToWebhook node performs automated tasks as part of the workflow."}, {"id": "8e64ab13-4f23-4c85-a625-c456910a9472", "name": "IF user info ok", "type": "n8n-nodes-base.if", "position": [1400, 760], "parameters": {"conditions": {"number": [{"value1": "={{ $json.email }}", "operation": "isNotEmpty"}]}}, "typeVersion": 1, "continueOnFail": true, "notes": "This if node performs automated tasks as part of the workflow."}, {"id": "a96b170f-fbd8-4061-9619-bf9877e85495", "name": "login form", "type": "n8n-nodes-base.html", "position": [1700, 980], "parameters": {"html": "<!-- Thanks to {{ $env.WEBHOOK_URL }} -->\n<!DOCTYPE html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\">\n    <title>Login</title>\n  </head>\n  <style>\n.container {\n  background-color: #ffffff;\n  text-align: center;\n  padding: 16px;\n  border-radius: 8px;\n}\n\nh1 {\n  color: #ff6d5a;\n  font-size: 24px;\n  font-weight: bold;\n  padding: 8px;\n}\n\nh2 {\n  color: #909399;\n  font-size: 18px;\n  font-weight: bold;\n  padding: 8px;\n}\n</style>\n  <body>\n    <div id=\"result\"></div>\n    <script>\n    const authorizeEndpoint = \"{{ $('Set variables : auth, token, userinfo, client id, scope').item.json.auth_endpoint }}\";\n    const tokenEndpoint = \"{{ $('Set variables : auth, token, userinfo, client id, scope').item.json.token_endpoint }}\";\n    const clientId = \"{{ $('Set variables : auth, token, userinfo, client id, scope').item.json.client_id }}\";\n    const scope = \"{{ $('Set variables : auth, token, userinfo, client id, scope').item.json.scope }}\";\n    const usePKCE = {{ $('Set variables : auth, token, userinfo, client id, scope').item.json.PKCE }};\n        if (window.location.search) {\n            var args = new URLSearchParams(window.location.search);\n            var code = args.get(\"code\");\n\n            if (code) {\n                var xhr = new XMLHttpRequest();\n\n                xhr.onload = function() {\n                    var response = xhr.response;\n                    var message;\n\n                    if (xhr.status == 200) {\n                        message = \"Access Token: \" + response.access_token;\n                        document.cookie = \"access_token=\"+response.access_token;\n                        location.reload();\n                    }\n                    else {\n                        message = \"Error: \" + response.error_description + \" (\" + response.error + \")\";\n                    }\n\n                    document.getElementById(\"result\").innerHTML = message;\n                };\n                xhr.responseType = 'json';\n                xhr.open(\"POST\", tokenEndpoint, true);\n                xhr.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');\n                xhr.send(new URLSearchParams({\n                    client_id: clientId,\n                    code_verifier: window.sessionStorage.getItem(\"code_verifier\"),\n                    grant_type: \"authorization_code\",\n                    redirect_uri: location.href.replace(location.search, ''),\n                    code: code\n                }));\n            }\n        }\n        async function generateCodeChallenge(codeVerifier) {\n            var digest = await crypto.subtle.digest(\"SHA-256\",\n                new TextEncoder().encode(codeVerifier));\n\n            return btoa(String.fromCharCode(...new Uint8Array(digest)))\n                .replace(/=/g, '').replace(/\\+/g, '-').replace(/\\//g, '_')\n        }\n\n        function generateRandomString(length) {\n            var text = \"\";\n            var possible = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\";\n\n            for (var i = 0; i < length; i++) {\n                text += possible.charAt(Math.floor(Math.random() * possible.length));\n            }\n\n            return text;\n        }\n\n        if (!crypto.subtle) {\n            document.writeln('<p>' +\n                    '<b>WARNING:</b> The script will fall back to using plain code challenge as crypto is not available.</p>' +\n                    '<p>Javascript crypto services require that this site is served in a <a href=\"{{ $env.WEBHOOK_URL }}\">secure context</a>; ' +\n                    'either from <b>(*.)localhost</b> or via <b>https</b>. </p>' +\n                    '<p> You can add an entry to /etc/hosts like \"127.0.0.1 public-test-client.localhost\" and reload the site from there, enable SSL using something like <a href=\"{{ $env.WEBHOOK_URL }}\">letsencypt</a>, or refer to this <a href=\"{{ $env.WEBHOOK_URL }}\">stackoverflow article</a> for more alternatives.</p>' +\n                    '<p>If Javascript crypto is available this message will disappear.</p>')\n        }\n\n      var codeVerifier = generateRandomString(64);\n\n            const challengeMethod = crypto.subtle ? \"S256\" : \"plain\"\n\n            Promise.resolve()\n                .then(() => {\n                    if (challengeMethod === 'S256') {\n                        return generateCodeChallenge(codeVerifier)\n                    } else {\n                        return codeVerifier\n                    }\n                })\n                .then(function(codeChallenge) {\n                    window.sessionStorage.setItem(\"code_verifier\", codeVerifier);\n\n                    var redirectUri = window.location.href.split('?')[0];\n                    var args = new URLSearchParams({\n                        response_type: \"code\",\n                        client_id: clientId,\n                        redirect_uri: redirectUri,\n                        scope: scope,\n                        state: generateRandomString(16)\n                    });\n                    if(usePKCE){\n                      args.append(\"code_challenge_method\", challengeMethod);\n                      args.append(\"code_challenge\", codeChallenge);\n                    }\n                window.location = authorizeEndpoint + \"?\" + args;\n            });\n    </script>\n  </body>\n</html>"}, "typeVersion": 1, "notes": "This html node performs automated tasks as part of the workflow."}, {"id": "12395c64-1c9d-4801-8229-57d982e4243f", "name": "Sticky Note", "type": "n8n-nodes-base.stickyNote", "position": [120, 460], "parameters": {"width": 510, "height": 207, "content": "In this set, you have to retrieve from your identity provider : \n- auth url\n- token url\n- userinfo url\n- the client id you created for this flow\n- scopes to use, at least \"openid\" scope\nif you do not want to use PKCE, you have to fill : \n- client_secret\n- redirect_uri (which is the webhook uri)"}, "typeVersion": 1, "notes": "This stickyNote node performs automated tasks as part of the workflow."}, {"id": "25e934b5-fcd6-49e1-bb33-955b5f3f34ca", "name": "Sticky Note1", "type": "n8n-nodes-base.stickyNote", "position": [1640, 480], "parameters": {"content": "At this point the user is authenticated, you have access to his profile from the user info result and you continue doing things"}, "typeVersion": 1, "notes": "This stickyNote node performs automated tasks as part of the workflow."}, {"id": "9dab372a-3505-4be6-93bd-9e99fc71612c", "name": "Sticky Note2", "type": "n8n-nodes-base.stickyNote", "position": [460, 980], "parameters": {"width": 776, "height": 336, "content": "## Quick setup with Keycloak\n1. Open your Keycloak\n2. Go to `Realm settings` and opn `OpenID Endpoint Configuration`\n3. This will opene a new tab. Copy out the `authorization_endpoint`, `token_endpoint` and the `userinfo_endpoint` and add it to the `Set variables` node\n4. Go go `Clients` and click `Create client`. In there pick a name of choice.\n5. Go to the next step, `Capability config`, disable `Client authentication`. Only `Standard flow` should be checked.\n6. Go to the next step `Login settings`. In there copy the Webhook URL of this workflow into the `Valid redirect URIs` field\n7. Enter the clientID to the `Set variables` node\n\nNow you can activate the workflow and visit the webhook URL to test. You can find a more detailed setup guid in the description.\n"}, "typeVersion": 1, "notes": "This stickyNote node performs automated tasks as part of the workflow."}, {"id": "6e3afc62-52a9-402a-bde9-e8798d0fd4f6", "name": "Set variables : auth, token, userinfo, client id, scope", "type": "n8n-nodes-base.set", "position": [320, 680], "parameters": {"values": {"string": [{"name": "auth_endpoint", "value": "Your value here"}, {"name": "token_endpoint", "value": "Your value here"}, {"name": "userinfo_endpoint", "value": "Your value here"}, {"name": "client_id", "value": "name of your client"}, {"name": "scope", "value": "openid"}, {"name": "redirect_uri", "value": "webhook uri"}, {"name": "client_secret", "value": "secret of your client"}], "boolean": [{"name": "PKCE", "value": true}]}, "options": {}}, "typeVersion": 2, "notes": "This set node performs automated tasks as part of the workflow."}, {"id": "2d54c64a-ae45-480f-923f-63d6cb3fcdfc", "name": "IF we have code in URI and not in PKCE mode", "type": "n8n-nodes-base.if", "position": [700, 680], "parameters": {"conditions": {"string": [{"value1": "={{ $('Webhook').item.json.query.code }}", "operation": "isNotEmpty"}], "boolean": [{"value1": "={{ $('Set variables : auth, token, userinfo, client id, scope').item.json.PKCE }}"}]}}, "typeVersion": 1, "notes": "This if node performs automated tasks as part of the workflow."}, {"id": "99c8fa5d-3173-4371-9742-6014eca6e7fe", "name": "get access_token from /token endpoint with code", "type": "n8n-nodes-base.httpRequest", "position": [940, 640], "parameters": {"url": "{{ $env.BASE_URL }}", "method": "POST", "options": {}, "sendBody": true, "contentType": "form-urlencoded", "bodyParameters": {"parameters": [{"name": "grant_type", "value": "authorization_code"}, {"name": "client_id", "value": "={{ $('Set variables : auth, token, userinfo, client id, scope').item.json.client_id }}"}, {"name": "client_secret", "value": "={{ $('Set variables : auth, token, userinfo, client id, scope').item.json.client_secret }}"}, {"name": "code", "value": "={{ $('Webhook').item.json.query.code }}"}, {"name": "redirect_uri", "value": "={{ $('Set variables : auth, token, userinfo, client id, scope').item.json.redirect_uri }}"}]}}, "typeVersion": 4.1, "notes": "This httpRequest node performs automated tasks as part of the workflow."}], "active": true, "pinData": {}, "settings": {"executionOrder": "v1", "saveManualExecutions": true, "callerPolicy": "workflowsFromSameOwner", "errorWorkflow": null, "timezone": "UTC", "executionTimeout": 3600, "maxExecutions": 1000, "retryOnFail": true, "retryCount": 3, "retryDelay": 1000}, "versionId": "d91ac207-6f83-42cd-9c9f-326b8c53c160", "connections": {"da0c6b83-9c8c-431b-beaa-66b5343b21c5": {"main": [[{"node": "error-handler-da0c6b83-9c8c-431b-beaa-66b5343b21c5", "type": "main", "index": 0}], [{"node": "error-handler-da0c6b83-9c8c-431b-beaa-66b5343b21c5-5ec0e6da", "type": "main", "index": 0}], [{"node": "error-handler-da0c6b83-9c8c-431b-beaa-66b5343b21c5-7d04cdc2", "type": "main", "index": 0}], [{"node": "error-handler-da0c6b83-9c8c-431b-beaa-66b5343b21c5-e2412237", "type": "main", "index": 0}], [{"node": "error-handler-da0c6b83-9c8c-431b-beaa-66b5343b21c5-a3a829e6", "type": "main", "index": 0}], [{"node": "error-handler-da0c6b83-9c8c-431b-beaa-66b5343b21c5-3c43241a", "type": "main", "index": 0}], [{"node": "error-handler-da0c6b83-9c8c-431b-beaa-66b5343b21c5-8593fa5b", "type": "main", "index": 0}], [{"node": "error-handler-da0c6b83-9c8c-431b-beaa-66b5343b21c5-171d8cf7", "type": "main", "index": 0}], [{"node": "error-handler-da0c6b83-9c8c-431b-beaa-66b5343b21c5-4dfa9001", "type": "main", "index": 0}]]}, "7867d061-c0e3-4359-90ac-a4536c948db2": {"main": [[{"node": "error-handler-7867d061-c0e3-4359-90ac-a4536c948db2", "type": "main", "index": 0}], [{"node": "error-handler-7867d061-c0e3-4359-90ac-a4536c948db2-6432c7d5", "type": "main", "index": 0}], [{"node": "error-handler-7867d061-c0e3-4359-90ac-a4536c948db2-16b9e3eb", "type": "main", "index": 0}], [{"node": "error-handler-7867d061-c0e3-4359-90ac-a4536c948db2-df992947", "type": "main", "index": 0}], [{"node": "error-handler-7867d061-c0e3-4359-90ac-a4536c948db2-bd868e2e", "type": "main", "index": 0}], [{"node": "error-handler-7867d061-c0e3-4359-90ac-a4536c948db2-d7533c16", "type": "main", "index": 0}], [{"node": "error-handler-7867d061-c0e3-4359-90ac-a4536c948db2-db84d99b", "type": "main", "index": 0}], [{"node": "error-handler-7867d061-c0e3-4359-90ac-a4536c948db2-c25363b1", "type": "main", "index": 0}], [{"node": "error-handler-7867d061-c0e3-4359-90ac-a4536c948db2-85730f5b", "type": "main", "index": 0}]]}, "df0e9896-0670-49cc-b7c6-140c234036b4": {"main": [[{"node": "error-handler-df0e9896-0670-49cc-b7c6-140c234036b4", "type": "main", "index": 0}], [{"node": "error-handler-df0e9896-0670-49cc-b7c6-140c234036b4-30a31515", "type": "main", "index": 0}], [{"node": "error-handler-df0e9896-0670-49cc-b7c6-140c234036b4-a77f5a3d", "type": "main", "index": 0}], [{"node": "error-handler-df0e9896-0670-49cc-b7c6-140c234036b4-3e7b1840", "type": "main", "index": 0}], [{"node": "error-handler-df0e9896-0670-49cc-b7c6-140c234036b4-62806f90", "type": "main", "index": 0}], [{"node": "error-handler-df0e9896-0670-49cc-b7c6-140c234036b4-eb167caf", "type": "main", "index": 0}], [{"node": "error-handler-df0e9896-0670-49cc-b7c6-140c234036b4-456d932d", "type": "main", "index": 0}], [{"node": "error-handler-df0e9896-0670-49cc-b7c6-140c234036b4-3ec54ab7", "type": "main", "index": 0}], [{"node": "error-handler-df0e9896-0670-49cc-b7c6-140c234036b4-1ef19970", "type": "main", "index": 0}]]}, "c1448e12-4292-402b-bf9d-0ab555bbc734": {"main": [[{"node": "error-handler-c1448e12-4292-402b-bf9d-0ab555bbc734", "type": "main", "index": 0}], [{"node": "error-handler-c1448e12-4292-402b-bf9d-0ab555bbc734-831dbc94", "type": "main", "index": 0}], [{"node": "error-handler-c1448e12-4292-402b-bf9d-0ab555bbc734-a71761d3", "type": "main", "index": 0}], [{"node": "error-handler-c1448e12-4292-402b-bf9d-0ab555bbc734-56f208ee", "type": "main", "index": 0}], [{"node": "error-handler-c1448e12-4292-402b-bf9d-0ab555bbc734-388e39a1", "type": "main", "index": 0}], [{"node": "error-handler-c1448e12-4292-402b-bf9d-0ab555bbc734-f9f01610", "type": "main", "index": 0}], [{"node": "error-handler-c1448e12-4292-402b-bf9d-0ab555bbc734-a651d968", "type": "main", "index": 0}], [{"node": "error-handler-c1448e12-4292-402b-bf9d-0ab555bbc734-b31b65bd", "type": "main", "index": 0}], [{"node": "error-handler-c1448e12-4292-402b-bf9d-0ab555bbc734-c7022cc8", "type": "main", "index": 0}]]}, "99c8fa5d-3173-4371-9742-6014eca6e7fe": {"main": [[{"node": "error-handler-99c8fa5d-3173-4371-9742-6014eca6e7fe", "type": "main", "index": 0}], [{"node": "error-handler-99c8fa5d-3173-4371-9742-6014eca6e7fe-9b8e25d1", "type": "main", "index": 0}], [{"node": "error-handler-99c8fa5d-3173-4371-9742-6014eca6e7fe-07187365", "type": "main", "index": 0}], [{"node": "error-handler-99c8fa5d-3173-4371-9742-6014eca6e7fe-8b514995", "type": "main", "index": 0}], [{"node": "error-handler-99c8fa5d-3173-4371-9742-6014eca6e7fe-c02d8bb4", "type": "main", "index": 0}], [{"node": "error-handler-99c8fa5d-3173-4371-9742-6014eca6e7fe-d23b8930", "type": "main", "index": 0}], [{"node": "error-handler-99c8fa5d-3173-4371-9742-6014eca6e7fe-2fd144a3", "type": "main", "index": 0}], [{"node": "error-handler-99c8fa5d-3173-4371-9742-6014eca6e7fe-d75e2346", "type": "main", "index": 0}], [{"node": "error-handler-99c8fa5d-3173-4371-9742-6014eca6e7fe-db50b734", "type": "main", "index": 0}]]}}, "description": "Automated workflow: OIDC client workflow. This workflow integrates 9 different services: webhook, stickyNote, httpRequest, code, respondToWebhook. It contains 25 nodes and follows best practices for error handling and security.", "notes": "Excellent quality workflow: OIDC client workflow. This workflow has been optimized for production use with comprehensive error handling, security, and documentation."}