Revision Summary Date Revision History Revision Class Comments 8/8/2013 1.0 New Released new document. 11/14/2013 2.0 Significantly changed the technical content. 2/13/2014 2.0 None No changes to the meaning, language, or formatting of the technical content. 5/15/2014 3.0 Significantly changed the technical content. 6/30/2015 4.0 Significantly changed the technical content. 7/14/2016 5.0 Major Significantly changed the technical content. 6/1/2017 6.0 Major Significantly changed the technical content.
AD_FS_BEHAVIOR_LEVEL_2 or higher. prompt OPTIONAL. This query parameter is used in the same way as the prompt parameter defined in [OIDCCore] section 3.1.2.1, but the only accepted values for this parameter are "none" and "login". This parameter and the accepted values specified in the preceding paragraph SHOULD<3> be supported for all values of ad_fs_behavior_level. max_age OPTIONAL. This query parameter is used in the same way as the max_age parameter defined in [OIDCCore] section 3.1.2.1. The AD FS server ignores this parameter unless its ad_fs_behavior_level is AD_FS_BEHAVIOR_LEVEL_2 or higher. id_token_hint OPTIONAL. This query parameter is used in the same way as the id_token_hint parameter defined in [OIDCCore] section 3.1.2.1. The AD FS server ignores this parameter unless its ad_fs_behavior_level is AD_FS_BEHAVIOR_LEVEL_2 or higher. resource GET HTTP/1.1 OPTIONAL The resource query parameter is OPTIONAL and MAY be specified by the client role of the OAuth 2.0 Protocol Extensions. When an OAuth 2.0 client requests authorization from an (as specified in sections 4.1 and 4.2), it MAY use the resource query parameter to specify the resource secured by the AD FS server for which it requires an authorization grant. The value of the resource query parameter corresponds to the identifier with which the resource, or , is registered with the AD FS server by an administrator.
Note Support for the prompt parameter depends on the AD FS server's ad_fs_behavior_level and the product version. See section 2.2.2 for support information. max_age: OPTIONAL. The client can choose to specify this optional query parameter. It is used in the same way as the max_age parameter defined in [OIDCCore] section 3.1.2.1. id_token_hint: OPTIONAL. The client can choose to specify this optional query parameter. It is used in the same way as the id_token_hint parameter defined in [OIDCCore] section 3.1.2.1. The request message for this method can contain the following optional HTTP headers. The header syntax is defined in section . Request header Value This optional header is used to specify a request identifier which is used when logging errors or failures that occur while processing the request. If the client chooses to use the query parameter, it SHOULD NOT set this HTTP header. A request identifier, MUST be a . The response message for this method does not contain any custom HTTP headers. The response message for this method can result in the status codes defined in [RFC6749] section 4.1.2. Request Body The format of the request is defined in section 4.1.1 (Authorization Request). Response Body The format of the response body is defined in section 4.1.2 (Authorization Response). Processing Details
Processing Details 6642 : Updated support information for the prompt parameter with a link to section 2.2.2. Authorization Code Request with prompt Parameter 6642 : Updated information for the prompt parameter with a link to section 2.2.2. major Appendix B: Product Behavior Updated product version information regarding applicability of protocol.
A 9 C 9 47 E Examples 35 40 37 36 35 39 35 35 40 39 39 39 35 F 9 44 G 6 I 43 43 8 6 J 44 M Messages 11 N 7 O Oauthextension client 23 23 23 23 25 25 23 Oauthextension server 25 27 26 27 34 34 26 8 P 43 9 9 45 Protocol Details 23 25 Protocol examples 35 35 40 37 36 39 35 35 40 39 39 39 35 R References 8 7 8 S Security 43 43 10 T 47 11 V 9