Revision Summary Date Revision History Revision Class Comments 7/14/2016 1.0 New Released new document. 6/1/2017 2.0 Major Significantly changed the technical content. 6/13/2017 3.0 Major Significantly changed the technical content. 9/15/2017 4.0 Major Significantly changed the technical content.
unique_name: REQUIRED. A locally unique identifier within the Issuer for the end user. This is similar to the sub ([OIDCCore] section 2), but the value provided is always consistent across all clients (similar to a public subject identifier, as described in [OIDCCore] section 8). Whenever possible, the value should be human-readable and meaningful to the end user who authenticated. pwd_exp: OPTIONAL. An integer that expresses the number of seconds until the end user's password or a similar authentication secret, such as a PIN, expires. pwd_url: OPTIONAL. The that the end user can visit in order to change their password or similar authentication secret. OpenID Provider Metadata OpenID Provider Metadata provides information the OpenID connect provider, as described in section 3. Note: The end_session_endpoint metadata field defined in the section 2.1 is required for the OpenID Connect 1.0 Protocol Extensions.<2> The OpenID Connect 1.0 Protocol Extensions extend OpenID Provider Metadata by adding a number of fields. See [OIDCDiscovery] section 3 for the OpenID Provider Metadata with the standard fields. The extended fields are defined as follows. access_token_issuer: OPTIONAL. A string that specifies the issuer for access tokens issued by the OpenID provider. microsoft_multi_refresh_token: OPTIONAL. A Boolean that indicates whether the OpenID provider supports , which are refresh tokens that can be redeemed for an access token for any resource registered with the . capabilities: OPTIONAL. A of strings describing additional protocol capabilities that are supported by the AD FS server.<3>
password but does have a similar authentication secret such as a PIN that can be interactively changed by visiting a particular URL, the server can provide that URL instead.<8> POST This method is transported by an HTTP POST. The method can be invoked through the following : /authorize The format of the authorization request is specified in sections 3.1.2.1, 3.2.2.1, and 3.3.2.1. The OpenID Connect 1.0 client MUST specify the parameters marked as REQUIRED in sections. In addition to the [OIDCCore] parameters mentioned previously, the OpenID Connect 1.0 client uses the parameters and HTTP headers given in section 3.2.5.1.1. Request Body The format of the request is defined in sections 3.1.2.1, 3.2.2.1, and 3.3.2.1. Response Body The format of the response body is defined in sections 3.1.2.5, 3.2.2.5, and 3.3.2.5 for successful responses, and sections 3.1.2.6, 3.2.2.6, and 3.3.2.6 for error responses. Processing Details The steps performed by the to respond to an authentication request are the same as those defined in section for the client. Token endpoint (/token) As defined in sections 3.1.3 and 3.3.3, the client uses the token endpoint to retrieve an ID Token, an access token, and optionally a refresh token by presenting its authorization grant or refresh token. The following HTTP methods are allowed to be performed on this resource. HTTP method Description POST A token request is issued by the OpenID Connect 1.0 client to the token endpoint of the in accordance with the requirements of [OIDCCore] sections 3.1.3 and 3.3.3.
Index A Abstract data model 11 14 8 7 C 8 25 9 Client 11 11 11 11 14 11 11 14 11 D 9 E Examples 21 21 21 Extensions 9 9 F 8 G 5 H 9 triggered events 11 15 I 22 22 7 Initialization 11 15 5 L 8 M 9 Message processing 11 15 Messages 9 N 6 O Openid connect extension client 11 11 11 11 14 14 11 Openid connect extension server 14 15 15 15 20 20 14 Other local events 14 20 7 P 9 22 7 7 23 Protocol Details 11 11 14 14 Protocol examples 21 21 8 7 Q