Format
IDs
snapshotId
Format: XXXXXXXXXXXXXXXXXXXXXXXXX
Example: 3b1d1fd97f0b6255356dacf130bb997a
setupId
Format: XXXXXXXXXXXXXXXXXXXXXXXXX
Example: 3b1d1fd97f0b6255356dacf130bb9976
clientId
Format: XXXXXXXXXXXXXXXXXXXXXXXXX
Example: 3b1d1fd97f0b6255356dacf130bb997e
resourceServerId
Format: XXXXXXXXXXXXXXXXXXXXXXXXX
Example: 3b1d1fd97f0b6255356dacf130bb997f
oAuthClientId
Format: Characters from the following list:
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
Example: %21%22%23%24%25%26%27%28%29%2A%2B%2C
Value should be in URL-Encoded format.
Setup resource
| Attribute (V2) | Data type | Example value | Possible values/constraints | Required | Remark |
|---|---|---|---|---|---|
| name | string | Not blank | X | Pretty name of setup | |
| owner | string | <current user> | UserId of owner/creator | ||
| valid_from | date (ISO-8601) | <now> | Not in the past | Activation date/time, set to current date and time if not set. | |
| comment | string | Individual comment | |||
| client_defaults | see table below | X | |||
| resource_defaults | see table below | X | |||
| metadata | metadatadata structure:name, value, locale (all string) | Default Metadata |
client_defaults
| Attribute (V2) | Data type | Example value | Possible values/constraints | Required | Remark |
|---|---|---|---|---|---|
| grant_types | list of strings | authorization_code, client_credentials, implicit, refresh_token | X | OAuth2 flows | |
| force_reauthentication | boolean | false | X | Default setting if client forces re-authentication | |
| access_token_ttl | number | 3600 | positive or zero | X | Default TTL access token, in seconds |
| refresh_token_ttl | number | 15552000 | positive or zero | X | Default TTL refresh token (offline access), in seconds |
| id_token_ttl | number | 3600 | positive or zero | X | Default TTL ID token, in seconds |
| persisted_consent_ttl | number | 31104000 | positive or zero | X | Default TTL persisted consent, in seconds |
resource_defaults
| Attribute (V2) | Data type | Example | Possible values/constraints | Remark |
|---|---|---|---|---|
| scope_policy_implicit_flow | string | consent | consent_required, consent_persisted, no_consent_required, disallowed | Default consent policy for scopes during implicit flow |
| scope_policy_authorization_code_flow | string | consent | consent_required, consent_persisted, no_consent_required, disallowed | Default consent policy for scopes during authorization code flow |
| scope_policy_refresh_token | string | consent | consent_required, consent_persisted, no_consent_required, disallowed | Default consent policy for refresh token |
| scope_policy_force_reauthentication | boolean | false | Default setting if scope requests should force reauthentication |
Client resource
name
Data type: string
Possible values and constraints: Not blank.
Required.
Pretty name of client.
owner
Data type: string
<current user>
UserId of owner/creator.
contacts
Data type: list of strings
Contact information.
valid_from
Data type: date (ISO-8601)
Example: <now>
Possible values and constraints: Not in the past.
Activation date/time, set to current date and time if not set.
comment
Data type: string
Individual comment.
client_id
Data type: string
Possible values and constraints: empty (= regenerate)
If not empty:
When editing an existing client, the client_id must match the client_id of the existing client.
When creating a new client, the client_id must be unique (within the relevant setup) and contain characters from the following list:
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
OAuth2 client ID.
client_secret
Data type: string
Possible values and constraints: empty (= regenerate)
If not empty, the client_secret must contain characters from the following list:
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
OAuth2 client secret.
redirect_uris
Data type: list of strings
OAuth2 redirect URLs.
grant_types
Data type: list of strings
Possible values and constraints: authorization_code, client_credentials, implicit
OAuth2 flows.
authorization_code: If you select this value, set the attribute response_types to code.
implicit: If you select this value, set the attribute response_types to token or id_token.
scopes
Data type: list of strings
Possible values and constraints: all defined scopes of resource servers in the according setup
OAuth2 scopes.
force_reauthentication
Data type: boolean
Example: false
Default setting.
confidentiality_type
Data type: string
Example: public
Possible values and constraints: public, confidential
Required.
response_types
Data type: list of strings
Possible values and constraints: code, token, id_token
code: If you select this value, set the attribute grant_types to authorization_code.
token, id_token: If you select one of these values, set the attribute grant_types to implicit.
pkce_mode
Data type: string
Example: required
Possible values and constraints: allowed, required, s256-required
Defines whether the client requires the use of PKCE in the authorization flow. The following types of PKCE modes are supported:
allowed (default): If the client sends PKCE information in the form of a code challenge in the authorization request, the code challenge will be validated. If the code challenge is not valid, the authorization will fail. But if no code challenge is included in the authorization request, the authorization will not fail.
required: The client must send valid PKCE information. If no code challenge is included in the authorization request, the authorization will fail.
s256-required: The client must send valid PKCE information using the S256 code challenge method. The authorization will fail if no code challenge is included in the authorization request, or if the code challenge does not use the S256 code challenge method.
access_token_ttl
Data type: number
Example: 3600
In seconds.
refresh_token_ttl
Data type: number
Example: 15552000
In seconds.
id_token_ttl
Data type: number
Example: 3600
In seconds.
persisted_consent_ttl
Data type: number
Example: 31104000
In seconds.
metadata
Data type: metadataData, structure:name, value, locale (all string).
Resource server resource
| Attribute (V2) | Data type | Example value | Possible values/constraints | Required | Remark |
|---|---|---|---|---|---|
| name | string | Not blank | X | Pretty name of client | |
| owner | string | <current user> | UserId of owner/creator | ||
| uri | string | Resource (Server) URL | |||
| valid_from | date (ISO-8601) | <now> | Not in the past | Activation date/time, set to current date/time if not set | |
| comment | string | Individual comment | |||
| scopes | see table below | Must contain one or more elements | X | OAuth2 scopes of the according resource (server) | |
| metadata | metadataData structure:name, value, locale (all string) |
scopes
| Attribute (V2) | Data type | Example value | Possible values | Remark |
|---|---|---|---|---|
| policy_implicit_flow | string | consent | consent_required, consent_persisted, no_consent_required, disallowed | Default consent policy for scopes during implicit flow |
| policy_authorization_code_flow | string | consent | consent_required, consent_persisted, no_consent_required, disallowed | Default consent policy for scopes during authorization code flow |
| policy_refresh_token | string | consent | consent_required, consent_persisted, no_consent_required, disallowed | Default consent policy for refresh token |
| policy_force_reauthentication | boolean | false | Default setting if scope requests should force reauthentication | |
| metadata | metadataData structure:name, value, locale (all string) | |||
| custom_claims | Mapping between custom scope and custom openid/oauth2 claim configurated in neivsAuth | test_claim | Default OAuth 2.0/OpenId Connect scopes cannot set custom claims |