Authorization

Here you can see all APIs definitions around Authentication and Authorization.

Prerequisites

This document assumes you have created a Developer App and implemented Login with GlobaliD

Available APIs

Get OpenID configuration

Get the OpenID configuration for the Global ID OAuth2 server

GEThttps://auth.global.id/realms/globalid/.well-known/openid-configuration

Response

200

OpenID configuration

Body

application/json

issuerstring

Issuer of the OpenID configuration

authorization_endpointstring

Authorization endpoint

token_endpointstring

Token endpoint

userinfo_endpointstring

User information endpoint

introspection_endpointstring

Introspection endpoint

jwks_uristring

JSON Web Key Set URI

response_types_supportedarray of string

Supported response types

subject_types_supportedarray of string

Supported subject types

id_token_signing_alg_values_supportedarray of string

Supported ID token signing algorithms

token_endpoint_auth_methods_supportedarray of string

Supported token endpoint authentication methods

claims_supportedarray of string

Supported claims

grant_types_supportedarray of string

Supported grant types

code_challenge_methods_supportedarray of string

Supported code challenge methods

scopes_supportedarray of string

Supported scopes

response_modes_supportedarray of string

Supported response modes

token_endpoint_auth_signing_alg_values_supportedarray of string

Supported token endpoint authentication signing algorithms

request_parameter_supportedboolean

Are request parameters supported

request_uri_parameter_supportedboolean

Are request URI parameters supported

require_request_uri_registrationboolean

Is request URI registration required

tls_client_certificate_bound_access_tokensboolean

Are TLS client certificate bound access tokens supported

introspection_endpoint_auth_methods_supportedarray

Supported introspection endpoint authentication methods

Request

JavaScriptCurlPythonHTTP

const response = await fetch('https://auth.global.id/realms/globalid/.well-known/openid-configuration', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Response

200

{
  "issuer": "text",
  "authorization_endpoint": "text",
  "token_endpoint": "text",
  "userinfo_endpoint": "text",
  "introspection_endpoint": "text",
  "jwks_uri": "text",
  "response_types_supported": [
    "text"
  ],
  "subject_types_supported": [
    "text"
  ],
  "id_token_signing_alg_values_supported": [
    "text"
  ],
  "token_endpoint_auth_methods_supported": [
    "text"
  ],
  "claims_supported": [
    "text"
  ],
  "grant_types_supported": [
    "text"
  ],
  "code_challenge_methods_supported": [
    "text"
  ],
  "scopes_supported": [
    "text"
  ],
  "response_modes_supported": [
    "text"
  ],
  "token_endpoint_auth_signing_alg_values_supported": [
    "text"
  ],
  "request_parameter_supported": false,
  "request_uri_parameter_supported": false,
  "require_request_uri_registration": false,
  "tls_client_certificate_bound_access_tokens": false,
  "introspection_endpoint_auth_methods_supported": []
}

Authorization request

GEThttps://auth.global.id/realms/globalid/protocol/openid-connect/auth

Query parameters

Response

302

Redirect to the provided redirect_uri with an authorization code

Request

JavaScriptCurlPythonHTTP

const response = await fetch('https://auth.global.id/realms/globalid/protocol/openid-connect/auth?client_id=text&redirect_uri=text&scope=openid&response_type=code&response_mode=query&state=text&nonce=text', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Get access, refresh token

POSThttps://auth.global.id/realms/globalid/protocol/openid-connect/token

Body

application/x-www-form-urlencoded

one of

PKCECodeRequest (object)BasicCodeRequest (object)ClientCredentialsRequest (object)RefreshRequest (object)

Response

200

Token response

Body

application/json

access_tokenstring

Access token

expires_ininteger

Time in seconds until the token expires

refresh_expires_ininteger

Time in seconds until the refresh token expires

refresh_tokenstring

Refresh token

token_typestring

Type of the token

id_tokenstring

ID token

not-before-policyinteger

Not before policy

session_statestring

Session state

scopestring

Scopes of the token

Request

JavaScriptCurlPythonHTTP

const response = await fetch('https://auth.global.id/realms/globalid/protocol/openid-connect/token', {
    method: 'POST',
    headers: {
      "Content-Type": "application/x-www-form-urlencoded"
    },
    body: JSON.stringify({
      "grant_type": "authorization_code",
      "client_id": "text",
      "redirect_uri": "text",
      "code": "text",
      "code_challenge": "text"
    }),
});
const data = await response.json();

Response

200

{
  "access_token": "text",
  "expires_in": 0,
  "refresh_expires_in": 0,
  "refresh_token": "text",
  "token_type": "text",
  "id_token": "text",
  "not-before-policy": 0,
  "session_state": "text",
  "scope": "text"
}

Introspect JWT token, check if it is valid and information contained

POSThttps://auth.global.id/realms/globalid/protocol/openid-connect/introspect

Body

application/x-www-form-urlencoded

token*string

Token to introspect

client_id*string

Client ID

client_secret*string

Client secret

Response

200

Token introspection response

Body

application/json

expinteger

Expiration time of the token

iatinteger

Issued at time of the token

jtistring

JWT ID of the token

issstring

Issuer of the token

audstring

Audience of the token

substring

Subject of the token

typstring

Type of the token

azpstring

Authorized party of the token

session_statestring

Session state of the token

acrstring

Authentication context class reference of the token

scopestring

Scopes of the token

Example: "openid offline_access"

sidstring

Session ID of the token

globalidstring

GlobaliD name / Universal name

groupsarray of string

Groups the user is part of

client_idstring

Client ID of the token

usernamestring

Username of the token, same as subject of the token

token_typestring

Type of the token

activeboolean

Is the token active

Request

JavaScriptCurlPythonHTTP

const response = await fetch('https://auth.global.id/realms/globalid/protocol/openid-connect/introspect', {
    method: 'POST',
    headers: {
      "Content-Type": "application/x-www-form-urlencoded"
    },
    body: JSON.stringify({
      "token": "text",
      "client_id": "text",
      "client_secret": "text"
    }),
});
const data = await response.json();

Response

200

{
  "exp": 0,
  "iat": 0,
  "jti": "text",
  "iss": "text",
  "aud": "text",
  "sub": "text",
  "typ": "text",
  "azp": "text",
  "session_state": "text",
  "acr": "text",
  "scope": "openid offline_access",
  "sid": "text",
  "globalid": "text",
  "groups": [
    "text"
  ],
  "client_id": "text",
  "username": "text",
  "token_type": "text",
  "active": false
}

Get user information

GEThttps://auth.global.id/realms/globalid/protocol/openid-connect/userinfo

Authorization

BearerAuth

Response

200

User information

Body

application/json

substring

Subject of the token

groupsarray of string

Groups the user is part of

peferred_usernamestring

Preferred username of the user

usernamestring

Username of the user

Request

JavaScriptCurlPythonHTTP

const response = await fetch('https://auth.global.id/realms/globalid/protocol/openid-connect/userinfo', {
    method: 'GET',
    headers: {
      "Authorization": "Bearer JWT"
    },
});
const data = await response.json();

Response

200

{
  "sub": "text",
  "groups": [
    "text"
  ],
  "peferred_username": "text",
  "username": "text"
}

APIs definitions in a OpenAPI file:

12KB

openid_oauth2.yml

OpenAPI file

Next Steps

Now that you have information about the identity, you can call Identity resources.