Version: 10.0

OIDC Ops Resource

Description

This resource is for managing OpenID Connect (OIDC) Providers used by rWeb. Providers should map to local users that are already created on rWeb, which can also be done via API.

This functionality was added starting in rWeb 9.6.0.

GET /oidc_ops

Returns the set of OIDC Providers currently configured for rWeb. This is a paged query.

GET Response Values

Name	Type	Description
id	JSON Number	The unique ID for this OIDC configuration.
name	JSON String	The display name of this OIDC Provider. This is used internally when displaying entries in this section.
issuer	JSON String	The identity of the OIDC Provider. Must match the `iss` field for ID Tokens from this Provider.
client_id	JSON String	This is the `client_id` that will be presented to the provider, following the Authorization Code Flow.
authorization_endpoint	JSON String	The URL for the initial OIDC Authorization Request. As TLS is required, this must be an 'https' URL.
token_endpoint	JSON String	The URL used for Token Requests. As TLS is required, this must be an 'https' URL.
userinfo_endpoint	JSON String	An optional URL used for making UserInfo requests. As TLS is required, this must be an 'https' URL.
jwks_uri	JSON String	If this is specified, this URI should return a JWK Set document for the public keys used by the Provider in order to verify and/or decrypt an ID Token.
scope	JSON String	The `scope` value used when initiating OIDC Authentication Requests. By default this will be filled out with the required value of 'openid'. Additional values (space separated) can be added as denoted in the specification if supported by your Provider.
username_path	JSON String	This is a JMESPath matcher used to extract the rWeb username from either the ID Token or the UserInfo response (if configured). This rWeb username must already be present and created within rWeb (it will not automatically be created on login). Depending on your Provider you may wish to leverage some of the existing User API for user creation.
created_at	JSON String	The timestamp the OIDC configuration was created, in ISO 8601 format (UTC).
updated_at	JSON String	The timestamp the OIDC configuration was last updated, in ISO 8601 format (UTC).
logout_method	JSON String	This can be either "local" (in which case the user logs out of rWeb but not their OAuth session) or "none" (in which case the user won't have a logout button).
post_logout_redirect_uri	JSON String	If allowed to logout by logout_method, this is the location users will be redirected to. If blank, users will be redirected to a generic logout screen.
metadata_url	JSON String	If the Provider supports using OpenID Provider Configuration Information, this URL will be queried to retrieve the Provider's configuration for required fields (plus optional fields if they are available).
resource	JSON String	The URL for this specific OIDC configuration.

Example GET Request

 GET /oidc_ops

Example GET Response

{
  "data": [
    {
      "id": 1,
      "name": "Riorey Engineering",
      "issuer": "https://keycloak.local.riorey.com/realms/rweb%20test%20clients",
      "client_id": "test_rweb2",
      "authorization_endpoint": "https://keycloak.local.riorey.com/realms/rweb%20test%20clients/protocol/openid-connect/auth",
      "token_endpoint": "https://keycloak.local.riorey.com/realms/rweb%20test%20clients/protocol/openid-connect/token",
      "userinfo_endpoint": "",
      "jwks_uri": "",
      "scope": "openid",
      "username_path": "preferred_username",
      "created_at": "2024-08-22T16:01:27Z",
      "updated_at": "2024-10-18T17:53:40Z",
      "logout_method": "local",
      "post_logout_redirect_uri": "",
      "metadata_url": "",
      "resource": "/oidc_ops/1"
    },
    {
      "id": 2,
      "name": "Googletron",
      "issuer": "https://accounts.google.com",
      "client_id": "totallyrealclientid.apps.googleusercontent.com",
      "authorization_endpoint": "https://accounts.google.com/o/oauth2/v2/auth",
      "token_endpoint": "https://oauth2.googleapis.com/token",
      "userinfo_endpoint": "https://openidconnect.googleapis.com/v1/userinfo",
      "jwks_uri": "https://www.googleapis.com/oauth2/v3/certs",
      "scope": "openid",
      "username_path": "'admin'",
      "created_at": "2024-10-03T21:52:18Z",
      "updated_at": "2024-10-03T23:44:40Z",
      "logout_method": "local",
      "post_logout_redirect_uri": null,
      "metadata_url": "https://accounts.google.com/.well-known/openid-configuration",
      "resource": "/oidc_ops/2"
    }
  ],
  "rows": 2
}

POST /oidc_ops

Create a new OIDC Provider configuration.

POST Parameters

Name	Required	Type	Description	Default Value
name	Yes	JSON String	The display name for this OIDC Provider. If using the rWeb login page this will be displayed on the button for logging in using this Provider.
issuer	Conditional	JSON String	The identity of the OIDC Provider. Must match the `iss` field for ID Tokens from this Provider. If using metadata_url, this can be omitted.
client_id	Yes	JSON String	This is the `client_id` that will be presented to the provider, following the Authorization Code Flow.
client_secret	Yes	JSON String	This is the `client_secret` that will be used for `client_secret_basic` authentication.
authorization_endpoint	Conditional	JSON String	The URL for the initial OIDC Authorization Request. As TLS is required, this must be an 'https' URL. If using metadata_url, this can be omitted.
token_endpoint	Conditional	JSON String	The URL used for Token Requests. As TLS is required, this must be an 'https' URL. If using metadata_url, this can be omitted.
userinfo_endpoint	No	JSON String	An optional URL used for making UserInfo requests. As TLS is required, this must be an 'https' URL.
jwks_uri	No	JSON String	If this is specified, this URI should return a JWK Set document for the public keys used by the Provider in order to verify and/or decrypt an ID Token.
scope	No	JSON String	The `scope` value used when initiating OIDC Authentication Requests. By default this will be filled out with the required value of 'openid'. Additional values (space separated) can be added as denoted in the specification if supported by your Provider.	"openid"
username_path	Yes	JSON String	This is a JMESPath matcher used to extract the rWeb username from either the ID Token or the UserInfo response (if configured) in that order. This rWeb username must already be present and created within rWeb (it will not automatically be created on login). Depending on your Provider you may wish to leverage some of the existing User API for user creation.
logout_method	No	JSON String	This can be either "local" (in which case the user logs out of rWeb but not their OAuth session) or "none" (in which case the user won't have a logout button).	"none"
post_logout_redirect_uri	No	JSON String	If allowed to logout by logout_method, this is the location users will be redirected to. If blank, users will be redirected to a generic logout screen.
metadata_url	No	JSON String	If the Provider supports using OpenID Provider Configuration Information, this URL will be queried to retrieve the Provider's configuration for required fields (plus optional fields if they are available).

POST Response Values

The response will include the new full OIDC Provider configuration object.

Example POST Request

POST /oidc_ops

JSON Body:

{
	"data": {
		"name": "Google OIDC Example",
		"client_id": "someclientid12345.apps.googleusercontent.com",
		"client_secret": "extremelycomplexsecrethere",
		"metadata_url": "https://accounts.google.com/.well-known/openid-configuration",
		"username_path": "'admin'"
	}
}

Example POST Response

{
	"id": 14,
	"name": "Google OIDC Example",
	"issuer": "https://accounts.google.com",
	"client_id": "someclientid12345.apps.googleusercontent.com",
	"authorization_endpoint": "https://accounts.google.com/o/oauth2/v2/auth",
	"token_endpoint": "https://oauth2.googleapis.com/token",
	"userinfo_endpoint": "https://openidconnect.googleapis.com/v1/userinfo",
	"jwks_uri": "https://www.googleapis.com/oauth2/v3/certs",
	"scope": "openid",
	"username_path": "'admin'",
	"created_at": "2025-02-19T18:04:23Z",
	"updated_at": "2025-02-19T18:04:23Z",
	"logout_method": "none",
	"post_logout_redirect_uri": null,
	"metadata_url": "https://accounts.google.com/.well-known/openid-configuration",
	"resource": "/oidc_ops/14"
}

GET /oidc_ops/:ID

Returns the set OIDC Provider configuration by ID.

GET Parameters

Name	Required	Type	Description	Default Value
:ID	Yes	URL	Numeric ID of the OIDC Provider configuration you are querying

GET Response Values

Identical to those provided by the full list GET request, scoped to the individual Provider with the requested ID.

Example GET Request

 GET /oidc_ops/1

Example GET Response

{
	"id": 1,
	"name": "Riorey Engineering",
	"issuer": "https://keycloak.local.riorey.com/realms/rweb%20test%20clients",
	"client_id": "test_rweb2",
	"authorization_endpoint": "https://keycloak.local.riorey.com/realms/rweb%20test%20clients/protocol/openid-connect/auth",
	"token_endpoint": "https://keycloak.local.riorey.com/realms/rweb%20test%20clients/protocol/openid-connect/token",
	"userinfo_endpoint": "",
	"jwks_uri": "",
	"scope": "openid",
	"username_path": "preferred_username",
	"created_at": "2024-08-22T16:01:27Z",
	"updated_at": "2024-10-18T17:53:40Z",
	"logout_method": "local",
	"post_logout_redirect_uri": "",
	"metadata_url": "",
	"resource": "/oidc_ops/1"
}

PUT /oidc_ops/:ID

Updates the OIDC Provider configuration with new values. Any parameter from the POST request can be used; unspecified parameters will continue to use their current value.

PUT Parameters

Name	Required	Type	Description	Default Value
:ID	Yes	URL	Numeric ID of the OIDC Provider configuration you are updating

Example PUT Request

PUT /oidc_ops/14

JSON Body:

{
   "data":{
      "name":"Google Example OIDC Updated",
   }
}

Example PUT Response

HTTP/1.1 200 OK

{
	"id": 14,
	"name": "Google OIDC Example Updated",
	"issuer": "https://accounts.google.com",
	"client_id": "someclientid12345.apps.googleusercontent.com",
	"authorization_endpoint": "https://accounts.google.com/o/oauth2/v2/auth",
	"token_endpoint": "https://oauth2.googleapis.com/token",
	"userinfo_endpoint": "https://openidconnect.googleapis.com/v1/userinfo",
	"jwks_uri": "https://www.googleapis.com/oauth2/v3/certs",
	"scope": "openid",
	"username_path": "'admin'",
	"created_at": "2025-02-19T18:04:23Z",
	"updated_at": "2025-02-19T18:04:27Z",
	"logout_method": "none",
	"post_logout_redirect_uri": null,
	"metadata_url": "https://accounts.google.com/.well-known/openid-configuration",
	"resource": "/oidc_ops/14"
}

DELETE /oidc_ops/:ID

Delete the selected OIDC Provider configurartion.

DELETE Parameters

Name	Required	Type	Description	Default Value
:ID	Yes	URL	Numeric ID of the OIDC configuration

Example DELETE Request

DELETE /oidc_ops/14

Example DELETE Response

HTTP/1.1 200 OK

{
	"id": 14,
	"name": "Google OIDC Example Updated",
	"issuer": "https://accounts.google.com",
	"client_id": "someclientid12345.apps.googleusercontent.com",
	"authorization_endpoint": "https://accounts.google.com/o/oauth2/v2/auth",
	"token_endpoint": "https://oauth2.googleapis.com/token",
	"userinfo_endpoint": "https://openidconnect.googleapis.com/v1/userinfo",
	"jwks_uri": "https://www.googleapis.com/oauth2/v3/certs",
	"scope": "openid",
	"username_path": "'admin'",
	"created_at": "2025-02-19T18:04:23Z",
	"updated_at": "2025-02-19T18:04:27Z",
	"logout_method": "none",
	"post_logout_redirect_uri": null,
	"metadata_url": "https://accounts.google.com/.well-known/openid-configuration",
	"resource": "/oidc_ops/14"
}

Description​

GET /oidc_ops​

GET Response Values​

Example GET Request​

Example GET Response​

POST /oidc_ops​

POST Parameters​

POST Response Values​

Example POST Request​

Example POST Response​

GET /oidc_ops/:ID​

GET Parameters​

GET Response Values​

Example GET Request​

Example GET Response​

PUT /oidc_ops/:ID​

PUT Parameters​

Example PUT Request​

Example PUT Response​

DELETE /oidc_ops/:ID​

DELETE Parameters​

Example DELETE Request​

Example DELETE Response​

Description

GET /oidc_ops

GET Response Values

Example GET Request

Example GET Response

POST /oidc_ops

POST Parameters

POST Response Values

Example POST Request

Example POST Response

GET /oidc_ops/:ID

GET Parameters

GET Response Values

Example GET Request

Example GET Response

PUT /oidc_ops/:ID

PUT Parameters

Example PUT Request

Example PUT Response

DELETE /oidc_ops/:ID

DELETE Parameters

Example DELETE Request

Example DELETE Response