OIDC client auth for GUI

Last modified 22 Sep 2026 16:16 UTC
Table of Contents

This page describes how to configure midPoint to use an OIDC authentication provider for GUI authentication.

This configuration consists of the following parts, both of which take place in the Security Policy configuration:

Create an OIDC module

The OIDC module is configured as oidc in the modules section of the authentication configuration.

The elements of the oidc module configuration are described in the following table.

Name Description Required Type

identifier

Unique identifier among module elements.

This identifier will be used to reference this module.

true

String

client

Parent element for the definition of OIDC client configuration.

Multiple client configurations can be used.

false

Complex client type
See more in the client section below.

focusType

Type of object this authentication module applies to, such as UserType or RoleType.

Default value is UserType.

false

QName

name

Unique name of the authentication module

Deprecated, use identifier instead.

false

String

Configuration details of the individual elements listed in the table above are described in the following sections.

See an example module configuration below.

While client is not mandatory as per specification, in order to successfully configure OIDC GUI authentication, it is necessary to use it.

Available fields in client section

Name Description Required Type

registrationId

Unique identifier of the client.

RegistrationId is used in different URLs path in OIDC workflows, so only correct symbols should be used.

true

String

clientId

Client Identifier set in the OIDC authentication provider

true

String

openIdProvider

Parent element for the definition of OIDC provider endpoints configuration.

true

Complex openIdProvider type

clientAuthenticationMethod

Defines the method midPoint will use to perform client authentication.

Based on the setting chosen here, additional fields may become mandatory. See clientAuthenticationMethod implications.

Possible values: clientSecretBasic, clientSecretPost, clientSecretJwt, privateKeyJwt and none.

false

String

clientSecret

Client secret set in the OIDC authentication provider.

false

ProtectedStringType

simpleProofKey

Parent element holding the private key and information necessary to use it.

false

Complex simpleProofKey type

keyStoreProofKey

Parent element holding information about the private key and the keystore holding it.

false

Complex AbstractKeyStoreKeyType

clientSigningAlgorithm

It specifies which cryptographic algorithm midPoint uses to digitally sign messages it sends to the OIDC provider.

Potential values are RFC7518 §3.1 algorithms.

false

String

idTokenSigningAlgorithm

It specifies the cryptographic algorithm used by the OIDC provider to digitally sign the ID token.

Default value is RS256.

Potential values are RFC7518 §3.1 algorithms.

false

String

scope

This parameter can be used to narrow down the scope of access.

This is a multi-value parameter. For multiple values, add this parameter multiple times, each time with a single value.

The value openid is added by default.

More information in RFC6749 §3.3 definition.

false

String

clientName

false

String

nameOfUsernameAttribute

Name of the attribute, provided by the OIDC authentication provider, referring to the subject of authentication, such as preferred_username.

Default value is sub.

false

String

usePkce

Whether to use Proof Key for Code Exchange (PKCE) for the OIDC authentication flow.
Default value is false.

false

Boolean

Available fields in openIdProvider section

This configuration has one mandatory child element - issuerUri.

Provided that your OIDC authentication provider exposes its metadata on the standard endpoint <issuerUri>/.well-known/openid-configuration, it is enough to only configure the issuerUri element. If that doesn’t apply, all remaining fields become mandatory.

Name Description Required Type

issuerUri

URI for the OIDC authentication provider. This URI is not only accessed by Midpoint, but also by the user’s browser.

true

String

authorizationUri

Uri for the authorization endpoint of the OIDC authentication provider. This URI is accessed by the user’s browser.

false

String

tokenUri

Uri for the token endpoint of the OIDC authentication provider. This URI is accessed by midPoint.

false

String

userInfoUri

Uri for the user info endpoint of the OIDC authentication provider. This URI is accessed by midPoint.

false

String

endSessionUri

Uri for the logout session endpoint of the OIDC authentication provider. This URI is accessed by the user’s browser.

false

String

jwkSetUri

Uri for the OIDC authentication provider’s endpoint providing public keys used for signing JWT tokens. This URI is accessed by midPoint.

false

String

Available fields in simpleProofKey section

Name Description Required Type

privateKey

Private key

true

ProtectedStringType

passphrase

Key passphrase

true

ProtectedStringType

certificate

Certificate

true

ProtectedStringType

AbstractKeyStoreKeyType section

Name Description Required Type

keyStorePath

Path to the keystore file

true

String

keyStorePassword

Password for the keystore

true

ProtectedStringType

keyAlias

Alias of the private key in the keystore

true

ProtectedStringType

keyPassword

Password for the private key with the keyAlias in the keystore

true

ProtectedStringType

Field clientAuthenticationMethod implications

Value Required fields

clientSecretBasic

clientSecret

clientSecretPost

clientSecret

clientSecretJwt

clientSecret and clientSigningAlgorithm

privateKeyJwt

simpleProofKey or keyStoreProofKey

none

none
Field clientAuthenticationMethod itself is not mandatory. When not present, midPoint will rely on the information available on the OIDC discovery endpoint <openIdProvider / issuerUri>/.well-known/openid-configuration.
none is not recommended to use for its security implications, more specifically, lack of them.

Example

This is a simple example of OIDC module configuration, using sample values.

<securityPolicy>
    <authentication>
        <modules>
            ...

            <!-- OIDC module for GUI demo -->
            <oidc>
                <identifier>gui-oidc</identifier>
                <client>
                    <registrationId>oidc-registration</registrationId>
                    <clientId>midpoint</clientId>
                    <clientSecret>
                        <t:clearValue>RwdBxRhOggkDCr321SzyGwkEVvRHd7g1</t:clearValue>
                    </clientSecret>
                    <clientAuthenticationMethod>clientSecretBasic</clientAuthenticationMethod>
                    <nameOfUsernameAttribute>preferred_username</nameOfUsernameAttribute>
                    <openIdProvider>
                        <issuerUri>http://192.168.4.100:8080/realms/master</issuerUri>
                    </openIdProvider>
                </client>
            </oidc>

            ...
        </modules>
    </authentication>
</securityPolicy>

Add a sequence referencing the OIDC module

An authentication sequence defines the authentication flow for a particular channel. It specifies which authentication modules are used and how they participate in the authentication process. To enable OIDC authentication for the GUI, configure a sequence for the GUI channel and reference the OIDC module in it.

The sequence has the following fields:

Name Description Required Type

identifier

Unique sequence identifier. Can be used to reference the sequence.

true

String

channel

Specification of the channel(s) this authentication sequence applies to (GUI, REST, etc.)

true

Complex channel type

module

Specification of an authentication module used in this sequence.

At least one module is required

true

Complex module type

name

A short identifier for administrator diagnostics. Not meant as a user-friendly label. Must be unique.

Deprecated, use identifier instead.

false

String

displayName

Display name of the sequence, shown for identifying the authentication sequence in the GUI.

false

String

description

Free form description (administrator comment).

false

String

requireAssignmentTarget

Required assignment target(s).

The authenticated user must hold all of the listed assignment targets. If not, the authentication sequence will fail.

For multiple targets, add this parameter multiple times, each time with a single value.

Example use case: emergency administrator access - can only work for administrator roles.

Example value: <requireAssignmentTarget oid="00000000-0000-0000-0000-000000000004" relation="org:default" type="c:RoleType"/>

false

ObjectReferenceType

nodeGroup

Required node group(s)

The authenticated user must carry one of the listed node groups (archetypes). If none applies, the authentication sequence will fail.

For multiple targets, add this parameter multiple times, each time with a single value.

Example use case: Only managers can log in to the GUI, but not regular users.

Example value: <nodeGroup oid="05b6933a-b7fc-4543-b8fa-fd8b278ff9ee" relation="org:default" type="c:ArchetypeType"/>

false

ObjectReferenceType

focusBehaviorUpdate

Controls updating of focus authentication behaviour attributes (e.g. failed login count, lockout state)

Possible values:

enabled - update focus authentication behaviour attributes on every login

disabled - never update focus authentication behaviour attributes

failureOnly - update focus authentication behaviour attributes only on failure

Default value is enabled.

false

String

See an example sequence below.

Available fields in channel section

Name Description Required Type

channelId

Name (URI) of the channel this configuration applies to.

The value for OIDC GUI sequence is: http://midpoint.evolveum.com/xml/ns/public/common/channels-3#user

true

String

description

Free form description (administrator comment).

false

String

default

Specifies whether this sequence is the default one for the given channel.

It is used, when no specific sequence is requested (e.g. via URL suffix).

It is recommended to keep one default sequence for each channel in use.

false

Boolean

urlSuffix

URL suffix used to select this authentication sequence specifically.

Must not contain a slash (/).

true

String

Available fields in module section

Name Description Required Type

identifier

Unique module identifier. Used to reference the module by module / identifier.

true

String

name

Reference to the authentication module name.

Value must match the name of an existing authentication module.

Deprecated, use identifier instead.

false

String

description

Free form description (administrator comment).

false

String

order

Ordering number for the module within the sequence.

Modules are sorted by order value

Modules sharing the same order may be evaluated in parallel where the authentication mechanism allows it.

Default value is 100.

false

Integer

necessity

Level of requirement for this module.

Possible values are: sufficient, required, requisite, or optional.

Default value is: sufficient.

false

String

Example

This is a simple example of a sequence referencing an OIDC module configuration, using sample values.

<securityPolicy>
    <authentication>
        ...

        <!-- Sequence referencing the OIDC GUI module demo -->
        <sequence>
            <identifier>gui-oidc</identifier>
            <channel>
                <channelId>http://midpoint.evolveum.com/xml/ns/public/common/channels-3#user</channelId>
                <default>true</default>
                <urlSuffix>gui-oidc</urlSuffix>
            </channel>
            <module>
                <identifier>gui-oidc</identifier>
            </module>
        </sequence>

        ...
    </authentication>
</securityPolicy>
Was this page helpful?
YES NO
Thanks for your feedback