Social identity provider settings

Whether the provider is enabled.

Click Edit to open the Edit UI Configuration modal, where you specify a map of properties that determine how the social identity provider button displays in the hosted journey pages.

The client_id parameter as described in section 2.2 of The OAuth 2.0 Authorization Framework specification.

The client_secret parameter as described in section 2.3 of The OAuth 2.0 Authorization Framework specification.

When selected, the Secret Label Identifier field is displayed, allowing you to create a secret label for mapping to a secret in a secret store. This is the recommended way to manage client secrets.

An identifier used to create a secret label for mapping to a secret in a secret store. This field is displayed only when you select Use Secret Store for secrets.

The list of scopes to request from the provider.

The attribute the social identity provider uses to identify an authenticated individual. For example, id, sub, and user_id.

The URL to the social provider’s endpoint handling authentication as described in section 3.1 of The OAuth 2.0 Authorization Framework. For example, https://accounts.google.com/o/oauth2/v2/auth.

The URL to the endpoint handling access tokens as described in section 3.2 of The OAuth 2.0 Authorization Framework specification. For example, https://www.googleapis.com/oauth2/v4/token.

The user profile URL that returns profile information. For example, https://www.googleapis.com/oauth2/v3/userinfo.

The URL to the endpoint handling access token validation, as described in the OOAuth 2.0 Token Introspection specification. For example, https://oauth2.googleapis.com/tokeninfo.

The URL to which the identity provider will redirect the user after authenticating, as described in Section 3.1.2 of The OAuth 2.0 Authorization Framework specification.

The URL of a custom login page or application. Advanced Identity Cloud will send processed form post data related to social login authentication to that URL as the value of the form_post_entry query parameter.

The delimiter used to separate scope values. For example, a blank space (), or a comma character (,).

How the client should authenticate to the provider. Possible values are:

Specifies the PKCE transformation method Advanced Identity Cloud uses when making requests to the provider’s authorization endpoint, as specified in Section 4.2 of the Proof Key for Code Exchange by OAuth Public Clients specification.

(OIDC providers only) Specifies whether Advanced Identity Cloud should provide a request object JWT to the provider. Possible values are:

(OIDC providers only) If selected, the exp claim must be included in JWT request objects in the /oauth2/authorize request.

Specifies whether the request parameter must be encrypted when Request Parameter JWT Option is set to REFERENCE or VALUE.

(OIDC providers only) A space-separated list, in order of preference, of the client’s acr values.

(OIDC providers only) The URL for retrieving information about the provider, such as endpoints, and public keys. For example, https://accounts.google.com/.well-known/openid-configuration.

(OIDC providers only) The intended audience (aud) of the request object when the Request Parameter JWT Option field is set to VALUE or REFERENCE.

(OIDC providers only) The intended audience (aud) of the private key JWT when performing an authentication using the PRIVATE_KEY_JWT client authentication method.

(OIDC providers only) Whether the provider encrypts ID Tokens.

(OIDC providers only) The issuer of ID Tokens.

(OIDC providers only) When selected, the provider native SDK must include a nonce claim in the ID token. The value of the claim must be the value of the nonce claim sent in the Authentication Request.

(OIDC providers only) The format in which the provider’s userinfo endpoint returns data.

The URI that contains the public keys of the identity provider. Advanced Identity Cloud uses these keys to verify signatures or to encrypt objects.

Any claims on the request object, in JSON format. These claims must conform to the claims request parameter, as defined in the OpenID Connect specification.

The signing algorithm supported by the provider that Advanced Identity Cloud uses to sign the following:

The encryption algorithm supported by the provider that Advanced Identity Cloud uses to encrypt client authentication JWTs. Applies only when Client Authentication Method is set to PRIVATE_KEY_JWT, and OIDC providers request JWTs when Request Parameter JWT Option is set to VALUE or REFERENCE.

The encryption method supported by the provider that Advanced Identity Cloud uses to encrypt the following:

Specifies the amount of time, in seconds, that Advanced Identity Cloud will cache the client authentication JWT before creating a new one.

(OIDC providers only) Specify the way the provider returns ID tokens to Advanced Identity Cloud. Possible values are:

Specify one or more options to be used by the TLS certificate revocation checking mechanism.

Specifies whether a custom truststore is used to verify the server certificate of the .well-known endpoint or JWKs URI of an OpenID provider (OP) in a TLS handshake.

(Apple SSO) When selected, this flag indicates that the native app can send the user’s userinfo in JSON format.

if (nodeState.get('nameEmptyOrNull')) {
  action.goTo("true");
} else {
  action.goTo("false");
}

var fr = JavaImporter(org.forgerock.openam.auth.node.api.Action);

if (nodeState.get('nameEmptyOrNull')) {
  action = fr.Action.goTo("true").build();
} else {
action = fr.Action.goTo("false").build();
}

A script to convert the provider’s raw profile object into a normalized object, also referred to as a normalization script.

function () {
    var normalizedProfileData = {};
    normalizedProfileData.id = rawProfile.get('sub');
    normalizedProfileData.displayName = rawProfile.get('name');
    normalizedProfileData.givenName = rawProfile.get('given_name');
    normalizedProfileData.familyName = rawProfile.get('family_name');
    normalizedProfileData.photoUrl = rawProfile.get('picture');
    normalizedProfileData.email = rawProfile.get('email');
    normalizedProfileData.username = rawProfile.get('email');
    normalizedProfileData.locale = rawProfile.get('locale');
    return normalizedProfileData;
}();

(function () {
    var frJava = JavaImporter(
        org.forgerock.json.JsonValue
    );

    var normalizedProfileData = frJava.JsonValue.json(frJava.JsonValue.object());

    normalizedProfileData.put('id', rawProfile.get('sub'));
    normalizedProfileData.put('displayName', rawProfile.get('name'));
    normalizedProfileData.put('givenName', rawProfile.get('given_name'));
    normalizedProfileData.put('familyName', rawProfile.get('family_name'));
    normalizedProfileData.put('photoUrl', rawProfile.get('picture'));
    normalizedProfileData.put('email', rawProfile.get('email'));
    normalizedProfileData.put('username', rawProfile.get('email'));
    normalizedProfileData.put('locale', rawProfile.get('locale'));

    return normalizedProfileData;
}());

("platformAttributeName", rawProfile.providerAttributeName)

(OIDC providers only) Determines how the expected issuer value should match the actual value of the iss claim: