{"action":"created","comment":{"url":"https://api.github.com/repos/okta/okta.github.io/pulls/comments/66822016","id":66822016,"diff_hunk":"@@ -6,12 +6,135 @@ title: OpenID Connect\n # Overview\n \n The OpenID Connect API endpoints enable clients to use [OIDC workflows](http://openid.net/specs/openid-connect-core-1_0.html) with Okta.\n-\n With OpenID Connect, a client can use Okta as a broker. The user authenticates against identity providers like Google, Facebook, LinkedIn, or Microsoft,\n and the client obtains an Okta session.\n \n > This API is currently in **Early Access** status.  It has been tested as thoroughly as a Generally Available feature. Contact Support to enable this feature.\n \n+## Authentication Basics with OAuth 2.0 and OpenID Connect\n+\n+OpenID Connect extends OAuth 2.0:\n+ \n+* Provides a signed `id_token` for the client and a UserInfo endpoint from which you can fetch user attributes.\n+* Provides a standard set of scopes and claims for identities including profile, email, address, and phone.\n+* Suppolies built-in registration, discovery, and metadata for dynamic federations.\n+* Supports enterprise use with high assurance levels and workflows for key SAML use cases.\n+\n+NOTE: illustration needs clean-up, but is it useful here? If not, what do we want?\n+\n+![OpenID Architecture Diagram](/assets/img/openID_overview.png)\n+\n+Think of OAuth 2.0 as an authorization framework for delegeated access to APIs, and OpenID Connect as an extension for authentication scenarios.\n+\n+## OpenID Connect Workflows\n+\n+OpenID Connect provides three basic workflows:\n+\n+* [Implicit flow](implicit-flow)\n+* [Authorization code flow](authorization-code-flow)\n+* [Hybrid flow](hybrid-flow)\n+\n+These flows don't necessarily map one-to-one with the different flows available in Okta. \n+By understanding the underlying flows, you can choose the right flow for your goals.\n+ \n+### Implicit Flow \n+\n+Implicit flow is the simplest, and is most often used for web apps including single-page apps (SPAs), because no \n+authorization code is returned. Implicit flow doesn't verify that the requesting client is the authenticated client.\n+You can't refresh the tokens, so implicit flow is not ideal for mobile device apps.\n+\n+Implicit flow is also called a two-legged flow:\n+\n+1. A client sends an authentication request from a browser app's sign-in page.\n+2. The request is redirected to Okta's authorization endpoint `/outh2/v1/authorize` and evaluated. \n+3. If authorization is successful, Okta returns an `id_token` and an access token (if requested).\n+\n+NOTE: image illustrating the steps here\n+\n+NOTE: Following is the full flow from the spec. Do we need to talk about AS, or is the shorter description above okay?? \n+\n+1. Client prepares an Authentication Request containing the desired request parameters.\n+2. Client sends the request to the Authorization Server.\n+3. Authorization Server Authenticates the End-User.\n+4. Authorization Server obtains End-User Consent/Authorization.\n+5. Authorization Server sends the End-User back to the Client with an ID Token and, if requested, an Access Token.\n+6. Client validates the ID token and retrieves the End-User's Subject Identifier.\n+\n+For example, assume that a movie-industry newspaper wanted to make a SPA available to its subscribers, so\n+they can search for unproduced scripts. Users navigate to a sign-in page and\n+enter their credentials, and the sign-in page sends a request to Okta's endpoint for evaluation. Upon successful authentication,\n+Okta sends an `id_token` and access token to the newspaper's server, which then serves the single-page app to the browser.\n+\n+### Authorization Code Flow\n+\n+Authorization code flow verifies that the requesting client is the authenticated client.\n+Instead of receiving an `id_token`, the authorization code flow returns an authorization code, which can be","path":"_source/docs/api/resources/oidc.md","position":67,"original_position":67,"commit_id":"caefcfd37730023f298c923b3fd7324aadde47b4","original_commit_id":"caefcfd37730023f298c923b3fd7324aadde47b4","user":{"login":"larsjohansen-okta","id":9053598,"avatar_url":"https://avatars.githubusercontent.com/u/9053598?v=3","gravatar_id":"","url":"https://api.github.com/users/larsjohansen-okta","html_url":"https://github.com/larsjohansen-okta","followers_url":"https://api.github.com/users/larsjohansen-okta/followers","following_url":"https://api.github.com/users/larsjohansen-okta/following{/other_user}","gists_url":"https://api.github.com/users/larsjohansen-okta/gists{/gist_id}","starred_url":"https://api.github.com/users/larsjohansen-okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/larsjohansen-okta/subscriptions","organizations_url":"https://api.github.com/users/larsjohansen-okta/orgs","repos_url":"https://api.github.com/users/larsjohansen-okta/repos","events_url":"https://api.github.com/users/larsjohansen-okta/events{/privacy}","received_events_url":"https://api.github.com/users/larsjohansen-okta/received_events","type":"User","site_admin":false},"body":"The end goal for this flow is also to get an id token, in fact that's the expected result from all the 3 flows, else they wouldn't be considered OIDC flows. So I would change this sentence slightly: ```Instead of receiving an `id_token` directly from the authorization endpoint, the client receives an authorization code which can be exchanged for an access token, refresh token and `id_token`.```","created_at":"2016-06-13T16:19:00Z","updated_at":"2016-06-13T16:19:00Z","html_url":"https://github.com/okta/okta.github.io/pull/272#discussion_r66822016","pull_request_url":"https://api.github.com/repos/okta/okta.github.io/pulls/272","_links":{"self":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/comments/66822016"},"html":{"href":"https://github.com/okta/okta.github.io/pull/272#discussion_r66822016"},"pull_request":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/272"}}},"pull_request":{"url":"https://api.github.com/repos/okta/okta.github.io/pulls/272","id":73508716,"html_url":"https://github.com/okta/okta.github.io/pull/272","diff_url":"https://github.com/okta/okta.github.io/pull/272.diff","patch_url":"https://github.com/okta/okta.github.io/pull/272.patch","issue_url":"https://api.github.com/repos/okta/okta.github.io/issues/272","number":272,"state":"open","locked":false,"title":"overview for OIDC flows first draft","user":{"login":"mystiberry-okta","id":17009066,"avatar_url":"https://avatars.githubusercontent.com/u/17009066?v=3","gravatar_id":"","url":"https://api.github.com/users/mystiberry-okta","html_url":"https://github.com/mystiberry-okta","followers_url":"https://api.github.com/users/mystiberry-okta/followers","following_url":"https://api.github.com/users/mystiberry-okta/following{/other_user}","gists_url":"https://api.github.com/users/mystiberry-okta/gists{/gist_id}","starred_url":"https://api.github.com/users/mystiberry-okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mystiberry-okta/subscriptions","organizations_url":"https://api.github.com/users/mystiberry-okta/orgs","repos_url":"https://api.github.com/users/mystiberry-okta/repos","events_url":"https://api.github.com/users/mystiberry-okta/events{/privacy}","received_events_url":"https://api.github.com/users/mystiberry-okta/received_events","type":"User","site_admin":false},"body":"@federations-okta this is a very drafty first draft of overview content for OIDC, meant to explain OIDC flows and, I think, map to our definition of different types of apps.\r\n\r\nIt's not ready for a line-by-line review (and the images are rough, not the final images), but can you look at it, and at-mention me if you'd like to participate in a one-hour review meeting so I can turn this into a good final draft. Will schedule for Wed. or Tuesday if RN work goes well.\r\n\r\ncomments like \"this is way off target\" or \"close but you've got errors\" or \"don't start with the spec-defined flows, start with our app types\" are most helpful at this stage.\r\n\r\n","created_at":"2016-06-12T22:04:07Z","updated_at":"2016-06-13T16:19:00Z","closed_at":null,"merged_at":null,"merge_commit_sha":"af75de1e5a7cd69b628554e6c8c6f69a1dbe81f0","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/okta/okta.github.io/pulls/272/commits","review_comments_url":"https://api.github.com/repos/okta/okta.github.io/pulls/272/comments","review_comment_url":"https://api.github.com/repos/okta/okta.github.io/pulls/comments{/number}","comments_url":"https://api.github.com/repos/okta/okta.github.io/issues/272/comments","statuses_url":"https://api.github.com/repos/okta/okta.github.io/statuses/caefcfd37730023f298c923b3fd7324aadde47b4","head":{"label":"okta:doc-88122","ref":"doc-88122","sha":"caefcfd37730023f298c923b3fd7324aadde47b4","user":{"login":"okta","id":362460,"avatar_url":"https://avatars.githubusercontent.com/u/362460?v=3","gravatar_id":"","url":"https://api.github.com/users/okta","html_url":"https://github.com/okta","followers_url":"https://api.github.com/users/okta/followers","following_url":"https://api.github.com/users/okta/following{/other_user}","gists_url":"https://api.github.com/users/okta/gists{/gist_id}","starred_url":"https://api.github.com/users/okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/okta/subscriptions","organizations_url":"https://api.github.com/users/okta/orgs","repos_url":"https://api.github.com/users/okta/repos","events_url":"https://api.github.com/users/okta/events{/privacy}","received_events_url":"https://api.github.com/users/okta/received_events","type":"Organization","site_admin":false},"repo":{"id":10953058,"name":"okta.github.io","full_name":"okta/okta.github.io","owner":{"login":"okta","id":362460,"avatar_url":"https://avatars.githubusercontent.com/u/362460?v=3","gravatar_id":"","url":"https://api.github.com/users/okta","html_url":"https://github.com/okta","followers_url":"https://api.github.com/users/okta/followers","following_url":"https://api.github.com/users/okta/following{/other_user}","gists_url":"https://api.github.com/users/okta/gists{/gist_id}","starred_url":"https://api.github.com/users/okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/okta/subscriptions","organizations_url":"https://api.github.com/users/okta/orgs","repos_url":"https://api.github.com/users/okta/repos","events_url":"https://api.github.com/users/okta/events{/privacy}","received_events_url":"https://api.github.com/users/okta/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/okta/okta.github.io","description":"Okta Identity Platform API Docs and Developer Home","fork":false,"url":"https://api.github.com/repos/okta/okta.github.io","forks_url":"https://api.github.com/repos/okta/okta.github.io/forks","keys_url":"https://api.github.com/repos/okta/okta.github.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/okta/okta.github.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/okta/okta.github.io/teams","hooks_url":"https://api.github.com/repos/okta/okta.github.io/hooks","issue_events_url":"https://api.github.com/repos/okta/okta.github.io/issues/events{/number}","events_url":"https://api.github.com/repos/okta/okta.github.io/events","assignees_url":"https://api.github.com/repos/okta/okta.github.io/assignees{/user}","branches_url":"https://api.github.com/repos/okta/okta.github.io/branches{/branch}","tags_url":"https://api.github.com/repos/okta/okta.github.io/tags","blobs_url":"https://api.github.com/repos/okta/okta.github.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/okta/okta.github.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/okta/okta.github.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/okta/okta.github.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/okta/okta.github.io/statuses/{sha}","languages_url":"https://api.github.com/repos/okta/okta.github.io/languages","stargazers_url":"https://api.github.com/repos/okta/okta.github.io/stargazers","contributors_url":"https://api.github.com/repos/okta/okta.github.io/contributors","subscribers_url":"https://api.github.com/repos/okta/okta.github.io/subscribers","subscription_url":"https://api.github.com/repos/okta/okta.github.io/subscription","commits_url":"https://api.github.com/repos/okta/okta.github.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/okta/okta.github.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/okta/okta.github.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/okta/okta.github.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/okta/okta.github.io/contents/{+path}","compare_url":"https://api.github.com/repos/okta/okta.github.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/okta/okta.github.io/merges","archive_url":"https://api.github.com/repos/okta/okta.github.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/okta/okta.github.io/downloads","issues_url":"https://api.github.com/repos/okta/okta.github.io/issues{/number}","pulls_url":"https://api.github.com/repos/okta/okta.github.io/pulls{/number}","milestones_url":"https://api.github.com/repos/okta/okta.github.io/milestones{/number}","notifications_url":"https://api.github.com/repos/okta/okta.github.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/okta/okta.github.io/labels{/name}","releases_url":"https://api.github.com/repos/okta/okta.github.io/releases{/id}","deployments_url":"https://api.github.com/repos/okta/okta.github.io/deployments","created_at":"2013-06-25T23:22:38Z","updated_at":"2016-04-19T07:31:50Z","pushed_at":"2016-06-13T16:05:23Z","git_url":"git://github.com/okta/okta.github.io.git","ssh_url":"git@github.com:okta/okta.github.io.git","clone_url":"https://github.com/okta/okta.github.io.git","svn_url":"https://github.com/okta/okta.github.io","homepage":"http://developer.okta.com/","size":28706,"stargazers_count":12,"watchers_count":12,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":36,"mirror_url":null,"open_issues_count":20,"forks":36,"open_issues":20,"watchers":12,"default_branch":"master"}},"base":{"label":"okta:master","ref":"master","sha":"72ca34959ce5debd6d7f77c913cc33c419cfc187","user":{"login":"okta","id":362460,"avatar_url":"https://avatars.githubusercontent.com/u/362460?v=3","gravatar_id":"","url":"https://api.github.com/users/okta","html_url":"https://github.com/okta","followers_url":"https://api.github.com/users/okta/followers","following_url":"https://api.github.com/users/okta/following{/other_user}","gists_url":"https://api.github.com/users/okta/gists{/gist_id}","starred_url":"https://api.github.com/users/okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/okta/subscriptions","organizations_url":"https://api.github.com/users/okta/orgs","repos_url":"https://api.github.com/users/okta/repos","events_url":"https://api.github.com/users/okta/events{/privacy}","received_events_url":"https://api.github.com/users/okta/received_events","type":"Organization","site_admin":false},"repo":{"id":10953058,"name":"okta.github.io","full_name":"okta/okta.github.io","owner":{"login":"okta","id":362460,"avatar_url":"https://avatars.githubusercontent.com/u/362460?v=3","gravatar_id":"","url":"https://api.github.com/users/okta","html_url":"https://github.com/okta","followers_url":"https://api.github.com/users/okta/followers","following_url":"https://api.github.com/users/okta/following{/other_user}","gists_url":"https://api.github.com/users/okta/gists{/gist_id}","starred_url":"https://api.github.com/users/okta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/okta/subscriptions","organizations_url":"https://api.github.com/users/okta/orgs","repos_url":"https://api.github.com/users/okta/repos","events_url":"https://api.github.com/users/okta/events{/privacy}","received_events_url":"https://api.github.com/users/okta/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/okta/okta.github.io","description":"Okta Identity Platform API Docs and Developer Home","fork":false,"url":"https://api.github.com/repos/okta/okta.github.io","forks_url":"https://api.github.com/repos/okta/okta.github.io/forks","keys_url":"https://api.github.com/repos/okta/okta.github.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/okta/okta.github.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/okta/okta.github.io/teams","hooks_url":"https://api.github.com/repos/okta/okta.github.io/hooks","issue_events_url":"https://api.github.com/repos/okta/okta.github.io/issues/events{/number}","events_url":"https://api.github.com/repos/okta/okta.github.io/events","assignees_url":"https://api.github.com/repos/okta/okta.github.io/assignees{/user}","branches_url":"https://api.github.com/repos/okta/okta.github.io/branches{/branch}","tags_url":"https://api.github.com/repos/okta/okta.github.io/tags","blobs_url":"https://api.github.com/repos/okta/okta.github.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/okta/okta.github.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/okta/okta.github.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/okta/okta.github.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/okta/okta.github.io/statuses/{sha}","languages_url":"https://api.github.com/repos/okta/okta.github.io/languages","stargazers_url":"https://api.github.com/repos/okta/okta.github.io/stargazers","contributors_url":"https://api.github.com/repos/okta/okta.github.io/contributors","subscribers_url":"https://api.github.com/repos/okta/okta.github.io/subscribers","subscription_url":"https://api.github.com/repos/okta/okta.github.io/subscription","commits_url":"https://api.github.com/repos/okta/okta.github.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/okta/okta.github.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/okta/okta.github.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/okta/okta.github.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/okta/okta.github.io/contents/{+path}","compare_url":"https://api.github.com/repos/okta/okta.github.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/okta/okta.github.io/merges","archive_url":"https://api.github.com/repos/okta/okta.github.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/okta/okta.github.io/downloads","issues_url":"https://api.github.com/repos/okta/okta.github.io/issues{/number}","pulls_url":"https://api.github.com/repos/okta/okta.github.io/pulls{/number}","milestones_url":"https://api.github.com/repos/okta/okta.github.io/milestones{/number}","notifications_url":"https://api.github.com/repos/okta/okta.github.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/okta/okta.github.io/labels{/name}","releases_url":"https://api.github.com/repos/okta/okta.github.io/releases{/id}","deployments_url":"https://api.github.com/repos/okta/okta.github.io/deployments","created_at":"2013-06-25T23:22:38Z","updated_at":"2016-04-19T07:31:50Z","pushed_at":"2016-06-13T16:05:23Z","git_url":"git://github.com/okta/okta.github.io.git","ssh_url":"git@github.com:okta/okta.github.io.git","clone_url":"https://github.com/okta/okta.github.io.git","svn_url":"https://github.com/okta/okta.github.io","homepage":"http://developer.okta.com/","size":28706,"stargazers_count":12,"watchers_count":12,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":36,"mirror_url":null,"open_issues_count":20,"forks":36,"open_issues":20,"watchers":12,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/272"},"html":{"href":"https://github.com/okta/okta.github.io/pull/272"},"issue":{"href":"https://api.github.com/repos/okta/okta.github.io/issues/272"},"comments":{"href":"https://api.github.com/repos/okta/okta.github.io/issues/272/comments"},"review_comments":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/272/comments"},"review_comment":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/okta/okta.github.io/pulls/272/commits"},"statuses":{"href":"https://api.github.com/repos/okta/okta.github.io/statuses/caefcfd37730023f298c923b3fd7324aadde47b4"}}}}
{"actor":{"display_login":"larsjohansen-okta"}}