AuthenticateOidcActionConfig
Request parameters when using an identity provider (IdP) that is compliant with OpenID Connect (OIDC) to authenticate users.
Contents
- AuthorizationEndpoint
-
The authorization endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.
Type: String
Required: Yes
- ClientId
-
The OAuth 2.0 client identifier.
Type: String
Required: Yes
- Issuer
-
The OIDC issuer identifier of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.
Type: String
Required: Yes
- TokenEndpoint
-
The token endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.
Type: String
Required: Yes
- UserInfoEndpoint
-
The user info endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.
Type: String
Required: Yes
- AuthenticationRequestExtraParams
- AuthenticationRequestExtraParams.entry.N.key (key)
- AuthenticationRequestExtraParams.entry.N.value (value)
-
The query parameters (up to 10) to include in the redirect request to the authorization endpoint.
Type: String to string map
Required: No
- ClientSecret
-
The OAuth 2.0 client secret. This parameter is required if you are creating a rule. If you are modifying a rule, you can omit this parameter if you set
UseExistingClientSecretto true.Type: String
Required: No
- OnUnauthenticatedRequest
-
The behavior if the user is not authenticated. The following are possible values:
-
deny
- Return an HTTP 401 Unauthorized error. -
allow
- Allow the request to be forwarded to the target. -
authenticate
- Redirect the request to the IdP authorization endpoint. This is the default value.
Type: String
Valid Values:
deny | allow | authenticateRequired: No
-
- Scope
-
The set of user claims to be requested from the IdP. The default is
openid.To verify which scope values your IdP supports and how to separate multiple values, see the documentation for your IdP.
Type: String
Required: No
- SessionCookieName
-
The name of the cookie used to maintain session information. The default is AWSELBAuthSessionCookie.
Type: String
Required: No
- SessionTimeout
-
The maximum duration of the authentication session, in seconds. The default is 604800 seconds (7 days).
Type: Long
Required: No
- UseExistingClientSecret
-
Indicates whether to use the existing client secret when modifying a rule. If you are creating a rule, you can omit this parameter or set it to false.
Type: Boolean
Required: No
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
