You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/claim-transform-task.md
+13-34Lines changed: 13 additions & 34 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -104,23 +104,17 @@ If the base URL for the API is `https://somewhere.org/myclaimsstore` the URL for
104
104
*The outgoing IP address can be changed and more can be added over time.*
105
105
106
106
#### Request
107
-
The API call is secured with [HTTP Basic authentication scheme](https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1) where FoxIDs sends the ID `external_claims` as the username and the configured secret as the password.
The API must return HTTP code 401 (Unauthorized) and an `error` (required) if the Basic authentication is rejected. Optionally add an error description in `ErrorMessage`.
138
+
The API must return HTTP code 401 (Unauthorized) and an `error` (required) if the Basic auth is rejected. Optionally add an error description in `ErrorMessage`.
160
139
```JSON
161
140
{
162
141
"error": "invalid_api_id_secret",
163
142
"ErrorMessage": "Invalid API ID or secret"
164
143
}
165
144
```
166
145
167
-
If other errors occur, the API should return HTTP code 500 or another appropriate error code.
168
-
It is recommended to add a technical error message in `ErrorMessage`. The error message can then later be found in the FoxIDs logs.
146
+
If other errors occur, the API should return HTTP code 500 or another appropriate error code.
147
+
It is recommended to add a technical error message `ErrorMessage` for diagnostics (it is only logged; never shown to the end user).
169
148
170
149
> Error messages returned from the API in `ErrorMessage` is NOT displayed for the user only logged.
**FoxIDs is a Identity Service (IDS) with support for [OAuth 2.0](oauth-2.0.md), [OpenID Connect 1.0](oidc.md) and [SAML 2.0](saml-2.0.md).**
1
+
**FoxIDs is an Identity Service (IDS) with support for [OAuth 2.0](oauth-2.0.md), [OpenID Connect 1.0](oidc.md) and [SAML 2.0](saml-2.0.md).**
2
2
3
3
> Hosted in Europe / Ownership and data in Europe.
4
4
5
-
FoxIDs is both an [authentication](login.md) platform and a security broker where FoxIDs support[converting](bridge.md) between OpenID Connect 1.0 and SAML 2.0.
5
+
FoxIDs is both an [authentication](login.md) platform and a security broker where FoxIDs supports[converting](bridge.md) between OpenID Connect 1.0 and SAML 2.0.
6
6
7
-
FoxIDs is designed as service with multi-tenant support. Your tenant holds your environments (prod, QA, test, dev or corporate, external-idp, app-a, app-b) and possible[interconnect](howto-environmentlink-foxids.md) the environments.
7
+
FoxIDs is designed as a service with multi-tenant support. Your tenant holds your environments (prod, QA, test, dev or corporate, external-idp, app-a, app-b) and can optionally[interconnect](howto-environmentlink-foxids.md) the environments.
8
8
Each environment is an Identity Provider with a [user repository](users.md) and a unique [certificate](certificates.md).
9
-
An environment can be connected to external Identity Provider with [OpenID Connect 1.0](auth-method-oidc.md) or [SAML 2.0](auth-method-saml-2.0.md) authentication methods.
9
+
An environment can be connected to an external Identity Provider with [OpenID Connect 1.0](auth-method-oidc.md) or [SAML 2.0](auth-method-saml-2.0.md) authentication methods.
10
10
The environment is configured as the IdP for applications and APIs with [OAuth 2.0](app-reg-oauth-2.0.md), [OpenID Connect 1.0](app-reg-oidc.md) or [SAML 2.0](app-reg-saml-2.0.md) application registrations.
11
11
The user's [log in](login.md) experience is configured and optionally [customised](customisation.md).
12
12
13
13
> Take a look at the FoxIDs test configuration in FoxIDs Control: [https://control.foxids.com/test-corp](https://control.foxids.com/test-corp)
14
14
> Get read access with the user `[email protected]` and password `TestAccess!`
15
15
16
-
FoxIDs consist of two services:
16
+
FoxIDs consists of two services:
17
17
18
18
-[FoxIDs](connections.md) - identity service, which handles user log in, OAuth 2.0, OpenID Connect 1.0 and SAML 2.0.
19
19
-[FoxIDs Control](control.md), which is used to configure FoxIDs in a user interface or by calling an API.
20
20
21
-
Hosting:
21
+
Hosting options:
22
22
23
23
- FoxIDs SaaS is available at [FoxIDs Cloud](https://www.foxids.com/action/signup) as an Identity Service (IDS).
24
24
- You can [deploy](deployment.md) FoxIDs anywhere using Docker or Kubernetes (K8s).
@@ -28,17 +28,17 @@ Hosting:
28
28
## Source code available
29
29
30
30
The FoxIDs source code is available at the [GitHub repository](https://github.com/ITfoxtec/FoxIDs).
31
-
The [license](https://github.com/ITfoxtec/FoxIDs/blob/main/LICENSE)grant all the right to install and use FoxIDs for non-production. The license grant small companies including, personal projects and non-profit educational institutions the right to install and use FoxIDs in production.
31
+
The [license](https://github.com/ITfoxtec/FoxIDs/blob/main/LICENSE)grants you the right to install and use FoxIDs for non-production. The license grants small companies, personal projects, and non-profit educational institutions the right to install and use FoxIDs in production.
32
32
33
33
## Selection by URL
34
-
The [structure](foxids-inside.md#structure) of FoxIDs separates the different tenants, environments and [connections](connections.md) which is selected with URL elements.
34
+
The [structure](foxids-inside.md#structure) of FoxIDs separates the different tenants, environments and [connections](connections.md), which are selected via URL elements.
35
35
36
36
If FoxIDs is hosted on e.g., `https://foxidsxxxx.com/` the tenants are separated in the first path element of the URL `https://foxidsxxxx.com/tenant-x/`.
37
37
The environments are separated under each tenant in the second path element of the URL `https://foxidsxxxx.com/tenant-x/environment-y/`.
38
38
39
-
An application registration is call by adding the application registration name as the third path element in the URL `https://foxidsxxxx.com/tenant-x/environment-y/application-z/`.
40
-
An authentication method is call by adding the authentication method name insight round brackets as the third path element in the URL `https://foxidsxxxx.com/tenant-x/environment-y/(auth-method-s)/`.
41
-
If FoxIDs handles a authentication method sequence resulting in a session cookie the same URL notation is used to lock the cookie to the URL.
39
+
An application registration is called by adding the application registration name as the third path element in the URL `https://foxidsxxxx.com/tenant-x/environment-y/application-z/`.
40
+
An authentication method is called by adding the authentication method name inside round brackets as the third path element in the URL `https://foxidsxxxx.com/tenant-x/environment-y/(auth-method-s)/`.
41
+
If FoxIDs handles an authentication method sequence resulting in a session cookie the same URL notation is used to lock the cookie to the URL.
42
42
43
43
When a client (application) starts an OpenID Connect or SAML 2.0 login sequence it needs to specify by which authentication method the user should authenticate.
44
44
The authentication method is selected by adding the authentication method name in round brackets in the URLs third path element after the application registration name `https://foxidsxxxx.com/tenant-x/environment-y/application-z(auth-method-s)/`.
in the URL after the application registration name `https://foxidsxxxx.com/tenant-x/environment-y/application-z(auth-method-s1,auth-method-s2,auth-method-s3,auth-method-s4)/`
51
51
- Select an authentication methods profile by adding the authentication method `+` profile instead of just the authentication method in the URL `https://foxidsxxxx.com/tenant-x/environment-y/application-z(auth-method-s+profile-u)/`
52
52
53
-
> The allowed authentication methods is configured in each [application registration](connections.md#application-registration).
53
+
> The allowed authentication methods are configured in each [application registration](connections.md#application-registration).
54
54
55
-
A client using client credentials as authorization grant would not specify the authentication method.
55
+
A client using the client credentials authorization grant would not specify the authentication method.
56
56
It is likewise optional to specify the authentication method when calling an OpenID Connect discovery document or a SAML 2.0 metadata endpoint.
0 commit comments