Create

POST

/api/web/custom/namespaces/{namespace}/oidc_providers

const url = 'https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/web/custom/namespaces/example/oidc_providers';
const options = {
  method: 'POST',
  headers: {Authorization: '<Authorization>', 'Content-Type': 'application/json'},
  body: '{"namespace":"example","spec":{"azure_oidc_spec_type":{"authorization_url":"example","backchannel_logout":true,"client_id":"example","client_secret":"example","default_scopes":"example","issuer":"example","jwks_url":"example","logout_url":"example","prompt":"UNSPECIFIED","token_url":"example","user_info_url":"example"},"google_oidc_spec_type":{"client_id":"example","client_secret":"example","hosted_domain":"example"},"oidc_v10_spec_type":{"allowed_clock_skew":"example","authorization_url":"example","backchannel_logout":true,"client_id":"example","client_secret":"example","default_scopes":"example","disable_user_info":true,"display_name":"example","forwarded_query_parameters":"example","issuer":"example","jwks_url":"example","logout_url":"example","pass_current_locale":true,"pass_login_hint":true,"prompt":"UNSPECIFIED","token_url":"example","user_info_url":"example","validate_signatures":true},"okta_oidc_spec_type":{"authorization_url":"example","backchannel_logout":true,"client_id":"example","client_secret":"example","default_scopes":"example","issuer":"example","jwks_url":"example","logout_url":"example","prompt":"UNSPECIFIED","token_url":"example","user_info_url":"example"},"provider_type":"DEFAULT"}}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/web/custom/namespaces/example/oidc_providers \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "namespace": "example", "spec": { "azure_oidc_spec_type": { "authorization_url": "example", "backchannel_logout": true, "client_id": "example", "client_secret": "example", "default_scopes": "example", "issuer": "example", "jwks_url": "example", "logout_url": "example", "prompt": "UNSPECIFIED", "token_url": "example", "user_info_url": "example" }, "google_oidc_spec_type": { "client_id": "example", "client_secret": "example", "hosted_domain": "example" }, "oidc_v10_spec_type": { "allowed_clock_skew": "example", "authorization_url": "example", "backchannel_logout": true, "client_id": "example", "client_secret": "example", "default_scopes": "example", "disable_user_info": true, "display_name": "example", "forwarded_query_parameters": "example", "issuer": "example", "jwks_url": "example", "logout_url": "example", "pass_current_locale": true, "pass_login_hint": true, "prompt": "UNSPECIFIED", "token_url": "example", "user_info_url": "example", "validate_signatures": true }, "okta_oidc_spec_type": { "authorization_url": "example", "backchannel_logout": true, "client_id": "example", "client_secret": "example", "default_scopes": "example", "issuer": "example", "jwks_url": "example", "logout_url": "example", "prompt": "UNSPECIFIED", "token_url": "example", "user_info_url": "example" }, "provider_type": "DEFAULT" } }'

Create creates an OIDC provider in F5XC Identity. Currently we support creating provider for brokering Google identity provider and any generic OIDC provider that support OpenID Connect protocol V1.0. To configure type Google (provider_type 1), user is not required to provide well-known URL details as its already pre-configured. Parameters such as client ID, client secret and additional optional parameters as specified in the create schema needs to be provided. To configure default type (provider_type 0), user needs to provide well-known URLs and additional fields as required part of create schema. Check create response section for the details on action that needs to be taken POST sending a successful create request.

Examples of this operation.

Authorizations

ApiToken

Parameters

Path Parameters

namespace

required

string

Namespace Supports only system namespace.

Request Body^required

application/json

Create Request

Create request shape for creating an OIDC provider in IAM.

object

namespace

namespace

Supports only system namespace.

string

>= 6 characters <= 1024 characters

spec

object

azure_oidc_spec_type

object

authorization_url

authorization url

The authorization URL of your OIDC application. Required: YES.

string

<= 1024 characters

backchannel_logout

backchannel logout

Does the external IDP support backchannel logout?

boolean format: boolean

client_id

client ID

Client ID of the OIDC application registered with Azure provider. REQUIRED field Required: YES.

string

<= 1024 characters

client_secret

client secret

Secret of the OIDC application registered with Azure provider. Required: YES.

string

<= 1024 characters

default_scopes

default scopes

The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. The recommendation is to set the default scopes as ‘openid profile email’ and is to add additional scopes if needed.

string

<= 256 characters

issuer

issuer

The issuer identifier for the issuer of the response. If not provided, no validation will be performed.

string

<= 1024 characters

jwks_url

JWKS URL

URL where identity provider keys in JWK format are stored.

string

<= 1024 characters

logout_url

logout url

Logout URL specified in your OIDC application.

string

<= 1024 characters

prompt

string

default: UNSPECIFIED

Allowed values: UNSPECIFIED NONE CONSENT LOGIN SELECT_ACCOUNT

token_url

token url

The token URL of your OIDC application. Required: YES.

string

<= 1024 characters

user_info_url

user info url

The User Info URL specified in your OIDC application.

string

<= 1024 characters

google_oidc_spec_type

object

client_id

client ID

Client ID of the OIDC application registered with google provider. REQUIRED field Required: YES.

string

<= 1024 characters

client_secret

client secret

Secret of the OIDC application registered with google provider. Required: YES.

string

<= 1024 characters

hosted_domain

hosted domain

Set hosted domain to restrict user input on login form to use email address from this email domain. For example, setting value company.com will enforce user email input to have only username@company.com leave empty if no restriction is required for email address. Ie for example allow user@company1.com and user@company2.com.

string

<= 1024 characters

oidc_v10_spec_type

object

allowed_clock_skew

allowed clock skew

Clock skew in seconds that is tolerated when validating identity provider tokens. Default value is zero.

string format: int64

<= 1024 characters

authorization_url

authorization url

The authorization URL of your OIDC application. Required: YES.

string

<= 1024 characters

backchannel_logout

backchannel logout

Does the external IDP support backchannel logout?

boolean format: boolean

client_id

client ID

Client ID of the OIDC application registered with your identity/OIDC provider. Required: YES.

string

<= 1024 characters

client_secret

client secret

Secret of the OIDC application registered with your identity/OIDC provider. Required: YES.

string

<= 1024 characters

default_scopes

default scopes

string

<= 256 characters

disable_user_info

disable user info

Disable fetching of user info information.

boolean format: boolean

display_name

display name

Friendly name for identity provider.

string

<= 1024 characters

forwarded_query_parameters

forwarded query parameters

Non OpenID Connect/OAuth standard query parameters to be forwarded to external IDP from the initial application request to Authorization Endpoint. Multiple parameters can be entered, separated by comma (,).

string

<= 1024 characters

issuer

issuer

The issuer identifier for the issuer of the response. If not provided, no validation will be performed.

string

<= 1024 characters

jwks_url

JWKS URL

URL where identity provider keys in JWK format are stored.

string

<= 1024 characters

logout_url

logout url

Logout URL specified in your OIDC application.

string

<= 1024 characters

pass_current_locale

pass current locale

Pass the current locale to the identity provider.

boolean format: boolean

pass_login_hint

pass login hint

Pass login_hint to identity provider.

boolean format: boolean

prompt

string

default: UNSPECIFIED

Allowed values: UNSPECIFIED NONE CONSENT LOGIN SELECT_ACCOUNT

token_url

token url

The token URL of your OIDC application. Required: YES.

string

<= 1024 characters

user_info_url

user info url

The User Info URL specified in your OIDC application.

string

<= 1024 characters

validate_signatures

validate signatures

Enable/disable signature validation of external IDP signatures.

boolean format: boolean

okta_oidc_spec_type

object

authorization_url

authorization url

The authorization URL of your OIDC application. Required: YES.

string

<= 1024 characters

backchannel_logout

backchannel logout

Does the external IDP support backchannel logout?

boolean format: boolean

client_id

client ID

Client ID of the OIDC application registered with Azure provider. Required: YES.

string

<= 1024 characters

client_secret

client secret

Secret of the OIDC application registered with Azure provider. Required: YES.

string

<= 1024 characters

default_scopes

default scopes

string

<= 256 characters

issuer

issuer

The issuer identifier for the issuer of the response. If not provided, no validation will be performed.

string

<= 1024 characters

jwks_url

JWKS URL

URL where identity provider keys in JWK format are stored.

string

<= 1024 characters

logout_url

logout url

Logout URL specified in your OIDC application.

string

<= 1024 characters

prompt

string

default: UNSPECIFIED

Allowed values: UNSPECIFIED NONE CONSENT LOGIN SELECT_ACCOUNT

token_url

token url

The token URL of your OIDC application. Required: YES.

string

<= 1024 characters

user_info_url

user info url

The User Info URL specified in your OIDC application.

string

<= 1024 characters

provider_type

string

default: DEFAULT

Allowed values: DEFAULT GOOGLE AZURE OKTA

Responses

200

A successful response.

application/json

Create Response

Create response is the response format for the response of request to create an OIDC provider in IAM.

object

err

string

default: EUNKNOWN

Allowed values: EUNKNOWN EOK EEXISTS EFAILED ENOTFOUND

post_logout_redirect_uri

Post logout redirect URI

X-displayName : “Logout Redirect URI” After successful logout, OIDC application may require redirect URI to be white-listed. Configure this URI in your OIDC app so user logout is correctly sent back our identity which will then redirect back to console app’s redirect.

string

<= 1024 characters

redirect_uri

redirect uri

Upon successful creation of OIDC provider object, User needs to whitelist/allow value of this redirect URI in their OIDC application’s allowed redirect URLs. This is required as part of the OIDC authentication process, F5XC identity will be brokering the request for authentication and will be sending authentication request with URL set in the redirect_uri. POST successful authentication of client browser and your identity provider, identity provider sends response back to F5 Distributed Cloud identity as per this redirect URI. So its a must that user has updated their OIDC application with this redirect URL as valid for authentication to go through.

string

<= 1024 characters

Example

{
  "err": "EUNKNOWN"
}

401

Returned when operation is not authorized.

application/json

string format: string

Example^generated

example

403

Returned when there is no permission to access resource.

application/json

string format: string

Example^generated

example

404

Returned when resource is not found.

application/json

string format: string

Example^generated

example

409

Returned when operation on resource is conflicting with current value.

application/json

string format: string

Example^generated

example

429

Returned when operation has been rejected as it is happening too frequently.

application/json

string format: string

Example^generated

example

500

Returned when server encountered an error in processing API.

application/json

string format: string

Example^generated

example

503

Returned when service is unavailable temporarily.

application/json

string format: string

Example^generated

example

504

Returned when server timed out processing request.

application/json

string format: string

Example^generated

example

Create

Authorizations

Parameters

Path Parameters

Request Bodyrequired

Responses

200

Example

401

Examplegenerated

403

Examplegenerated

404

Examplegenerated

409

Examplegenerated

429

Examplegenerated

500

Examplegenerated

503

Examplegenerated

504

Examplegenerated

Request Body^required

Example^generated

Example^generated

Example^generated

Example^generated

Example^generated

Example^generated

Example^generated

Example^generated