latest--oidc_websso-plugin-schema
shared| Type | object |
|---|---|
| Schema URL | https://catalog.lintel.tools/schemas/schemastore/dwp-exchange-gateway/_shared/latest--oidc_websso-plugin-schema.json |
| Parent schema | dwp-exchange-gateway |
Properties
The identity provider the plugin will interact with to carry our the OpenId Connect auth code flow
Determines whether the JWKS endpoints for your IDP will be internet facing
Additional scopes to request from the authorization endpoint
The audience required to be present in the access token (or introspection results) for successful authorization.
Specifies authorisation cookie name. This is necessary when same instance of Kong is used to protect multiple upstream services with different client ids.
Specifies authorisation cookie lifetime (in seconds).
Reference to the client id env var in the gateway, refer to gateway module for details
The redirect URI passed to the authorization and token endpoints
Uplift configuration to allow moving from a lower confidence_level to a higher one
2 nested properties
Whether to enable uplift
Gateway URI to redirect the user to for uplift. If omitted then redirect will default to the route’s host, path and any query args will be maintained
Defines leeway time (in seconds) when validating: time authentication occurred (auth_time), expiration time after which the token must not be accepted (exp), time at which the JWT was issued (iat) and not before claim which specifies time before which token must not be accepted (nbf).
If true, this route will not forward to the upstream application. Instead, it will end the user's session and redirect to the IDP's logout URI. The IDP's logout URI will then redirect to the application's logout confirmation page, which should have a different path than the logout path, for example, /logout and /signed-out.
Where to redirect the client on logout
Where to redirect the client on logout (for RP Initiated Logout)
If true, the plugin will attempt to revoke the token before redirecting to the IDP's logout URI
The request URI suffix that activates the logout process
The request methods that can activate the logout process
The query argument that activates the logout process
The hostname used for dth-stub
Where to redirect the client on unauthorized requests
Where to redirect the client on forbidden requests
Where to redirect the client when unexpected errors happen with the requests
The groups required to be present in the access token (or introspection results) for successful authorization.
Whether to preserve query arguments even when doing authorization code flow
Verify plugin configuration against discovery
5 nested properties
11 nested properties
The session cookie name
The session cookie idle time in seconds
The number of seconds prior to the session_cookie_lifetime that the session cookie will be renewed
The session cookie lifetime in seconds. Defaults is 1800 seconds (30 minutes)
Reference to the client secret env var in the gateway, refer to gateway module for details
Extra query argument values passed to the authorization endpoint
The URL of the HTTP proxy to use for outgoing requests
The URL of the HTTPS proxy to use for outgoing requests
Extra query arguments passed from the client to the authorization endpoint.
ui_locales URL query-parameter value(s) to pass to the logout endpoint