The authorize endpoint can be used to request tokens or authorization codes via the browser. This process typically involves authentication of the end-user and optionally consent.
IdentityServer supports a subset of the OpenID Connect and OAuth 2.0 authorize request parameters. For a full list, see here.
- identifier of the client (required).
- one or more registered scopes (required)
- must exactly match one of the allowed redirect URIs for that client (required)
id_tokenrequests an identity token (only identity scopes are allowed)
tokenrequests an access token (only resource scopes are allowed)
id_token tokenrequests an identity token and an access token
coderequests an authorization code
code id_tokenrequests an authorization code and identity token
code id_token tokenrequests an authorization code, identity token and access token
form_postsends the token response as a form post instead of a fragment encoded redirect (optional)
- identityserver will echo back the state value on the token response, this is for round tripping state between client and provider, correlating request and response and CSRF/replay protection. (recommended)
identityserver will echo back the nonce value in the identity token, this is for replay protection)
Required for identity tokens via implicit grant.
noneno UI will be shown during the request. If this is not possible (e.g. because the user has to sign in or consent) an error is returned
loginthe login UI will be shown, even if the user is already signed-in and has a valid session
- sends the code challenge for PKCE
plainindicates that the challenge is using plain text (not recommended)
S256indicates the the challenge is hashed with SHA256
- can be used to pre-fill the username field on the login page
- gives a hint about the desired display language of the login UI
- if the user’s logon session exceeds the max age (in seconds), the login UI will be shown
allows passing in additional authentication related information - identityserver special cases the following proprietary acr_values:
idp:name_of_idpbypasses the login/home realm screen and forwards the user directly to the selected identity provider (if allowed per client configuration)
tenant:name_of_tenantcan be used to pass a tenant name to the login UI
GET /connect/authorize? client_id=client1& scope=openid email api1& response_type=id_token token& redirect_uri=https://myapp/callback& state=abc& nonce=xyz
(URL encoding removed, and line breaks added for readability)
You can programmatically create URLs for the authorize endpoint using the IdentityModel library:
var request = new RequestUrl(doc.AuthorizeEndpoint); var url = request.CreateAuthorizeUrl( clientId: "client", responseType: OidcConstants.ResponseTypes.CodeIdToken, responseMode: OidcConstants.ResponseModes.FormPost, redirectUri: "https://myapp.com/callback", state: CryptoRandom.CreateUniqueId(), nonce: CryptoRandom.CreateUniqueId());
..and parse the response:
var response = new AuthorizeResponse(callbackUrl); var accessToken = response.AccessToken; var idToken = response.IdentityToken; var state = response.State;