Add an OpenID Connect application in SSOGEN

• An administrator role that changes applications: Application admin or Super admin. Assigning people and running the test also need a role that reads the directory (Directory admin, Read-only admin, or Super admin).
• A sign-in policy under SSO policies > Policies, with a default under SSO policies > Defaults or one you pick in the wizard.
• From the application:
  • its redirect URI (also called callback or reply URL): one or more https:// addresses, at most 16, each up to 2,048 characters, with no # part;
  • whether it runs on a server and can keep a secret, or runs in the browser or on a phone and cannot;
  • support for PKCE with the S256 method, which SSOGEN requires of every client;
  • optionally, the address the browser returns to after sign-out.
• The address people open the application at, for the launch URL.

Check both before you go on. Once the wizard has saved the application, the redirect URIs and the client ID cannot be changed in the console; a wrong one means registering the application again.

Every application starts as a public client: no secret, PKCE required. A server-side application gets its secret or key in step 10. Select Next.

Leave Identify the person by at its default unless the application page says otherwise. Extra claims are easier to add later on the Identity sent to app tab (step 11). Select Next.

Choose a Person and select Run test. The cards ID token claims and UserInfo claims show every claim the application would receive. Under Advanced, OpenID Connect scope lets you test with the scopes the application asks for. Select Next, check the list and select Activate application.

On the application’s Sign-in tokens tab, section Client authentication:

• Client secret: select Client secret, then Generate secret. The secret appears once. Copy it and hand it to the application’s administrator over a channel you trust, then select I have copied it. Select Save sign-in settings. Saving before a secret exists is refused with “Generate a client secret first (Generate secret), then save.”
• Private key JWT (recommended): select it, paste the application’s public keys as a JWKS document in Public keys (JWKS) (at most 5, each with its own key ID), and select Save sign-in settings.

To replace a secret later, generate a new one and choose under When replacing a secret how long the old one keeps working (at once, 1 hour, 24 hours or 7 days).

The same tab sets Refresh tokens (off by default) and the Post-logout redirect URIs the browser may return to after sign-out.