Login

This endpoint can be used for login using a Kubernetes Service Account token.

Authenticate towards the system. Providing a tenant is optional, if the username is unique in the system.

This endpoint completes the OpenID Connect (OIDC) authentication process.

Workflow:

1. After successful authentication, the OIDC provider redirects the client to this endpoint (or an equivalent web backend endpoint that forwards the request).

2. The request must include the following query parameters:

   • state: A unique value used to prevent CSRF attacks.
   • code: The authorization code used to obtain a token.
   • nonce (optional): A value originally provided by the client to prevent replay attacks.

3. If authentication is successful, a valid token is returned.

Expected Input:

• The state and code parameters are required and must match the expected values.
• The nonce parameter is optional but is verified if present.

Response:

• A valid authentication token.
• A message field containing additional information about the authentication result.

Security Considerations:

• Ensure that the state value is validated to mitigate CSRF attacks.
• If a nonce was provided during login, it is checked to prevent replay attacks.
• All input parameters are marked as sensitive and should be handled securely.

This endpoint is typically called by frontend applications or backend services handling the OIDC login flow.

This endpoint completes the OpenID Connect (OIDC) authentication process.

Workflow:

1. After successful authentication, the OIDC provider redirects the client to this endpoint (or an equivalent web backend endpoint that forwards the request).

2. The request must include the following query parameters:

   • state: A unique value used to prevent CSRF attacks.
   • code: The authorization code used to obtain a token.
   • nonce (optional): A value originally provided by the client to prevent replay attacks.

3. If authentication is successful, a valid token is returned.

Expected Input:

• The state and code parameters are required and must match the expected values.
• The nonce parameter is optional but is verified if present.

Response:

• A valid authentication token.
• A message field containing additional information about the authentication result.

Security Considerations:

• Ensure that the state value is validated to mitigate CSRF attacks.
• If a nonce was provided during login, it is checked to prevent replay attacks.
• All input parameters are marked as sensitive and should be handled securely.

This endpoint is typically called by frontend applications or backend services handling the OIDC login flow.

This endpoint initiates an OpenID Connect (OIDC) authentication flow, typically used by web applications to authenticate users.

Workflow:

1. Invoke oidc-login to obtain a redirect URL.
2. Redirect the client to the provided URL for authentication with the OIDC provider.
3. Once authentication is complete, the OIDC provider redirects the client to the configured callback URL, including code, state, and optionally nonce as query parameters. The callback URL may be the oidc-callback endpoint directly, or a callback in the web backend that performs 4.
4. Call oidc-callback with these parameters to complete authentication and receive a valid token.

Default Behavior:

• If no parameters are provided, the system:
  • First checks for an OIDC configuration at the system tenant.
  • If unavailable, it checks the edge-provider tenant.
  • If no OIDC configuration is found, the default value is used.

This endpoint supports login initiation with optional parameters to specify the tenant, OIDC provider, and role.

This endpoint validates the integrity of the state parameter before performing any additional redirects during an OpenID Connect (OIDC) authentication flow.

Purpose:

• The state parameter is used to prevent CSRF attacks and track authentication sessions in OIDC.
• Some backend implementations may inspect state to determine an additional redirect URL based on its contents, such as a state-addition field.
• Since any such redirect URL is not verified by the OIDC provider, this endpoint can be used to ensure that state remains unchanged before executing any redirection. A HMAC can also be added to ensure that the state has not been manipulated. This is configured using the state-hmac-key setting.

Expected Input:

• state (required): A unique value originally sent in the OIDC authentication request.
• Additional fields may be present in the request but are ignored.

Response:

• valid (boolean): Returns true if the state is unchanged, ensuring that no CSRF attack is in progress.

Use Case:

• When a backend wants to introduce an additional redirect based on the state contents, it can use this endpoint to verify the state before proceeding.
• This extra validation step helps mitigate CSRF attacks, ensuring that only valid authentication flows proceed.

Create a passkey challenge

Initiates passkey login from the command line.

Performs a passkey login with the parameters signed by the browser.