# OpenIdConnectConfig

Configuration for OpenID Connect authorization in AppSync.

- Source: [`aws-appsync/lib/graphqlapi.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-appsync/lib/graphqlapi.ts#L120)
- Type last changed: v2.60.0 · 12 Jan 2023

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_appsync as appsync } from 'aws-cdk-lib';
const openIdConnectConfig: appsync.OpenIdConnectConfig = {
  oidcProvider: 'oidcProvider',

  // the properties below are optional
  clientId: 'clientId',
  tokenExpiryFromAuth: 123,
  tokenExpiryFromIssue: 123,
};
```

## Properties

- `clientId`: string — The client identifier of the Relying party at the OpenID identity provider.

  **Default:** * (All)

  A regular expression can be specified so AppSync can validate against multiple client identifiers at a time.

  ```ts
  - 'ABCD|CDEF' // where ABCD and CDEF are two different clientId
  ```

- `oidcProvider`: string (required) — The issuer for the OIDC configuration.

  The issuer returned by discovery must exactly match the value of `iss` in the OIDC token.

- `tokenExpiryFromAuth`: number — The number of milliseconds an OIDC token is valid after being authenticated by OIDC provider.

  **Default:** no validation

  `auth_time` claim in OIDC token is required for this validation to work.

- `tokenExpiryFromIssue`: number — The number of milliseconds an OIDC token is valid after being issued to a user.

  **Default:** no validation

  This validation uses `iat` claim of OIDC token.