/AWS1/CL_EL2AUTHNTCTOIDCACTCFG

Request parameters when using an identity provider (IdP) that is compliant with OpenID Connect (OIDC) to authenticate users.

CONSTRUCTOR

IMPORTING

Required arguments:

iv_issuer TYPE /AWS1/EL2AUTHNTCTOIDCACTISSUER /AWS1/EL2AUTHNTCTOIDCACTISSUER

The OIDC issuer identifier of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.

iv_authorizationendpoint TYPE /AWS1/EL2AUTHNOIDCACTAUTHENDPT /AWS1/EL2AUTHNOIDCACTAUTHENDPT

The authorization endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.

iv_tokenendpoint TYPE /AWS1/EL2AUTHNOIDCACTTOKENDPT /AWS1/EL2AUTHNOIDCACTTOKENDPT

The token endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.

iv_userinfoendpoint TYPE /AWS1/EL2AUTHOIDCACTUSERINFO00 /AWS1/EL2AUTHOIDCACTUSERINFO00

The user info endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.

iv_clientid TYPE /AWS1/EL2AUTHNTCTOIDCACTCLIID /AWS1/EL2AUTHNTCTOIDCACTCLIID

The OAuth 2.0 client identifier.

Optional arguments:

iv_clientsecret TYPE /AWS1/EL2AUTHNOIDCACTCLISECRET /AWS1/EL2AUTHNOIDCACTCLISECRET

The OAuth 2.0 client secret. This parameter is required if you are creating a rule. If you are modifying a rule, you can omit this parameter if you set UseExistingClientSecret to true.

iv_sessioncookiename TYPE /AWS1/EL2AUTHOIDCACTESSIONCO00 /AWS1/EL2AUTHOIDCACTESSIONCO00

The name of the cookie used to maintain session information. The default is AWSELBAuthSessionCookie.

iv_scope TYPE /AWS1/EL2AUTHNTCTOIDCACTSCOPE /AWS1/EL2AUTHNTCTOIDCACTSCOPE

The set of user claims to be requested from the IdP. The default is openid.

To verify which scope values your IdP supports and how to separate multiple values, see the documentation for your IdP.

iv_sessiontimeout TYPE /AWS1/EL2AUTHNOIDCACTESSIONTO /AWS1/EL2AUTHNOIDCACTESSIONTO

The maximum duration of the authentication session, in seconds. The default is 604800 seconds (7 days).

it_authntctnreqextraparams TYPE /AWS1/CL_EL2AUTHOIDCACTAUTHR00=>TT_AUTHOIDCACTAUTHREQEXTRAPRMS TT_AUTHOIDCACTAUTHREQEXTRAPRMS

The query parameters (up to 10) to include in the redirect request to the authorization endpoint.

iv_onunauthenticatedrequest TYPE /AWS1/EL2AUTHOIDCACTCONDALBE00 /AWS1/EL2AUTHOIDCACTCONDALBE00

The behavior if the user is not authenticated. The following are possible values:

• deny - Return an HTTP 401 Unauthorized error.

• allow - Allow the request to be forwarded to the target.

• authenticate - Redirect the request to the IdP authorization endpoint. This is the default value.

iv_useexistingclientsecret TYPE /AWS1/EL2AUTHOIDCACTUSEEXING00 /AWS1/EL2AUTHOIDCACTUSEEXING00

Indicates whether to use the existing client secret when modifying a rule. If you are creating a rule, you can omit this parameter or set it to false.

---

Queryable Attributes

Issuer

The OIDC issuer identifier of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.

Accessible with the following methods

Method	Description
GET_ISSUER()	Getter for ISSUER, with configurable default
ASK_ISSUER()	Getter for ISSUER w/ exceptions if field has no value
HAS_ISSUER()	Determine if ISSUER has a value

AuthorizationEndpoint

The authorization endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.

Accessible with the following methods

Method	Description
GET_AUTHORIZATIONENDPOINT()	Getter for AUTHORIZATIONENDPOINT, with configurable default
ASK_AUTHORIZATIONENDPOINT()	Getter for AUTHORIZATIONENDPOINT w/ exceptions if field has
HAS_AUTHORIZATIONENDPOINT()	Determine if AUTHORIZATIONENDPOINT has a value

TokenEndpoint

The token endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.

Accessible with the following methods

Method	Description
GET_TOKENENDPOINT()	Getter for TOKENENDPOINT, with configurable default
ASK_TOKENENDPOINT()	Getter for TOKENENDPOINT w/ exceptions if field has no value
HAS_TOKENENDPOINT()	Determine if TOKENENDPOINT has a value

UserInfoEndpoint

The user info endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.

Accessible with the following methods

Method	Description
GET_USERINFOENDPOINT()	Getter for USERINFOENDPOINT, with configurable default
ASK_USERINFOENDPOINT()	Getter for USERINFOENDPOINT w/ exceptions if field has no va
HAS_USERINFOENDPOINT()	Determine if USERINFOENDPOINT has a value

ClientId

The OAuth 2.0 client identifier.

Accessible with the following methods

Method	Description
GET_CLIENTID()	Getter for CLIENTID, with configurable default
ASK_CLIENTID()	Getter for CLIENTID w/ exceptions if field has no value
HAS_CLIENTID()	Determine if CLIENTID has a value

ClientSecret

The OAuth 2.0 client secret. This parameter is required if you are creating a rule. If you are modifying a rule, you can omit this parameter if you set UseExistingClientSecret to true.

Accessible with the following methods

Method	Description
GET_CLIENTSECRET()	Getter for CLIENTSECRET, with configurable default
ASK_CLIENTSECRET()	Getter for CLIENTSECRET w/ exceptions if field has no value
HAS_CLIENTSECRET()	Determine if CLIENTSECRET has a value

SessionCookieName

The name of the cookie used to maintain session information. The default is AWSELBAuthSessionCookie.

Accessible with the following methods

Method	Description
GET_SESSIONCOOKIENAME()	Getter for SESSIONCOOKIENAME, with configurable default
ASK_SESSIONCOOKIENAME()	Getter for SESSIONCOOKIENAME w/ exceptions if field has no v
HAS_SESSIONCOOKIENAME()	Determine if SESSIONCOOKIENAME has a value

Scope

The set of user claims to be requested from the IdP. The default is openid.

To verify which scope values your IdP supports and how to separate multiple values, see the documentation for your IdP.

Accessible with the following methods

Method	Description
GET_SCOPE()	Getter for SCOPE, with configurable default
ASK_SCOPE()	Getter for SCOPE w/ exceptions if field has no value
HAS_SCOPE()	Determine if SCOPE has a value

SessionTimeout

The maximum duration of the authentication session, in seconds. The default is 604800 seconds (7 days).

Accessible with the following methods

Method	Description
GET_SESSIONTIMEOUT()	Getter for SESSIONTIMEOUT, with configurable default
ASK_SESSIONTIMEOUT()	Getter for SESSIONTIMEOUT w/ exceptions if field has no valu
HAS_SESSIONTIMEOUT()	Determine if SESSIONTIMEOUT has a value

AuthenticationRequestExtraParams

The query parameters (up to 10) to include in the redirect request to the authorization endpoint.

Accessible with the following methods

Method	Description
GET_AUTHNTCTNREQEXTRAPARAMS()	Getter for AUTHNTCTNREQUESTEXTRAPARAMS, with configurable de
ASK_AUTHNTCTNREQEXTRAPARAMS()	Getter for AUTHNTCTNREQUESTEXTRAPARAMS w/ exceptions if fiel
HAS_AUTHNTCTNREQEXTRAPARAMS()	Determine if AUTHNTCTNREQUESTEXTRAPARAMS has a value

OnUnauthenticatedRequest

The behavior if the user is not authenticated. The following are possible values:

• deny - Return an HTTP 401 Unauthorized error.

• allow - Allow the request to be forwarded to the target.

• authenticate - Redirect the request to the IdP authorization endpoint. This is the default value.

Accessible with the following methods

Method	Description
GET_ONUNAUTHENTICATEDREQUEST()	Getter for ONUNAUTHENTICATEDREQUEST, with configurable defau
ASK_ONUNAUTHENTICATEDREQUEST()	Getter for ONUNAUTHENTICATEDREQUEST w/ exceptions if field h
HAS_ONUNAUTHENTICATEDREQUEST()	Determine if ONUNAUTHENTICATEDREQUEST has a value

UseExistingClientSecret

Indicates whether to use the existing client secret when modifying a rule. If you are creating a rule, you can omit this parameter or set it to false.

Accessible with the following methods

Method	Description
GET_USEEXISTINGCLIENTSECRET()	Getter for USEEXISTINGCLIENTSECRET, with configurable defaul
ASK_USEEXISTINGCLIENTSECRET()	Getter for USEEXISTINGCLIENTSECRET w/ exceptions if field ha
HAS_USEEXISTINGCLIENTSECRET()	Determine if USEEXISTINGCLIENTSECRET has a value