Authorization Endpoint#

Janssen Server exposes an authorization endpoint defined in OAuth 2.0 (RFC 6749), with security behavior aligned with the OAuth 2.1 draft.

A client uses this endpoint to initiate an authorization request and obtain an authorization grant.

For new integrations, use the Authorization Code Flow with PKCE (code_challenge_method=S256). The authorization endpoint returns an authorization code, which the client exchanges for tokens at the token endpoint after successful end-user authentication and authorization.

Janssen Server may also support legacy implicit and hybrid response types, depending on server and client configuration. These response types are not recommended for new integrations.

URL to access authorization endpoint on Janssen Server is listed in the response of Janssen Server's well-known configuration endpoint given below.

https://janssen.server.host/jans-auth/.well-known/openid-configuration

authorization_endpoint claim in the response specifies the URL for authorization endpoint. By default, authorization endpoint looks like below:

https://janssen.server.host/jans-auth/restv1/authorize

More information about request and response of the authorization endpoint can be found in the OpenAPI specification of jans-auth-server module.

Configuration Properties#

Authorization endpoint can be further configured using Janssen Server configuration properties listed below. When using Janssen Text-based UI(TUI) to configure the properties, navigate via Auth Server->Properties.

• issuer
• requirePkce
• fapiCompatibility
• forceSignedRequestObject
• authorizationCodeLifetime
• returnDeviceSecretFromAuthzEndpoint
• requestUriBlockList
• requireRequestObjectEncryption
• staticDecryptionKid
• requestUriHashVerificationEnabled
• legacyIdTokenClaims
• customHeadersWithAuthorizationResponse
• includeSidInResponse
• sessionIdRequestParameterEnabled
• returnDeviceSecretFromAuthzEndpoint
• requirePar
• cibaMaxExpirationTimeAllowedSec

Required Client Configuration#

Clients must be registered for an authorization flow supported by the running server. Authorization Code is the recommended flow. The Implicit Grant is a legacy option and is not included in the default supported grant types.

Using Janssen Text-based UI(TUI), client can be registered for appropriate grant type by navigating to Auth-Server->Clients->Add Client

Using PKCE#

Janssen Server supports PKCE for the Authorization Code Flow. PKCE is required by default, and new integrations should use the S256 code challenge method.

PKCE enforcement is controlled by the requirePkce property, which defaults to true. If the global property is set to false, PKCE is still required for clients that have requirePkce enabled individually.

When PKCE is required, the client must send a code_challenge with code_challenge_method=S256 in the authorization request and provide the corresponding code_verifier at the token endpoint.

Using Request Objects#

Authorization requests can pass parameters as signed and/or encrypted JWTs using the request or request_uri parameters. See Request Objects.

Using PAR#

As a separate endpoint, Janssen Server supports PAR(Pushed Authorization Requests) to enable authorization using more complex authorization requests and making it more secure at the same time.

Use Janssen Server configuration property requirePar to accept only PAR requests.

Using JARM#

Authorization endpoint supports JWT Secured Authorization Response Mode, or JARM. Using JARM makes authorization responses more secure and compliant to be used in FAPI deployments.

Janssen Server supports all response modes as defined in JARM specification

Using Prompt Parameter#

prompt request parameter is an ASCII string value that specifies whether the Authorization Server prompts the End-User for re-authentication and consent. Janssen Server supports none, login, consent, create and select_account values for prompt parameter. Multiple values can be specified by separating them with single space. Based on value/s of this request parameter Authorization Server prompts the End-User for re-authentication (login), consent or user registration details (create).

Check Prompt page for more details.

none#

none value will instruct Janssen Server NOT to display any authentication or consent user interface pages. An error is returned if the End-User is not already authenticated or the Client does not have pre-configured consent for the requested scopes. This can be used as a method to check for existing authentication and/or consent.

login#

login value will instruct Janssen Server to prompt the End-User for re-authentication.

consent#

consent value will instruct Janssen Server to prompt the End-User for consent before returning information to the Client.

select_account#

select_account value will instruct Janssen Server to prompt the End-User to select a user account. This allows a user who has multiple accounts at the Authorization Server to select amongst the multiple accounts that they may have current sessions for.

Configuring Authentication Methods#

acr_values request parameter is used to specify authentication methods to be used by Janssen Server to authenticate the end user. Multiple acr values can be specified by separating them with a space.

In order to use a particular acr value, the client needs to be authorized to use all the acr values in the list. If no the request doesn't specify any acr value then the default acr value configured for respective client is used by Janssen server for end user authentication.

Customizing using Interception Scripts#

Interception scripts allow flexibility to configure and customize multiple aspects in Janssen Server. For example, see this documentation to learn

how person authentication and consent gathering can be customized using interception scripts.

Want to contribute?#

If you'd like to contribute content to this page, you can get started with our Contribution guide.