as

path

Optional. Should only be used if the application has associated two or more Authorization Server entities that support the scope requested for Authorization Code Grant flows.

Identifier of the TRIDENT authorization server to which the authorization request is sent (Server ID field of one of the Authorization server entities).

If this parameter is not specified, the TRIDENT automatically selects the authorization server, choosing the one associated with the application that supports Authorization Code Grant for the requested scope (for all the values included). If no authorization server or several meet this condition, the TRIDENT rejects the authorization request and returns an error.

response_type

Required

Must take the code value, which indicates that an authorization code is requested.

client_id

Required

Identifier of the OAuth 2.0 application registered in TRIDENT (Client identifier field of one of the Client application entities). The application must be associated with the authorization server and have the use of the Authorization Code Grant enabled.

code_challenge

Recommended as it protects against theft of the authorization code that the application will receive in the response to the Obtain Authorization operation

Value calculated from the code_verifier parameter that must be included in the subsequent request for the Obtain a Token operation (see [RFC 7636]).

code_challenge_method

Conditionally required

Method used to calculate the value of the code_challenge parameter from the value that will be put in the code_verifier parameter of the subsequent request for the Obtain a Token operation. This parameter is required if the code_challenge parameter is used. The only value supported is "S256", which means that the code_challenge value is obtained by calculating the base64(url_encode(utf8(code_verifier))), where code_verifier is a high-entropy random string between 42 and 128 characters (see [RFC 7636]).

state

Recommended

We recommend using this parameter to safeguard against CSRF attacks. For this, the application must include a random value in this parameter, store it in the user's HTTP session, and verify it when the Authorization Response message is received from the agent. The random value associates the authorization request with the HTTP session. This safeguards against the application processing an authorization response message not returned in response to an authorization request message specified previously in the user's browser.

The application can also include additional information in this parameter, such as the URL to which the browser will be redirected when the OAuth flow finishes. (To include multiple data in the value of this parameter, the application must serialize as seen fit.)

nonce

Recommended in OpenID Connect requests

We recommend using this parameter in OpenID Connect authentication requests to safeguard against replay attacks on obtaining the ID token. For this, the application must include a random value in this parameter (taken from a space with sufficient entropy so that an attacker cannot guess it), store it in the HTTP session, and, later on, when it obtains the ID token, check that it matches the nonce claim of the ID token. This random value associates the authentication request with the ID token issued, safeguarding against an attacker using an ID token previously captured from another user and resending it to the application.

redirect_uri

Conditionally required

Redirection URI to the application. The application waits for the authorization/authentication response message with the authorization code at this URI. It must be one of the Redirect URIs registered for the client application or a redirect URI of the system.

This parameter can be omitted if only one redirect URI was registered for the application. In this case, the registered redirect URI is used.

scope

Optional

List of values, separated by spaces, that represent the scope of the authorization the application wants to obtain. Ask the TRIDENT administrator for the scopes necessary for accessing the resources and servers. To request an OpenID Connect authentication, the application must include the openid value in this parameter. If this parameter is not specified, the scopes defined for the authorization server enabled for Authorization Code Grant flows are assumed by default.

prompt

Optional

The values supported are login and none:

• The login value disables SSO.

• The none value specifies that there can be no interaction with the user (not for authentication or requesting authorization).

See [RSE_AUTH_INTEG] for more information.

acr_values

Optional

Defines conditions for authenticating the user (minimum levels and/or specific flows) who must authorize the access. See [RSE_AUTH_INTEG]

view_type

Optional

This is a nonstandard parameter for requesting a particular display format for the user interfaces displayed to authenticate the user and obtain their consent. See [RSE_AUTH_INTEG].

ui_locales

Optional

Specifies a list of languages ordered by preference. TRIDENT uses this list to select the language for displaying the graphical interfaces for authenticating users and obtaining their consent. The value of this parameter is a list of language labels, as per RFC 5646, separated by spaces. The interface is displayed internationalized according to the first label in the list whose base language is supported by the TRIDENT or has been customized. For how to customize a language, including country, dialect, identity provider, and/or view_type value variants, see [RSE_AUTH_INTEG].

This parameter is optional. If this parameter is not included (or it is, but it specifies an unsupported language), the language specified by the browser is used. US English is used (en-US) if this language is not supported.

register_group_labels

Optional

This parameter must only be used to obtain authorization from the user for creating server signing identities enabled via passwords stored on the HSM. See the Authorization section of the create a signing identity and its associated keys on the server and operations.

sign_identity_id

Optional.

It can't be present when the authorization_details parameter is used.

The number of signatures whose generation the user must authorize. This parameter can only be present if the sign_identity_id parameter is also present (otherwise, the TRIDENT will ignore the num_signatures parameter). If the user grants the authorization, with the access token obtained later, only num_signatures signatures can be generated in a single access. The value entered must be equal to or less than the value configured by the TRIDENT administrator in the Signature Provider. Check with your administrator if you need to know this value.

num_signatures

Optional.

It can't be present when the authorization_details parameter is used.

The number of signatures whose generation the user must authorize. This parameter can only be present if the sign_identity_id parameter is also present (otherwise, the TRIDENT will ignore the num_signatures parameter). If the user grants authorization, the access token obtained later can only be used to generate num_signatures signatures at most, and it can only be used once. The value entered must be equal to or less than the value configured by the TRIDENT administrator in the Signature Provider. Check with your administrator if you need to know this value.

digests_summary

Optional.

It can't be present when the authorization_details parameter is used.

This parameter must only be used to obtain user authorization for generating a digital signature (or a batch of digital signatures) with a server signing identity activated with a password stored on the HSM. Its value must be the base64 encoded cryptographic hash of the concatenation of the data and cryptographic hashes to be used to create the digital signatures. This concatenation must be done in the same order and with the same data and cryptographic hashes as those specified subsequently in the request for generating the signature (see Create a Digital Signature on the Server and Create a Digital Signature Batch on the Server).

digests_summary_algorithm

Optional.

It can't be present when the authorization_details parameter is used.

This parameter must only be used to obtain user authorization for generating a digital signature (or a batch of digital signatures) with a server signing identity activated with a password stored on the HSM. Its value ("sha256", "sha384" or "sha512") must be the algorithm for obtaining the cryptographic hash specified in the digests_summary parameter.

authorization_details[]

Optional

No puede estar presente cuando se utilizan los parámetros sign_identity_id, num_signatures, digests_summary y digests_summary_algorithm.

Debe contener un solo elemento.

Detailed information regarding the requested authorization (see[RFC 9396]).

Currently, details provided can only refer to generating one or more signatures with a given signature key.

authorization_details[0].type

Conditionally required. It must be present when the authorization_details property is included.

The value is always "digest_signing".

authorization_details[0].sign_identity

Conditionally required. It must be present when the authorization_details property is included.

Identifier of the signing identity to generate one or more signatures for which authorization is requested. It is mandatory that this signing identity's activation is with an HSM password or through the SAM

authorization_details[0].num_signatures

Conditionally required. It must be present when the authorization_details property is included.

Number of signatures to generate using the signing identity indicated by the sign_identity_id property.

authorization_details[0].digests[]

Conditionally required. It must be present when the authorization_details property is included.

Hashes of the data to sign. It must have one element at least.

authorization_details[0].digests[].value

Conditionally required. It must be present when the authorization_details property is included.

The hash of one piece of data to sign.

authorization_details[0].digests[].algorithm

Optional (It can only be present when the authorization_details[0].digests[].value parameter is also present.

The algorithm used to generate the hash of one piece of data to sign: "sha256", "sha384" o "sha512".

login_hint

Optional

Suggested user identifier that can be used if the user must be authenticated.

id_token_hint

Optional

ID Token provided by TRIDENT when it authenticated (using OpenID Connect) the user whose authorization is now wanted. If the TRIDENT has to authenticate the user again (e.g., because the user's session expired), the user identifier obtained as a result of this authentication must match the one that appears in the sub claim of the ID Token provided in this parameter.