Oauth / OpenID Flows: Implicit

    Applies to:
  • Legacy SecureAuth IdP
Deployment model:
  • Hybrid
  • On Premises
  • Version Affected:  IdP - All versions


    The Implicit flow allows an application to request an Access Token directly from the Authorization endpoint so can be fully handled via the Users Browser, rather than the Application needing access to the IdP Token Endpoint. 

    Cause:  This KB outlines how to use the Implicit grant type. 


    For an Access Token:

    1. Add a custom scope to the Post Auth tab. In my example, it is called Abhi.

    2.  Point your browser to https://youridp.secureauth.com/secureauth8/?response_type=token&client_id=88fa3281&redirect_uri=https://app.getpostman.com/oauth2/callback&scope=Abhi&state=State&nonce=n-0S6_WzA2Mj


    Replace youridp.secureauth.com with the FQDN of your SecureAuth server

    Replace secureauth8 with your Oauth realm

    Replace the client_id with your Client ID

    Replace the redirect_uri with your redirect uri

    Replace the scope with your scope

    Nonce is required. 


    For an Access Token and ID Token:

    Point your browser to https://youridp.secureauth.com/secureauth8/?response_type=id_token+token&client_id=88fa3281&redirect_uri=https://app.getpostman.com/oauth2/callback&scope=openid&state=State&nonce=n-0S6_WzA2Mj

    Add more scopes to get more claims returned in the ID token. 


    For an Implicit flow with ID Token use the following:

    1. Point your browser to https://youridp.secureauth.com/secureauth8/?response_type=id_token&client_id=88fa3281&redirect_uri=https://app.getpostman.com/oauth2/callback&scope=openid&state=State&nonce=n-0S6_WzA2Mj


    Add more scopes to get more claims returned in the ID token. 




    SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

    Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.

    0 out of 0 found this helpful



    Please sign in to leave a comment.