Oauth / OpenID Flows: Implicit

Version Affected:  IdP - All versions

Description:

The Implicit flow allows an application to request an Access Token directly from the Authorization endpoint so can be fully handled via the Users Browser, rather than the Application needing access to the IdP Token Endpoint. 

Cause:  This KB outlines how to use the Implicit grant type. 

Resolution:  

For an Access Token:

1. Add a custom scope to the Post Auth tab. In my example, it is called Abhi.
​

2.  Point your browser to https://youridp.secureauth.com/secureauth8/?response_type=token&client_id=88fa3281&redirect_uri=https://app.getpostman.com/oauth2/callback&scope=Abhi&state=State&nonce=n-0S6_WzA2Mj

Replace youridp.secureauth.com with the FQDN of your SecureAuth server

Replace secureauth8 with your Oauth realm

Replace the client_id with your Client ID

Replace the redirect_uri with your redirect uri

Replace the scope with your scope

Nonce is required. 

For an Access Token and ID Token:

Point your browser to https://youridp.secureauth.com/secureauth8/?response_type=id_token+token&client_id=88fa3281&redirect_uri=https://app.getpostman.com/oauth2/callback&scope=openid&state=State&nonce=n-0S6_WzA2Mj

Add more scopes to get more claims returned in the ID token. 

For an Implicit flow with ID Token use the following:

1. Point your browser to https://youridp.secureauth.com/secureauth8/?response_type=id_token&client_id=88fa3281&redirect_uri=https://app.getpostman.com/oauth2/callback&scope=openid&state=State&nonce=n-0S6_WzA2Mj

Add more scopes to get more claims returned in the ID token. 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.