doc-exports/docs/iam/api-ref/iam_13_0606.html

Obtaining an Unscoped Token with an OpenID Connect ID Token

Function

This API is used to obtain an unscoped token using an OpenID Connect ID token.

URI

POST /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}/auth

Table 1 URI parameters

Parameter	Mandatory	Type	Description
idp_id	Yes	String	Identity provider ID.
protocol_id	Yes	String	Protocol ID.

Request Parameters

Table 2 Parameters in the request header

Parameter	Mandatory	Type	Description
Authorization	Yes	String	ID token of the identity provider. The format is Bearer {ID Token}.

Response Parameters

Status code: 201

Table 3 Parameters in the response header

Parameter	Type	Description
X-Subject-Token	String	Signed token.

Table 4 Parameters in the response body

Parameter	Type	Description
token	object	Details about the obtained token.

Table 5 token

Parameter	Type	Description
expires_at	String	Time when the token will expire.
methods	Array of strings	Token obtaining method. The default value for federated authentication is mapped.
issued_at	String	Time when the token was issued.
user	object	User details.

Table 6 token.user

Parameter	Type	Description
OS-FEDERATION	object	Federated user details.
domain	object	Domain details.
id	String	User ID.
name	String	Username

Table 7 token.user.OS-FEDERATION

Parameter	Type	Description
identity_provider	object	Identity provider details.
protocol	object	Protocol details.
groups	Array	User group details.

Table 8 token.user.OS-FEDERATION.identity_provider

Parameter	Type	Description
id	String	Identity provider ID.

Table 9 token.user.OS-FEDERATION.protocol

Parameter	Type	Description
id	String	Protocol ID.

Table 10 token.user.OS-FEDERATION.groups

Parameter	Type	Description
id	String	User group ID.
name	String	User group name.

Table 11 token.user.domain

Parameter	Type	Description
id	String	Domain ID.
name	String	Domain name.

Table 12 token.roles

Parameter	Type	Description
id	String	Permission ID.
name	String	Permission name.

Table 13 token.catalog

Parameter	Type	Description
endpoints	Array of objects	Endpoint information.
id	String	Service ID.
name	String	Service name.
type	String	Type of the service to which the API belongs.

Table 14 token.catalog.endpoints

Parameter	Type	Description
id	String	Endpoint ID.
interface	String	Visibility of the API. public indicates that the API is available for public access.
region	String	Region to which the endpoint belongs.
region_id	String	Region ID.
url	String	Endpoint URL.

Example Request

POST https://sample.domain.com/v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}/auth

Example Response

Status code: 201

The request is successful.

{ 
  "token" : { 
    "expires_at" : "2018-03-13T03:00:01.168000Z", 
    "methods" : [ "mapped" ], 
    "issued_at" : "2018-03-12T03:00:01.168000Z", 
    "user" : { 
      "OS-FEDERATION" : { 
        "identity_provider" : { 
          "id" : "idptest" 
        }, 
        "protocol" : { 
          "id" : "oidc" 
        }, 
        "groups" : [ { 
          "name" : "admin", 
          "id" : "45a8c8f..." 
        } ] 
      }, 
      "domain" : { 
        "id" : "063bb260a480...", 
        "name" : "IAMDomain" 
      }, 
      "name" : "FederationUser", 
      "id" : "suvmgvUZc4PaCOEc..." 
    } 
  } 
}

Status code: 400

The server failed to process the request.

{ 
  "error" : { 
    "code" : 400, 
    "message" : "Request parameter 'idp id' is invalid.", 
    "title" : "Bad Request" 
  } 
}

Status code: 401

Authentication failed.

{ 
  "error" : { 
    "code" : 401, 
    "message" : "The request you have made requires authentication.", 
    "title" : "Unauthorized" 
  } 
}

Status code: 403

Access denied.

{ 
  "error" : { 
    "code" : 403, 
    "message" : "You are not authorized to perform the requested action.", 
    "title" : "Forbidden" 
  } 
}

Status code: 404

The requested resource cannot be found.

{ 
  "error" : { 
    "code" : 404, 
    "message" : "Could not find %(target)s: %(target_id)s.", 
    "title" : "Not Found" 
  } 
}

Status code: 500

Internal system error.

{ 
  "error" : { 
    "code" : 500, 
    "message" : "An unexpected error prevented the server from fulfilling your request.", 
    "title" : "Internal Server Error" 
  } 
}

Status Codes

Status Code	Description
201	The request is successful.
400	The server failed to process the request.
401	Authentication failed.
403	Access denied.
404	The requested resource cannot be found.
500	Internal system error.

Parent topic: Token