OpenID Connect support for OAuth Authorization Server

When sign-in scopes (openid / profile / email) are granted on an OAuth Authorization Server, this authorization server acts as an OpenID Connect authorization server and releases the member's sign-in information (claims) to the client. id_token issuance and claim retrieval from the userinfo endpoint are enabled only when the granted scope contains openid.

For how to configure an OAuth Authorization Server, see OAuth Authorization Server.

Basic information

Item	Description
Type	OpenID Connect (id_token / userinfo / JWKS)
Target	OAuth Authorization Server (target domain API / Management / AdminMCP)
Use case	An OAuth client needs to retrieve the member's sign-in information (claims)

Metadata

Accessing [Metadata URL] in the OAuth Authorization Server editor returns this authorization server's configuration (Authorization Server Metadata) as JSON. In addition to basic OAuth 2.0 items such as issuer, authorization_endpoint, and token_endpoint, the response includes the following items.

• jwks_uri: URL of the JWKS endpoint
• userinfo_endpoint: URL of the userinfo endpoint (when openid is among the issuable scopes)
• subject_types_supported
• id_token_signing_alg_values_supported (RS256)
• claims_supported

The JWKS and userinfo endpoint URLs described below are both obtained from this response.

Authorization requests for SSO Release version: βversion

For SSO between services managed by the same organization, enable [Trusted client] for the OAuth Authorization Server client to use the existing Kuroco login session and skip the consent screen. For configuration steps, see OAuth Authorization Server client editor.

The authorization endpoint URL is available in the metadata as authorization_endpoint. To check whether authorization can complete without displaying a login or consent screen, specify prompt=none. The metadata lists the prompt values that change behavior in prompt_values_supported.

GET {authorization_endpoint}?response_type=code&client_id={client_id}&redirect_uri=https%3A%2F%2Fclient.example%2Fcallback&scope=openid+profile+email&state={state}&nonce={nonce}&code_challenge={code_challenge}&code_challenge_method=S256&prompt=none

Separate scopes within scope with spaces or +. Separate prompt and other parameters from scope with &.

Behavior by prompt

prompt	No login session	Signed in, trusted client	Signed in, other client
Omitted	Displays the login screen.	Issues an authorization code without displaying the consent screen.	Displays the consent screen.
none	Returns login_required without displaying a screen.	Issues an authorization code without displaying the consent screen.	Returns consent_required without displaying a screen.
consent / login / select_account / any other value	Displays the consent screen after login.	Displays the consent screen.	Displays the consent screen.

Any value other than none is treated as a request for user interaction, so the consent screen is displayed even for a trusted client. Only none and consent are advertised in prompt_values_supported: Kuroco does not re-authenticate a signed-in user for prompt=login, and does not display an account selection screen for prompt=select_account.

prompt=none cannot be combined with another value. A combination such as none consent returns invalid_request. If the signed-in account is not eligible for the authorization request, Kuroco returns access_denied.

caution

Enable [Trusted client] only for a first-party client managed by your organization. The consent screen is skipped, but redirect URI, scope, resource, PKCE, and other validations still apply.

id_token

The token endpoint exchanges an authorization code, refresh token, or client credentials for an access token (its URL is available in the metadata as token_endpoint). When the granted scope contains openid, this endpoint's response includes an RS256-signed id_token (JWT) in addition to the access token.

The id_token always contains iss (issuer), sub (member ID), aud (client ID), iat, and exp, plus nonce when a nonce was provided in the authorization request. It also contains auth_time when the authentication time is available. When a [Trusted client] skips the consent screen by using an existing login session, auth_time is omitted. For the claims added based on the profile and email scopes, see Scope-to-claim mapping.

JWKS endpoint

Serves the public key used to verify the id_token signature, as a JWK Set (RFC 7517). The endpoint URL is available in the metadata as jwks_uri. The signing key is managed per authorization server and is generated on first access.

userinfo endpoint

You can retrieve the member's claims using an access token.

Item	Description
Method	GET / POST
Authentication	Authenticated with the Authorization: Bearer <access_token> header (passing the access token as a query parameter is not supported).
Response	Returns the claims (always including sub) that correspond to the granted scopes, as JSON.

The endpoint URL is available in the metadata as userinfo_endpoint.

Scope-to-claim mapping

The claims returned in the id_token and from userinfo are determined by the granted scopes.

Scope	Claim	Source
openid	sub	Member ID
profile	name	Full name (family name + given name)
profile	family_name	Family name
profile	given_name	Given name
profile	preferred_username	Login ID
profile	updated_at	Member update date/time (Unix time)
email	email	Email address
email	email_verified	Always true (a constant, because Kuroco has no email verification flow)

Shared information on the consent screen

When a scope containing openid is requested, the consent screen shows the sign-in information to be shared with the client (the actual claim values) under "Shared information". You can review the member information that will actually be released, not just the scope names, before granting consent.

Related documents

• OAuth Authorization Server