## Documentation

- About
- Read First
  - What is IdentityServer
  - Installation Scenarios
- Migrations
- Bootstrapping
- Configuration & Integration
  - AdminUI Settings
  - Configuring AdminUI
  - Configuring AdminUI (NuGet)
  - Integrating with Identity Server
  - Integrating with Identity Server Custom Schema
  - Integrating with Quickstarts
  - Enabling Logging
- Installation
  - IIS
  - Azure
    - Install in Azure
    - Create Azure Web App
  - Docker
  - NuGet
- Custom Database Connections
- Custom Identity Store
  - Overview
  - Partial Implementation
  - Full Implementation
  - Tenancy With Entity Framework
  - NoSql Implementation (MongoDB)
- Custom CSP
- Users
  - Searching for Users
  - Adding Users
  - Editing Users
  - Deleting Users
  - Merge Users
  - Set User Password
  - Session Management
  - User Reports
  - Bulk User Import
- Roles
  - Creating Roles
  - Managing Roles
  - Managing Users in a Role
  - Managing Role Claims
- Claim Types
- Clients
  - Searching for Clients
  - Adding Clients
  - Adding a SAML Client
  - Adding a WS-Fed Client
  - Editing Clients
  - Deleting Clients
  - Clone Client
- Import and Export
  - Exporting Clients
  - Importing Clients
  - Importing Client Configuration with Secrets
  - Importing SAML Clients with Certificates
  - Import and Export Via the API
- Dynamic Authentication Providers
  - What is Dynamic Authentication
  - Enabling or disabling Dynamic Authentication
  - Add a Dynamic Provider
    - First Steps
    - Adding OIDC Provider
    - Adding SAML Provider
  - Edit a Dynamic Provider
    - Accessing edit view
    - Editing a OIDC Provider
    - Editing a SAML Provider
  - Deleting a Provider
  - Searching for Provider
- Resources
  - Searching for Resources
  - Creating Resources
  - Editing resources
- Webhooks
  - Webhooks
  - Endpoint Configuration
- MCP
  - Overview
  - Default Server Prompt Instructions
- User Settings Endpoints
- Access Policy
- Keys
- Auditing
- FAQs
- Troubleshooting
  - Unable to start AdminUI
  - Unable to contact IdentityServer
  - Unable to contact API
  - Unable to log in

### Editing a OIDC Provider

- -Editing an OIDC Dynamic Auth Provider with AdminUI
- -Details Tab
- -Scopes Tab
- -Advanced Tab
- -Actions Available

## Editing an OIDC Dynamic Auth Provider with AdminUI

Once loaded you will be directed to the details tab by default. The OIDC tabs to view and edit are:

- `Details Tab` page for managing general information about the OIDC provider
- `Scopes Tab` page for managing the scopes assigned to the OIDC provider
- `Advanced Tab` page for managing advance configuration of the OIDC provider

### Details Tab

The `Details` tab is where you will be able to view the "Scheme" of the dynamic provider along with modify the following elements:

- `Enabled` a switch to enable and disable the provider
- `Display Name` a name used to identify the provider in the login screen
- `Authority URL` the URL of the provider (must begin with `https://`)
- `Client ID` internal identifier to the external provider
- `Callback Path (Only in RSK mode)` path of the ACS endpoint
- `OAuth Flow` the flow used by provider
- `Sign In Scheme (Only in RSK mode)` the sign in Scheme representing an authentication handler on your IDS code
- `Different Sign Out Scheme (Only in RSK mode)` enable entering Sign out Scheme different to the Sign in Scheme
- `Sign Out Scheme (Only in RSK mode)` the sign out Scheme representing an authentication handler on your IDS code
- `Client Secret` an optional secret used to access external provider

### Scopes Tab

The `Scopes` tab is where you can view, add, and remove scopes for a provider.

### Advanced Tab

In `Duende` mode the only option available is `Get Claims From User Info Endpoint`.

In `Rsk` mode there are available several inner tabs as follows.

#### Advanced tab: Request

- `Resource` ...
- `Response Mode` the mechanism to be used for returning Authorization Response parameters from the Authorization Endpoint. The options are:
  - `Query (query)` parameters are encoded in the query string at the end of the redirect URI
  - `FormPost (form_post)` parameters are are encoded as HTML form parameters transmitted in a HTML Post
  - `Fragment (fragment)` parameters are encoded in the fragment at the end of the redirect URI
- `Prompt` specifies whether the Authorization Server prompts the End-User for reauthentication and consent

#### Advanced tab: Claims

- `Get Claims From User Info Endpoint` retrieves additional claims from the user info endpoint after creating an identity from id_token
- `Map Inbound Claims` maps claim types that are extracted when validating a JwtSecurityToken.

#### Advanced tab: Sign Out

- `Remote Sign Out Path` requests received on this path will cause the middleware to invoke SignOut using the Sign Out Scheme
- `Signed Out Redirect Uri` where the user agent will be redirected to after application is signed out from the identity provider (this is executed after the "Signed Out Redirect Uri")
- `Signed Out Callback Path` the request path within the application's base path where the user agent will be returned after sign out from the identity provider

#### Advanced tab: Metadata

- `Refresh Metadata On Issuer Key Not Found` this allows for automatic recovery in the event of a signature key rollover
- `Metadata Refresh Interval` represents how often an automatic metadata refresh should occur

#### Advanced tab: Tokens

- `Save Tokens` defines whether access and refresh tokens should be stored in the AuthenticationProperties after a successful authorization
- `Use Token Lifetime` indicates that the authentication session lifetime (e.g. cookies) should match that of the authentication token

#### Advanced tab: Other

- `Retrieval Refresh Interval` represents the minimum time between retrievals, in the event that a retrieval failed, or that a refresh was explicitly requested
- `Skip Unrecognized Requests` if enabled the handler will pass requests through that do not contain OpenIdConnect authentication responses
- `Disable Telemetry`

### Actions Available

In the edit screen there are two options available, these are described below:

- `Save All` Once valid changes have been made this button should be clickable and it will save the changes made in all 3 of the tabs.
- `Delete` Will completely remove the provider from IdentityServer

Previous Next