OIDC Authorization (/oauth/authorize/)
URL: https://[server_name]/api/v1/oauth/authorize/
The Authorization Code flow is best used in web and mobile apps. This is the flow used for third party integration, the user authorizes your partner to access its products in your APIs and get the authorization code. This code is needed along with client_id and client_secret to get the access token.
This endpoint will redirect to the access portal configured in the Relying Party.
Supported fields
|
Field |
Display name |
Type |
Required |
Other restrictions |
|---|---|---|---|---|
|
response_type |
response_type which should be set to code for now |
string |
Yes |
|
|
client_id |
client_id that is registered in FortiAuthenticator |
string |
Yes |
|
|
redirect_uri |
Redirect URL after successful or failed authentication |
string |
Yes |
|
|
scope |
Requested scopes |
string |
No |
|
|
code_challenge_method |
Code Verifier hashing algorithm |
string |
If grant_type is Authorization code with PKCE |
only 'S256' accepted |
|
code_challenge |
Base64 URL encoding of the SHA256 hash of the code_verifier |
string |
If grant_type is Authorization code with PKCE |
|
|
approval_prompt |
Controls whether to show the approval page |
string |
No |
Either 'auto' or 'force'. See approval_prompt. |
|
prompt |
Controls user authentication and consent flow |
string |
No |
Either 'none' or 'login' or 'consent'. See prompt. |
approval_prompt
|
Value |
Behavior |
|---|---|
|
auto |
Skips the consent screen if the user has previously granted the requested scopes. |
|
force |
Always prompts the user for consent, even if they have previously granted the requested scopes. |
prompt
|
Value |
Behavior |
|---|---|
|
none |
Should not display any authentication or consent user interface pages. Fails if user interaction is required. |
|
consent |
Always prompts the user for consent. |
|
login |
Should prompt the end-user for authentication. |
Allowed methods
|
HTTP method |
Resource URI |
Action |
|---|---|---|
|
GET |
/api/v1/oauth/authorize |
Redirect to portal for authentication. |
To modify query and response formats or filter results using the REST API, see Filtering query results.
Response codes
|
Code |
Response content |
Description |
|---|---|---|
|
302 redirect |
Portal for authentication |
Successfully redirected to the portal. |
|
302 redirect |
Callback URL with error |
In case of error client will be redirected to redirect_uri with error and error_description. |
Example
https://fac3.org/api/v1/oauth/authorize/?response_type=code&client_id=hlcOZPMGhIjNgU4sZu90nmr4O6q9vsSSdTcUIubM&redirect_uri=https://some_url/noexist/callback
Response:
redirect to the portal specified in the policy of relying party configuration