If your app is on the OpenID Connect sign-in standard, it works with a standard OpenID Connect library. You give your library the Discovery URL, your Client ID and, for a confidential app, your client secret. The library fetches the rest itself.
Discovery URL and issuer
Every website of your association is a provider of its own. The issuer is the website's address, and the Discovery URL is that address followed by /.well-known/openid-configuration:
https://www.vereniging.nl/.well-known/openid-configuration
You find the Issuer and Discovery URL of each website on your app's page under Settings > Apps. Choose the website your members log in on; a token only works on your own association's websites.
What we support
The authorization code flow, with
response_type=code.PKCE with
S256. Required for an app with the Public client type.Authenticating at the token endpoint with HTTP Basic (
client_secret_basic) for a confidential app, or with the Client ID alone (none) for a public app.ID tokens signed with RS256. The key is at the
jwks_urifrom the Discovery URL,https://www.vereniging.nl/.well-known/jwks.json.nonce,prompt(none,loginandconsent) andmax_age.The userinfo fields
sub,name,given_name,family_name,nickname,preferred_username,picture,gender,birthdate,email,addressandphone_number.Refresh tokens for a confidential app, and revoking tokens through the revocation endpoint.
A redirect_uri must exactly match one of your app's Redirect URIs; we refuse any other. How each step works in detail is explained in How does Log in with Congressus work?
From Legacy to OpenID Connect
Apps that existed before OpenID Connect are on Legacy and work as they always did. When you set an app's Sign-in standard to OpenID Connect, this changes:
The ID token is signed with RS256 and the key from the
jwks_uri, instead of HS256 and your client secret.issin the ID token becomes the website's address, instead ofurn:congressus:nl.nonceis only in the ID token when you sent one. On Legacy it is then empty.We refuse a
redirect_urithat isn't registered for your app. On Legacy we send the member to the first Redirect URI instead.
The endpoints, the token endpoint's response, the userinfo fields and refresh tokens stay the same. First change your application so it verifies the new ID token, then switch the sign-in standard.