API Endpoints

OIDC Client consists of five endpoints: /, /login, /logout, /callback and /token.

Index

The index endpoint / is used as a healthcheck endpoint, it returns the name of the service as given in the configuration file.

Login

The login endpoint /login generates a state and saves this state to cookies, after which the user is redirected to the AAI server for authentication. Upon a successful authentication at the AAI, the user is returned to the /callback endpoint.

Logout

The logout endpoint /logout is used to destroy the access token cookie and to revoke the access token at the AAI. Upon a successful logout procedure, the user is returned to the url_redirect address from the configuration file.

Callback

The callback endpoint /callback acts as a landing site for the returning user from the AAI server. Upon returning to the OIDC Client from the AAI server, OIDC Client extracts state and code from the callback request, and uses these values to request a token from the AAI server. Upon a successful retrieval of an access token, the access token is saved to the browser cookies.

Some of the created cookies can be considered _unsafe_ (not http_only) for the purpose of displaying values in UI for logged in state.

Token

Display token from encrypted session storage for easy retrieval. Alternate way to inspect the access token is to look at the browser cookies.

Cookies

Cookies created and used by the OIDC Client and their default settings.

Cookie	Origin	Purpose	Lifetime	Secure	Http Only
AIOHTTP_SESSION	/login	Store state at login to be checked upon callback. Store access token at callback to be displayed at token endpoint.	Session	True	True
access_token	/callback	Sent along same-domain requests for authorizing access to data	1 hour	True	True
logged_in	/callback	Used to display logged in state in UI	1 hour	True	False