From bcce84860c4b73e97dc7033113a7dabbf8a549a2 Mon Sep 17 00:00:00 2001 From: Karuna Vengurlekar Date: Thu, 13 Aug 2026 14:24:40 +0530 Subject: [PATCH 1/3] version update info for OIDC --- .../platform-supported-content/modules/oidc.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md index 8e836355bbf..777025040ef 100644 --- a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md +++ b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md @@ -392,13 +392,14 @@ See the section [Optional Features](#optional) information on additional optiona #### API Security Configuration for Client Credential Grant {#client-credential-grant} 1. Start your app, log in as an administrator, for example, *demo_administrator*, and access the Client Credential setup page. -2. If you have the **Automatic Configuration URL** (also known as the well-known endpoint), enter it and click **Import Configuration** to automatically fill the other endpoints. +2. If you are using version x.x.x of the module, configure the **Resource path** and **Expected audience** value. Otherwise, the API security flow fails because audience validation is enabled by default. +3. If you have the **Automatic Configuration URL** (also known as the well-known endpoint), enter it and click **Import Configuration** to automatically fill the other endpoints. {{% alert color="info" %}}If the endpoint URL does not already end with `/.well-known/openid-configuration`, include it at the end. According to the specifications, the URL you need to enter typically ends with `/.well-known/openid-configuration`.{{% /alert %}} If you do not have an automatic configuration URL, you can fill in the other endpoints manually. -3. Optionally, you can select the **Custom AccessToken Parsing** microflow if you want to use additional information from the OIDC IdP. This can be used, for example, to assign end-user roles based on information from the IdP – see [Dynamic Assignment of Userroles (Access Token Parsing)](#access-token-parsing) for more information. -4. Click **Save**. Once you have completed these steps, the Client Credential Configuration is ready for testing. +4. Optionally, you can select the **Custom AccessToken Parsing** microflow if you want to use additional information from the OIDC IdP. This can be used, for example, to assign end-user roles based on information from the IdP – see [Dynamic Assignment of Userroles (Access Token Parsing)](#access-token-parsing) for more information. +5. Click **Save**. Once you have completed these steps, the Client Credential Configuration is ready for testing. #### Microsoft Entra ID Client Configuration for APIs {#azure} @@ -544,9 +545,9 @@ The following constants are mandatory when creating an OIDC SSO Client Credentia Example: `OIDC.Default_SAM_TokenProcessing_CustomATP` * **IsClientGrantOnly** (*default: false*) – allow to create Client Credential Configuration in the application -{{% alert color="warning" %}} -When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration. -{{% /alert %}} + {{% alert color="warning" %}}When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration. + {{% /alert %}} +* **OIDC.APIAuthentication** – If you want the api security client you can use the `APIAuthentication` microflow from the **OIDC.APIAuthentication** folder of the module. ## Configuring Multi-Domain {#multi-domain} From ba07624ff5d489e0061915b9f1627262e5878cb9 Mon Sep 17 00:00:00 2001 From: Karuna Vengurlekar Date: Mon, 17 Aug 2026 15:27:25 +0530 Subject: [PATCH 2/3] Add corrections --- .../platform-supported-content/modules/oidc.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md index 777025040ef..121d3acb02b 100644 --- a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md +++ b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md @@ -547,7 +547,7 @@ Example: `OIDC.Default_SAM_TokenProcessing_CustomATP` {{% alert color="warning" %}}When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration. {{% /alert %}} -* **OIDC.APIAuthentication** – If you want the api security client you can use the `APIAuthentication` microflow from the **OIDC.APIAuthentication** folder of the module. +* **EnableAudienceValidation** (boolean) – If you are setting this as a true then make sure to set Resource path and Expected audience. ## Configuring Multi-Domain {#multi-domain} @@ -790,7 +790,7 @@ You can create your own APIs within your Mendix app and secure the end point ove 1. Create a REST API endpoint which needs to be secured. 2. Use **Custom** as the [authentication method](/refguide/published-rest-service/#authentication) to secure the endpoint with an access token. -3. Select the `OIDC.APIAuthentication` microflow which has `HTTPRequest` as the input and returns `System.User` as the output. +3. Select the `OIDC.APIAuthentication` microflow from the **OIDC.APIAuthentication** folder of the module which has `HTTPRequest` as the input and returns `System.User` as the output. ### Using `APIAuthentication` for Client Credentials Grant @@ -799,7 +799,9 @@ The client credentials grant type is used when applications request an access to 1. Request an Access Token using `/token` endpoint. 2. Access the Secured API Endpoint 3. `APIAuthentication` will validate the token and extract the claims. -4. The OIDC SSO module checks if the `sub` claim (which contains the `client-id`) is present in the access token. If it is not, the module will verify the `client_id`, `appid`, or `cid` parameters. If none of these are found, it will throw an exception message. +4. The OIDC SSO module checks + * if the `sub` claim (which contains the `client-id`) is present in the access token. If it is not, the module will verify the `client_id`, `appid`, or `cid` parameters. If none of these are found, it will throw an exception message. + * if the `audiencevalidationenabled` is true then verify the resource path and expected audince based on the configured values. 5. Create a new user using the client ID from the token if one does not already exist. {{% alert color="info" %}} From 81b093d45660a1fb0c45cab88dcd5c2ee47d0126 Mon Sep 17 00:00:00 2001 From: Karuna Vengurlekar Date: Mon, 17 Aug 2026 16:09:45 +0530 Subject: [PATCH 3/3] Add upgrading info --- .../marketplace/platform-supported-content/modules/oidc.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md index 121d3acb02b..2eaf939b63f 100644 --- a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md +++ b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md @@ -203,6 +203,7 @@ This section provides an overview of updates for the OIDC SSO module across diff | Mendix Version | OIDC SSO Module Version | Important Migration Changes | Additional Information | | --- | --- | --- | --- | +| 10.24.0 and above | 4.x.x | - | New constant (`EnableAudienceValidation`) has been introduced for the api security. Configure the required values as they are mandatory for the api security flow. | | 10.24.0 and above | 4.6.0 | - | New constant (`OIDC.NonceCookieSameSite`) has been introduced. | | 10.24.0 and above | 4.5.0 | - | New Admin UI and new constants have been introduced. | | | | | `Anonymous` module role has been removed. | @@ -392,7 +393,7 @@ See the section [Optional Features](#optional) information on additional optiona #### API Security Configuration for Client Credential Grant {#client-credential-grant} 1. Start your app, log in as an administrator, for example, *demo_administrator*, and access the Client Credential setup page. -2. If you are using version x.x.x of the module, configure the **Resource path** and **Expected audience** value. Otherwise, the API security flow fails because audience validation is enabled by default. +2. If you are using version x.x.x of the module, configure the **Resource path** and **Expected audience** value. Otherwise, the API security flow fails as audience validation is enabled by default. 3. If you have the **Automatic Configuration URL** (also known as the well-known endpoint), enter it and click **Import Configuration** to automatically fill the other endpoints. {{% alert color="info" %}}If the endpoint URL does not already end with `/.well-known/openid-configuration`, include it at the end. According to the specifications, the URL you need to enter typically ends with `/.well-known/openid-configuration`.{{% /alert %}} @@ -547,7 +548,7 @@ Example: `OIDC.Default_SAM_TokenProcessing_CustomATP` {{% alert color="warning" %}}When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration. {{% /alert %}} -* **EnableAudienceValidation** (boolean) – If you are setting this as a true then make sure to set Resource path and Expected audience. +* **EnableAudienceValidation** (Boolean) – If you are setting this as a true then make sure to set Resource path and Expected audience. ## Configuring Multi-Domain {#multi-domain}