Obtaining a Token with an OpenID Connect ID Token

Function

This API is used to obtain a federated identity authentication token using an OpenID Connect ID token.

The API can be called using both the global endpoint and region-specific endpoints. For IAM endpoints, see Regions and Endpoints.

Debugging

You can debug this API in API Explorer.

URI

POST /v3.0/OS-AUTH/id-token/tokens

Request Parameters

Response Parameters

Status code: 201

Example Request

• Request for obtaining a scoped token for a specific project

  POST /v3.0/OS-AUTH/id-token/tokens

    
   { 
     "auth" : { 
       "id_token" : { 
         "id" : "eyJhbGciOiJSU..." 
       }, 
       "scope" : { 
         "project" : { 
           "id" : "46419baef4324...", 
           "name" : "ap-southeast-1" 
         } 
       } 
     } 
   }

• Request for obtaining a scoped token for a specific domain

  POST /v3.0/OS-AUTH/id-token/tokens

   
    
   { 
     "auth" : { 
       "id_token" : { 
         "id" : "eyJhbGciOiJSU..." 
       }, 
       "scope" : { 
         "domain" : { 
           "id" : "063bb260a480...", 
           "name" : "IAMDomain" 
         } 
       } 
     } 
   }

• Request for obtaining an unscoped token

  POST /v3.0/OS-AUTH/id-token/tokens

   
    
   { 
     "auth" : { 
       "id_token" : { 
         "id" : "eyJhbGciOiJSU..." 
       } 
     } 
   }

Example Response

Status code: 201

The token is obtained successfully.

{ 
  "token" : { 
    "expires_at" : "2018-03-13T03:00:01.168000Z", 
    "methods" : [ "mapped" ], 
    "issued_at" : "2018-03-12T03:00:01.168000Z", 
    "user" : { 
      "OS-FEDERATION" : { 
        "identity_provider" : { 
          "id" : "idptest" 
        }, 
        "protocol" : { 
          "id" : "oidc" 
        }, 
        "groups" : [ { 
          "name" : "admin", 
          "id" : "45a8c8f..." 
        } ] 
      }, 
      "domain" : { 
        "id" : "063bb260a480...", 
        "name" : "IAMDomain" 
      }, 
      "name" : "FederationUser", 
      "id" : "suvmgvUZc4PaCOEc..." 
    } 
  } 
}

Status code: 400

Invalid parameters.

{ 
  "error_msg" : "Request body is invalid.", 
  "error_code" : "IAM.0011" 
}

Status code: 401

Authentication failed.

{ 
  "error_msg" : "The request you have made requires authentication.", 
  "error_code" : "IAM.0001" 
}

Status code: 403

Access denied.

{ 
  "error_msg" : "Policy doesn't allow %(actions)s to be performed.", 
  "error_code" : "IAM.0003" 
}

Status code: 404

The requested resource cannot be found.

{ 
  "error_msg" : "Could not find %(target)s: %(target_id)s.", 
  "error_code" : "IAM.0004" 
}

Status code: 500

Internal system error.

{ 
  "error_msg" : "An unexpected error prevented the server from fulfilling your request.", 
  "error_code" : "IAM.0006" 
}

Status Codes

Error Codes

For details, see Error Codes.