Obtaining an Unscoped Token with an OpenID Connect ID Token

Function

This API is used to obtain an unscoped token using an OpenID Connect ID token.

The API can be called using both the global endpoint and region-specific endpoints. For IAM endpoints, see Regions and Endpoints.

Debugging

You can debug this API in API Explorer.

URI

POST /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}/auth

**Table 1** URI parameters
Parameter	Mandatory	Type	Description
idp_id	Yes	String	Identity provider name.
protocol_id	Yes	String	Protocol ID.

Request Parameters

**Table 2** Parameters in the request header
Parameter	Mandatory	Type	Description
Authorization	Yes	String	ID token of the identity provider. The format is Bearer {ID Token}.

Response Parameters

Status code: 201

**Table 3** Parameters in the response header
Parameter	Type	Description
X-Subject-Token	String	Signed token.

**Table 4** Parameters in the response body
Parameter	Type	Description
token	object	Details about the obtained token.

**Table 5** UnscopedTokenInfo
Parameter	Type	Description
expires_at	String	Time when the token will expire. NOTE: The value is a UTC time in the YYYY-MM-DDTHH:mm:ss.ssssssZ format, for example, 2023-06-28T08:56:33.710000Z. For details about the date and timestamp formats, see ISO-8601.
methods	Array of strings	Token obtaining method. The default value for federated authentication is mapped.
issued_at	String	Time when the token was issued. NOTE: The value is a UTC time in the YYYY-MM-DDTHH:mm:ss.ssssssZ format, for example, 2023-06-28T08:56:33.710000Z. For details about the date and timestamp formats, see ISO-8601.
user	object	User details.
roles	Array of objects	Role or policy details.
catalog	Array of objects	Catalog details.

**Table 6** FederationUserBody
Parameter	Type	Description
OS-FEDERATION	object	Federated user details.
domain	object	Account details.
id	String	User ID.
name	String	Username.

**Table 7** OSFederationInfo
Parameter	Type	Description
identity_provider	object	Identity provider details.
protocol	object	Protocol details.
groups	Array of objects	User group details.

**Table 8** IdpIdInfo
Parameter	Type	Description
id	String	Identity provider ID.

**Table 9** ProtocolIdInfo
Parameter	Type	Description
id	String	Protocol ID.

**Table 10** token.user.OS-FEDERATION.groups
Parameter	Type	Description
id	String	User group ID.
name	String	User group name.

**Table 11** DomainInfo
Parameter	Type	Description
id	String	Account ID.
name	String	Account name.

**Table 12** token.roles
Parameter	Type	Description
id	String	Permission ID.
name	String	Permission name.

**Table 13** token.catalog
Parameter	Type	Description
id	String	Endpoint ID.
interface	String	Visibility of the API. public indicates that the API is available for public access.
region	String	Region which the endpoint belongs to.
region_id	String	Region ID.
url	String	Endpoint URL.

Example Request

Request for obtaining an unscoped token with an OpenID Connect ID token

POST https://{address}/v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}/auth

Example Response

Status code: 201

The token is obtained successfully.

{ 
  "token" : { 
    "expires_at" : "2018-03-13T03:00:01.168000Z", 
    "methods" : [ "mapped" ], 
    "issued_at" : "2018-03-12T03:00:01.168000Z", 
    "user" : { 
      "OS-FEDERATION" : { 
        "identity_provider" : { 
          "id" : "idptest" 
        }, 
        "protocol" : { 
          "id" : "oidc" 
        }, 
        "groups" : [ { 
          "name" : "admin", 
          "id" : "45a8c8f..." 
        } ] 
      }, 
      "domain" : { 
        "id" : "063bb260a480...", 
        "name" : "IAMDomain" 
      }, 
      "name" : "FederationUser", 
      "id" : "suvmgvUZc4PaCOEc..." 
    } 
  } 
}

Status code: 400

Invalid parameters.

{ 
  "error" : { 
    "code" : 400, 
    "message" : "Request parameter 'idp id' is invalid.", 
    "title" : "Bad Request" 
  } 
}

Status code: 401

Authentication failed.

{ 
  "error" : { 
    "code" : 401, 
    "message" : "The request you have made requires authentication.", 
    "title" : "Unauthorized" 
  } 
}

Status code: 403

Access denied.

{ 
  "error" : { 
    "code" : 403, 
    "message" : "You are not authorized to perform the requested action.", 
    "title" : "Forbidden" 
  } 
}

Status code: 404

The server could not find the requested page.

{ 
  "error" : { 
    "code" : 404, 
    "message" : "Could not find %(target)s: %(target_id)s.", 
    "title" : "Not Found" 
  } 
}

Status code: 500

Internal system error.

{ 
  "error" : { 
    "code" : 500, 
    "message" : "An unexpected error prevented the server from fulfilling your request.", 
    "title" : "Internal Server Error" 
  } 
}

Status Codes

Status Code	Description
201	The token is obtained successfully.
400	Invalid parameters.
401	Authentication failed.
403	Access denied.
404	The server could not find the requested page.
500	Internal system error.