Connect an OpenID Connect app

Status: OIDC is supported. SAML guide is separate.

1. Register. Manage integrations → Add application → OpenID Connect. Start with the test registration.
2. Settings. Add your exact redirect URI(s). Server apps are confidential and get a client secret (shown once). Browser apps are public and never get a secret.
3. Configure your app with any standard OIDC client library — no FarnorID SDK needed:
   • Issuer: https://auth.farnorid.com/oidc (test: https://auth.farnorid.com/test/oidc) — discovery fills in every endpoint.
   • Flow: Authorization Code with PKCE S256. Implicit and password grants are not available.
   • Scopes: openid plus profile, email, offline_access as registered.
   • Use the ID token's sub as the user key. It's stable for your app and never changes with email. Don't key accounts by email.
4. Optional, recommended: after your callback creates its session, call POST https://auth.farnorid.com/api/partner/confirm with Authorization: Bearer <access token>. FarnorID then shows “App confirmed sign-in” instead of “Sign-in sent to app”.
5. Sign-out on revoke: register a back-channel logout URL (OIDC Back-Channel Logout 1.0). Partner apps also call POST https://auth.farnorid.com/api/partner/status (client_secret_basic, body {"sub": "…"}) at least every 60 seconds for protected access and treat any error as signed out.
6. Test connection → run the test, sign in from your app, confirm all four steps pass.
7. Production: fill in production settings (separate client ID and secret), publish the domain token at /.well-known/farnorid-domain.txt, test again, then Enable for production.

Token lifetimes: authorization code 60 s (single use), ID/access token 5 min, refresh 7-day idle / 30-day absolute with rotation. A token already issued can't be recalled from an app that validates it offline — use the status check for fast sign-out.

Reference app: reference/oidc-app.ts (Node, openid-client).