Home
OpenID Implementation
This document contains technical information for publishers and integrators about OpenID Connect (OIDC) protocol.
The Authorization Request
When a web application needs to authenticate a user, it must direct the browser to the URL of the authorization_endpoint, specified in the application metadata. This request is also referred to as the authorization request.
Successful Response
A successful response includes an id_token, a code, or both, depending on the value of the response_type parameter.

OpenID Implementation
This document contains technical information for publishers and integrators about OpenID Connect (OIDC) protocol.
- Overview of CONNECT
  CONNECT is an Identity Management as a Service (IDaaS) platform created and managed by Wiley Partner Solutions that enables publishers to securely sign in users to their applications, using the OpenID Connect (OIDC) protocol.
- Overview of OpenID CONNECT
  The OpenID Connect (OIDC) protocol is an extension of OAuth 2.0 for use as an authentication protocol.
- Client Application Configuration
  A client application represents an application (typically a web application) of a publisher that provides services to authenticated users. Each application always belongs to one CONNECT tenant (customer). Each customer can have multiple applications.
- Metadata Document
  The OpenID Connect service is a metadata document that contains most of the information required for a client application to perform the authorization flow. This includes information such as the URLs to use and the location of the service's public signing keys.
- The Authorization Request
  When a web application needs to authenticate a user, it must direct the browser to the URL of the authorization_endpoint, specified in the application metadata. This request is also referred to as the authorization request.
  - Authorization Request Parameters
    The following parameters are included in an authorization request:
  - Successful Response
    A successful response includes an id_token, a code, or both, depending on the value of the response_type parameter.
  - Error Responses
    Authorization responses are also sent in case of error.
  - List of Authorization Request Errors
    The following error messages appear when an authorization request fails:
- The id_token
  The id_token can be provided either in JSON format or as a signed JWT (configurable on the CONNECT side according to the client application requirements) and includes basic user profile data that allows the authentication of a user on the client application.
- Automatic Login
  The user authentication status on CONNECT can be checked by an application by issuing a "silent" authorization request.
- Retrieving User Data
  Some applications not only need to sign the user in, but also access a web service on behalf of that user using OAuth. An example of this is a service that provides additional user data than those included in the id_token.
- Scopes
- Logout
- Back Channels APIs

Successful Response

A successful response includes an id_token, a code, or both, depending on the value of the response_type parameter.

Responses are sent to the redirect_uri using an HTTP redirection, after the user has been authenticated. For example,

GET  302 Found 
Location: https://www.appname.com/oidc/cbk? 
             id_token=ieyJhbGciOiJSUzUxMiJ9... 
             &code=qeezyJhbGFddiS… 
             &state=jctMTcwMWE1ZmQ2ZTQx