Add Client

{{client.clientId|capitalize}}

Specifies ID referenced in URI and tokens. For example 'my-client'
Specifies display name of the client. For example 'My Client'. Supports keys for localized values as well. For example: ${my_client}
Disabled clients cannot initiate a login or have obtain access tokens.
If enabled users have to consent to client access.
When enabled, client can only obtain grants from grant REST API.
'OpenID connect' allows Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server. 'SAML' enables web-based authentication and authorization scenarios including cross-domain single sign-on (SSO) and uses security tokens containing assertions to pass information.
'Confidential' clients require a secret to initiate login protocol. 'Public' clients do not require a secret. 'Bearer-only' clients are web services that never initiate a login.
Should a statement specifying the method and timestamp be included in login responses?
Should SAML documents be signed by the realm?
Should assertions inside SAML documents be signed? This setting isn't needed if document is already being signed.
The signature algorithm to use to sign documents.
Should SAML assertions be encrypted with client's public key using AES?
Will the client sign their saml requests and responses? And should they be validated?
Always use POST binding for responses.
When true, logout requires a browser redirect to client. When false, server performs a background invocation for logout.
Ignore requested NameID subject format and use admin console configured one.
The name ID format to use for the subject.
Valid URI pattern a browser can redirect to after a successful login or logout. Simple wildcards are allowed i.e. 'http://example.com/*'. Relative path can be specified too i.e. /my/relative/path/*. Relative paths will generate a redirect URI using the request's host and port. For SAML, you must set valid URI patterns if you are relying on the consumer service URL embedded with the login request.
Default URL to use when the auth server needs to redirect or link back to the client.
URL to the admin interface of the client. Set this if the client supports the adapter REST API. This REST API allows the auth server to push revocation policies and other adminstrative tasks. Usually this is set to the base URL of the client.
If configured, this URL will be used for every binding to both the SP's Assertion Consumer and Single Logout Services. This can be individually overiden for each binding and service in the Fine Grain SAML Endpoint Configuration.
Allowed CORS origins.
Fine Grain SAML Endpoint Configuration Expand this section to configure exact URLs for Assertion Consumer and Single Logout Service.
SAML POST Binding URL for the client's assertion consumer service (login responses). You can leave this blank if you do not have a URL for this binding.
SAML Redirect Binding URL for the client's assertion consumer service (login responses). You can leave this blank if you do not have a URL for this binding.
SAML POST Binding URL for the client's single logout service. You can leave this blank if you are using a different binding
SAML Redirect Binding URL for the client's single logout service. You can leave this blank if you are using a different binding.