--- schema_version: "1" id: 371e496cc955ea723281c39c7005924e715bc31fa37926c7185903c34e95dddd title: Configure a Default IDP collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/commerce-api/guides/slas-default-idp.md canonical_url: https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/slas-default-idp.html source_site: developer.salesforce.com content_type: documentation content_hash: de58a31f216212c500b27721bc41692493ca36cd03434acd67bea9f8d388abfd products: - Composable Storefront - Salesforce APIs --- # Configure a Default IDP If you're using Shopper API Access and Login (SLAS) with 3rd party identity providers (IDP) and you would like to use an IDP that is not [supported by SLAS](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/slas-identity-providers.md), use SLAS' Default IDP feature to communicate with your IDP. This guide covers the steps required to configure a Default IDP with SLAS using either the SLAS Admin API or UI. Depending on your IDP, there are two ways to configure it: - If the IDP does not support the [OpenID Connect Discovery](https://datatracker.ietf.org/doc/html/rfc8414) (OIDC) protocol, use SLAS Admin UI or the SLAS Admin API's [registerIdentityProvider](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth-admin?meta=registerIdentityProvider) endpoint. - If the IDP supports the [OpenID Connect Discovery](https://datatracker.ietf.org/doc/html/rfc8414) protocol, use SLAS automation. **important:** SLAS only supports IDPs that support OpenID Connect. SLAS does not support SAML. ## Default IDP Configuration Requirements Configuring a default IDP requires the same SLAS properties as supported IDPs: - The `name`, `clientId`, `clientSecret`, IDP urls, scopes, and `preferenceValue` are all required SLAS IDP client configuration values. For details, see [Register an Identity Provider.](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth-admin?meta=registerIdentityProvider) with the following additional requirements: - Provide the `oidcClaimMapper` property. It is used to map the IDP's token claims to SLAS' required IDP keys to get user information when the user successfully authenticates. The `oidcClaimMapper` property is a list of strings in which each string's format is `$KEY=$VAL`, where `$KEY` is a required SLAS IDP key and `$VAL` is the name of the corresponding IDP token claim. For example: `accessToken=access_token`. `accessToken` is the SLAS key, and `access_token` is the IDP Claim. - Map each of the following keys to the applicable IDP value: - `accessToken`: Value of access token. - `accessTokenTTL`: Time to live of access token. - `refreshToken`: Value of the refresh token. - `idToken`: Value of the ID token. - `subject`: The subject. This is the unique identifier of the shopper. - `userId`: Also the subject. This is the unique identifier of the shopper. - `email`: Shopper's email. - `familyName`: Shopper's family name. - `givenName`: Shopper's given name. - `name`: Shopper's full name. - Verify the values that are returned by your identity provider for IDP `/token` and `/userinfo` endpoints are correct. The following example can be used as a starting point for SLAS IDP configuration: ```text "oidcClaimMapper": [ "accessToken={access_token}", "refreshToken={refresh_token}", "accessTokenTTL={expires_in}", "idToken={id_token}", "subject={sub}", "email={email}", "userId={sub}", "familyName={family_name}", "givenName={given_name}", "name={name}" ] ``` ## Default IDP Configuration with SLAS Admin User Interface To configure a Default IDP using the SLAS Admin user interface (UI): 1. Navigate to the **Idps** tab. 2. Select **Add Idp**. 3. Select the **Idp Name** field and then select `default` from the drop down menu. 4. Add all applicable information. In the **Default IDP Claim Map** field, add the `oidcClaimMapper` keys described in the previous section. 5. Save your configuration information. ## Default IDP Configuration with registerIdentityProvider Endpoint If the third-party IDP does not support the [Open ID Connect Discovery](https://datatracker.ietf.org/doc/html/rfc8414) protocol, use SLAS Admin API's [registerIdentityProvider endpoint](https://developer.salesforce.com/docs/commerce/commerce-api/references/auth-admin?meta=registerIdentityProvider) to configure a Default IDP. For example: ```sh curl --location --request PUT '/tenants//idps/default-idp' \ --header 'Content-Type: application/json' \ --header 'Authorization: Bearer --data '{ "name": "default-idp", "clientId": "my-client-id", "clientSecret": "my-client-secret", "authUrl": "https://idp.example.com/oidc/auth", "tokenUrl": "https://idp.example.com/oidc/token", "tokenInfoUrl": "https://idp.example.com/oidc/tokenInfo", "userInfoUrl": "https://idp.example.com/oidc/auth/userInfo", "redirectUrl": "https://'$CODE'.api.commercecloud.salesforce.com/shopper/auth/v1/idp/callback/default-idp", "wellKnownUrl": "http://localhost:9011/a8f79c10-0d31-b7a9-8409-5979e1ba4d86/.well-known/openid-configuration", "origin": "default", "preferenceValue": false, "scopes": [ "openid", "offline_access" ], "keyId": "", "teamId": "", "isClientCredsBody": 0, "loginMergeClaims": null, "oidcClaimMapper": [ "accessToken=access_token", "refreshToken=refresh_token", "accessTokenTTL=expires_in", "idToken=id_token", "subject=sub", "userId=sub", "email=email", "familyName=family_name", "givenName=given_name", "name=name" ], "isClientCredsBody": false }' ``` ## Default IDP Configuration with SLAS Automation If the IDP supports the [Open ID Connect Discovery](https://datatracker.ietf.org/doc/html/rfc8414) protocol, the simplest way to configure a Default IDP is to use the identity provider `.../well-known/openid-configuration` endpoint. SLAS can then automatically configure your Default IDP. Specify the following required properties for automated Default IDP configuration: - `wellKnownUrl`: The URL of the IDP's Open ID Connect Discovery endpoint. - `useWellKnown`: A boolean that when set to `true` indicates that SLAS should attempt to automatically configure the Default IDP using the Open ID Connect Discovery endpoint. For example: ```sh curl "https://$CODE.api.commercecloud.salesforce.com/shopper/auth-admin/v1/tenants/$TENANT/idps/default-idp" \ --request 'PUT' \ --header 'Content-Type: application/json' \ --header "Authorization: Bearer $ACCESS_TOKEN" \ --data-raw '{ "name": "default-idp", "clientId": "my-client-id", "clientSecret": "my-client-secret", "redirectUrl": "https://'$CODE'.api.commercecloud.salesforce.com/shopper/auth/v1/idp/callback/default-idp", "origin": "default-idp", "preferenceValue": false, "wellKnownUrl": "https://idp.example.com/.well-known/openid-configuration", "useWellKnown": true }' ``` A successful third-party IDP response contains `"claims_parameter_supported": true` and the OIDC claim mappings for SLAS configuration. If `claims_parameter_supported` is not returned, then SLAS uses a default mapping. The IDP token claims for UserInfo can be found in the `/.well-known/openid-configuration/` response from the `claims-supported` section, for example: ```text "claims_parameter_supported": true, "claims_supported": [ "aud", "sub", "iss", "auth_time", "name", "given_name", "family_name", "preferred_username", "email", "acr" ], ``` SLAS then uses the `wellKnownUrl` for configuration, and if successful, returns information similar to the following example: ```json { "id": 111, "name": "default-idp", "clientId": "my-client-id", "clientSecret": "my-client-secret", "authUrl": "http://localhost:9090/realms/SLAS_Realm/protocol/openid-connect/auth", "tokenUrl": "http://localhost:9090/realms/SLAS_Realm/protocol/openid-connect/token", "tokenInfoUrl": "http://localhost:9090/realms/SLAS_Realm/protocol/openid-connect/token", "userInfoUrl": "http://localhost:9090/realms/SLAS_Realm/protocol/openid-connect/userinfo", "redirectUrl": ""https://'$CODE'.api.commercecloud.salesforce.com/shopper/auth/v1/idp/callback/default-idp"", "wellKnownUrl": "https://idp.example.com/.well-known/openid-configuration", "origin": "default-idp", "isPreferred": true, "scopes": [ "openid", "phone", "offline_access", "roles", "address", "microprofile-jwt", "profile", "web-origins", "email", "acr" ], "keyId": "", "teamId": "", "oidcClaimMapper": [ "accessToken=access_token", "refreshToken=refresh_token", "accessTokenTTL=expires_in", "idToken=id_token", "subject=sub", "userId=sub", "email=email", "familyName=family_name", "givenName=given_name", "name=name" ] } ``` ## Troubleshooting SLAS takes the IDP response and applies `oidcClaimMapper` information. Authentication fails and a 400 response code is returned if: - A required mapping parameter is missing. - A required mapping field or mapping value is invalid, for example: an invalid URL. - One or more corresponding claims cannot be found in the IDP token response. In the event of an error, review your `oidcClaimMapper` information for errors. Make sure that your mapping includes valid values for all required fields.