Indicium extension of the OPENID PROVIDERS definition

Hello Math,

We will be looking into allowing additional parameters to be configured for OpenID providers in IAM. Until then, I think you could solve this problem by configuring an outbound rewrite rule.

Assuming that Indicium is hosted on IIS you can follow the steps below. If not, then you could apply a similar solution elsewhere.

1. Open the IIS Manager and navigate to the Indicium web application that handles the redirect to the OpenID provider.
2. Click on URL Rewrite

   

3. Click on Add Rule(s)

   

4. Create a new Blank rule under Outbound rules

   

5. Configure it like this

    

I used the following value to match the Location header returned in the response. When a user clicks the button to sign in with an Identity Provider, Indicium will redirect the browser to the Authorization URL of that Identity provider. Redirects are done by means of a 302 response with a Location header indicating where the browser should redirect to. So the idea here is that we capture all redirects to the specified Identity Provider. You can make this condition more or less specific if that seems better to you.

.*/AutentIDConnect/npa/authorize?.*

Then at the Action part, we will rewrite this Location header and add the necessary parameters to it:

{RESPONSE_LOCATION}&acr_values=http://eidas.europa.eu/LoA/high&display=no_eidas_country_selection

Note that I have not tested any of this. There could be some mistakes in my example, but the general idea should work.

I hope this helps.