You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: _data/errors.yml
+5-5Lines changed: 5 additions & 5 deletions
Original file line number
Diff line number
Diff line change
@@ -10,8 +10,8 @@ oidc:
10
10
This specific error occurs when Login.gov receives an OIDC request from a Service Provider that contains a `client_id` that is either not registered or not active with Login.gov. The `client_id` specified in the request must match EXACTLY the Issuer defined in the Portal.
11
11
##### What to do:
12
12
- Ensure the authentication request has a `client_id` value
13
-
- Ensure that the `client_id` sent in the authentication request matches the Issuer registered in your application's configuration on the [Partner Portal](https://portal.int.identitysandbox.gov/){:target="_blank"}.
14
-
- Ensure that the integration configuration's "Accessible" setting is set to "Yes".
13
+
- Ensure that the `client_id` sent in the authentication request matches the Issuer registered in your application on the [Partner Portal](https://portal.int.identitysandbox.gov/){:target="_blank"}.
14
+
- Ensure that the application configuration's "Accessible" setting is set to "Yes".
15
15
- See our video [How to Troubleshoot and Fix "Bad client_id" Error for OIDC Integrations](https://www.youtube.com/watch?v=MAgSnjp1aOE) for a detailed visual explanation.
16
16
- title: Missing a valid IAL level
17
17
id: oidc-missing-ial
@@ -21,8 +21,8 @@ oidc:
21
21
No IAL Service Levels are present in the `acr_values` parameter of the authentication request.
22
22
##### What to do:
23
23
Check the `acr_values` parameter in your authentication request and ensure that you are passing either:
24
-
- `urn:acr.login.gov:auth-only` for Authentication Only integrations, OR;
25
-
- `urn:acr.login.gov:verified` for Identity-Verification Permitted integrations.
24
+
- `urn:acr.login.gov:auth-only` for Authentication Only applications, OR;
25
+
- `urn:acr.login.gov:verified` for Identity-Verification Permitted applications.
26
26
Learn more about IAL Service Level values here: [https://developers.login.gov/oidc/authorization/#service_level](/oidc/authorization/#service_level){:target="_blank"}
27
27
- title: The acr_values are not authorized
28
28
id: oidc-missing-acr-values
@@ -104,7 +104,7 @@ oidc:
104
104
##### What to do:
105
105
- Ensure the logout request has a `client_id` value.
106
106
- Ensure that the `client_id` sent in the logout request matches the one registered in your application on the [Partner Portal](https://dashboard.int.identitysandbox.gov/){:target="_blank"}.
107
-
- Ensure that the integration configuration's `active` value is set to `true`.
107
+
- Ensure that the application configuration's `active` value is set to `true`.
Copy file name to clipboardExpand all lines: _includes/support/faq_csp_violation.html
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -4,9 +4,9 @@ <h5>Background:</h5>
4
4
<br/><br/>
5
5
The <atarget="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/form-action">CSP form-action</a> directive restricts which URLs can be used as the target of form submissions from a given context. Certain Chromium-based internet browsers (e.g. Google Chrome and Microsoft Edge) enforce the form-action directive through the entire redirect chain (if any). Other non-Chromium-based browsers only check the first redirect in the chain (e.g. Firefox). For Chromium-based browsers, upon form submission, any attempts to redirect to a url not explicitly listed as a form-action source will violate the CSP directive and cause a failure to load and a console error.
6
6
<br/><br/>
7
-
This error occurs when Service Providers attempt to redirect users to a url that is not registered in the Redirect URLs field in the <atarget="_blank" href="https://dashboard.int.identitysandbox.gov/">Login.gov Portal</a>application's configuration. All urls that users could be redirected to, even as a passthrough, need to be included in the list of Redirect URLs.
7
+
This error occurs when Service Providers attempt to redirect users to a url that is not registered in the Redirect URLs field in the <atarget="_blank" href="https://dashboard.int.identitysandbox.gov/">Login.gov Portal</a> configuration. All urls that users could be redirected to, even as a passthrough, need to be included in the list of Redirect URLs.
8
8
</p>
9
9
<h5>Solution:</h5>
10
10
<p>
11
-
Use the Network tab of your web browser to identify which redirect (302) is hanging or failing. Add that uri to the list of Redirect URIs in your Login.gov Portal integration configuration.
11
+
Use the Network tab of your web browser to identify which redirect (302) is hanging or failing. Add that uri to the list of Redirect URIs in your Login.gov Portal configuration.
Copy file name to clipboardExpand all lines: _includes/support/faq_unauthorized_sp.html
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -10,11 +10,11 @@ <h5>Solution:</h5>
10
10
<p>
11
11
<ul>
12
12
<li>Double check your SAML request to Login.gov and confirm that the Issuer field matches exactly what is defined in the Login.gov <ahref="https://portal.int.identitysandbox.gov/" class="usa-link">Partner Portal</a>.</li>
13
-
<li>Ensure that the integration configuration’s "Accessible" setting is set to "Yes".</li>
13
+
<li>Ensure that the application configuration’s "Accessible" setting is set to "Yes".</li>
14
14
<li>See our video <ahref="https://www.youtube.com/watch?v=SzTRc_c_5I4" class="usa-link">How to Troubleshoot and Fix "Unauthorized Service Provider" Error for SAML Integrations</a> for a detailed visual explanation.</li>
15
15
</ul>
16
16
17
-
Note that certain Service Providers will not allow partners to set or change the Issuer value after the application is configured (e.g. MS Power Apps Portal). In this case, the best option would be to create the Login.gov Portal integration configuration after the Service Provider application has defined the Issuer and use that Issuer in the Portal.
17
+
Note that certain Service Providers will not allow partners to set or change the Issuer value after the application is configured (e.g. MS Power Apps Portal). In this case, the best option would be to create the Login.gov Portal configuration after the Service Provider application has defined the Issuer and use that Issuer in the Portal.
18
18
</p>
19
19
20
20
<!-- markdown has to be formatted left-aligned -->
Copy file name to clipboardExpand all lines: _pages/oidc/getting-started.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -60,9 +60,9 @@ You are able to test authentication methods in real time with a testing account
60
60
61
61
- Select the “Sign-in” button to create a new account. Anyone with a .gov or .mil email address may request an account.
62
62
- Create a new team - see [Testing](/testing/) page for instructions.
63
-
- Create a certificate - before creating your configuration you'll need to create a certificate that will be used to sign your requests. You can create a certificate using openssl. The example command to create the certificate from your terminal is:
63
+
- Create a certificate - before creating your application you'll need to create a certificate that will be used to sign your requests. You can create a certificate using openssl. The example command to create the certificate from your terminal is:
Copy file name to clipboardExpand all lines: _pages/oidc/token.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,7 +23,7 @@ sidenav:
23
23
24
24
---
25
25
{% capture client_assertion %}
26
-
A [JWT](https://jwt.io/){:class="usa-link--external"} signed with the client’s private key (minimum length of 2048 bits) associated with the public key uploaded to your integration configuration within the Portal. The JWT should use the RS256 algorithm and containing the following claims:
26
+
A [JWT](https://jwt.io/){:class="usa-link--external"} signed with the client’s private key (minimum length of 2048 bits) associated with the public key uploaded to your application configuration within the Portal. The JWT should use the RS256 algorithm and containing the following claims:
27
27
-**iss** (string) — The issuer, which must be the `client_id`.
28
28
-**sub** (string) — The subject, which must also be the `client_id`.
29
29
-**aud** (string) — The audience, which should be (or, in the case of multiple audience values, include) the URL of the token endpoint, for example: `https://idp.int.identitysandbox.gov/api/openid_connect/token`
Copy file name to clipboardExpand all lines: _pages/oidc/token/pkce.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,7 +23,7 @@ sidenav:
23
23
24
24
---
25
25
{% capture client_assertion %}
26
-
A [JWT](https://jwt.io/){:class="usa-link--external"} signed with the client’s private key (minimum length of 2048 bits) associated with the public key uploaded to your integration configuration within the Dashboard. The JWT should use the RS256 algorithm and containing the following claims:
26
+
A [JWT](https://jwt.io/){:class="usa-link--external"} signed with the client’s private key (minimum length of 2048 bits) associated with the public key uploaded to your application configuration within the Dashboard. The JWT should use the RS256 algorithm and containing the following claims:
27
27
-**iss** (string) — The issuer, which must be the `client_id`.
28
28
-**sub** (string) — The subject, which must also be the `client_id`.
29
29
-**aud** (string) — The audience, which should be (or, in the case of multiple audience values, include) the URL of the token endpoint, for example: `https://idp.int.identitysandbox.gov/api/openid_connect/token`
Copy file name to clipboardExpand all lines: _pages/overview.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -30,5 +30,5 @@ This is the configuration for your application within Login.gov’s identity pro
30
30
To configure a test application in the sandbox environment:
31
31
* Create an account in the [Login.gov Portal](https://portal.int.identitysandbox.gov). From here you will be able to test various configurations and determine what is right for your agency.
32
32
* Select between [OIDC]({{ site.baseurl }}/oidc/) or [SAML]({{ site.baseurl }}/saml/) protocol implementation protocols and understand which user attributes are required.
33
-
* If you have questions when testing your integration, read through our [FAQs]({{ site.baseurl }}/support/) or submit a ticket to our [technical support help desk]({{ site.baseurl}}/support/#contacting-partner-support).
34
-
* Before submitting a request to move your application's configuration to production, review the [User experience]({{ site.baseurl }}/design-guidelines/) page and the [Production]({{ site.baseurl }}/production/) page. Additional requirements, like a [signed Interagency agreement]({{ site.baseurl }}/production/#confirm-interagency-agreement-iaa) (IAA) and [agency logo]({{ site.baseurl }}/user-experience/agency-logo/), are described in these pages.
33
+
* If you have questions when testing your app, read through our [FAQs]({{ site.baseurl }}/support/) or submit a ticket to our [technical support help desk]({{ site.baseurl}}/support/#contacting-partner-support).
34
+
* Before submitting a request to move your app to production, review the [User experience]({{ site.baseurl }}/design-guidelines/) page and the [Production]({{ site.baseurl }}/production/) page. Additional requirements, like a [signed Interagency agreement]({{ site.baseurl }}/production/#confirm-interagency-agreement-iaa) (IAA) and [agency logo]({{ site.baseurl }}/user-experience/agency-logo/), are described in these pages.
Copy file name to clipboardExpand all lines: _pages/production.md
+9-9Lines changed: 9 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -35,7 +35,7 @@ Make sure you have the following items ready before you start the deployment pro
35
35
36
36
-[Signed Interagency Agreement (IAA) listing this integration ]({{ site.baseurl}}/production/#confirm-interagency-agreement-iaa)
37
37
38
-
- A dedicated [integration configuration within the Portal](https://dashboard.int.identitysandbox.gov/)
38
+
- A dedicated [application configuration within the Portal](https://dashboard.int.identitysandbox.gov/)
39
39
* We recommend having two configurations, one that is intended for deployment to production and one which is purely for testing purposes.
40
40
* All production urls should have .gov, .mil, or a dedicated .com address and point to an Authority to Operate (ATO) approved environment.
41
41
@@ -69,23 +69,23 @@ Please reach out to your agency IAA contact if you have any questions. If your a
69
69
70
70
## Production configuration process
71
71
72
-
Before you can request deployment, you need to create a new and separate integration configuration on our partner portal. This new app will include your production certificate, urls, and logo. When starting this process you need the following items ready to go:
72
+
Before you can request deployment, you need to create a new and separate application on our partner portal. This new app will include your production certificate, urls, and logo. When starting this process you need the following items ready to go:
73
73
74
74
- Signed IAA listing this integration
75
75
- ATO approved environment
76
76
-[Approved agency logo](/user-experience/agency-logo/) for your app
77
77
78
-
When you have the components required, follow these steps to create your production integration configuration:
78
+
When you have the components required, follow these steps to create your production configuration app:
79
79
80
80
1.[Create a new app on the](https://dashboard.int.identitysandbox.gov/) Login.gov Partner Portal. Select “Apps” from the top right menu, then select the “Create a new app” button.
81
81
82
82
1. Choose an agency team for the app from the drop down menu.
83
83
84
84
1. Select "Ready for Production" in the Dashboard Configuration section.
85
85
86
-
1. Enter the name of the app as it appears in your IAA in the "Configuration name" field. Do NOT use environment names such as "Prod" or "Production".
86
+
1. Enter the name of the app as it appears in your IAA in the "App Name" field. Do NOT use environment names such as "Prod" or "Production".
87
87
88
-
1. Enter the name of the app as it should appear to users in the "Friendly name" field. This is the app name a user will see when logging in.
88
+
1. Enter the name of the app as it should appear to users in the "Friendly Name" field. This is the app name a user will see when logging in.
89
89
90
90
1. Select the Next button to move to the next steps.
91
91
@@ -107,7 +107,7 @@ When you have the components required, follow these steps to create your product
107
107
108
108
1. Select the sign-in, sign-up, and forgot password help text users will encounter in your app. This step is optional but encouraged to ensure better usability. Take a look at the [user experience guidance]({% link _pages/user-experience/help-text.md %}) for a good example of help text.
109
109
110
-
1. Once all fields are complete select the "Create configuration" button.
110
+
1. Once all fields are complete select the "Create app" button.
111
111
112
112
If you encounter errors or have questions after completing these steps, please submit a technical support ticket through the [Partner Support Help Desk.]({{ site.baseurl}}/support/#contacting-partner-support)
113
113
@@ -135,7 +135,7 @@ Once you have:
135
135
136
136
1.[Confirmed that this integration is listed in a signed IAA](https://login.gov/partners/get-started/#interagency-agreement-iaa-process). **Do not request deployment if you are not certain that your application is listed in a signed IAA.**
137
137
138
-
2.[Created a production configuration]({{site.baseurl}}/production/#production-configuration-process).
138
+
2.[Created a production configuration app]({{site.baseurl}}/production/#production-configuration-process).
139
139
140
140
3. Confirmed that you have a logo uploaded to your production configuration in the [Partner Portal](https://dashboard.int.identitysandbox.gov/). **An uploaded logo is required for the deployment process.**
141
141
@@ -153,9 +153,9 @@ We recommend using the sandbox environment to test your new app before requestin
153
153
154
154
## Changes to production applications
155
155
156
-
**Changes to production configurations are not automatic and may take up to two weeks.**
156
+
**Changes to the production app are not automatic and may take up to two weeks.**
157
157
158
-
If you need to make any changes to your deployed integration, please update your production integration configuration in the sandbox and test the changes you wish to deploy. After you have confirmed the change, **you must submit a change request** through the [Partner Support Help Desk](https://zendesk.login.gov) to ensure the change takes effect in production.
158
+
If you need to make any changes to your deployed integration, please update your production configuration app in the sandbox and test the changes you wish to deploy. After you have confirmed the change, **you must submit a change request** through the [Partner Support Help Desk](https://zendesk.login.gov) to ensure the change takes effect in production.
Copy file name to clipboardExpand all lines: _pages/testing.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -51,18 +51,18 @@ Please submit a support ticket through the [Partner Support Help Desk](https://z
51
51
1. If you already have a Login.gov test account, select the “Sign in” button in the upper-right corner to sign in.
52
52
1. You must create a team before you can create a new app. Create a new team by selecting the “Continue” button under “Create your first team.” If you have previously created a team you can move on to the next step.
53
53
1. If necessary, add users to that team by clicking the “Add users” button. This is the opportunity to add contractors or anyone without a .gov or a .mil email address.
54
-
1. After creating your team, select the Apps tab. This page is where you will find all of the integration configurations you and your team create.
54
+
1. After creating your team, select the Apps tab. This page is where you will find all of the applications you and your team create.
55
55
1. Select the “Create a new app” button and follow the steps to register a new application with the Login.gov IdP in the test sandbox environment. You can only have one app creation in progress at a time. There are links to additional information throughout the form. We recommend reading through the descriptions carefully.
56
56
1. To troubleshoot specific errors, please visit our error dictionary in the [troubleshooting section of our developer documentation]({% link _pages/support.md %}). If the guidance there does not resolve the error, please submit a support ticket through the [Partner Support Help Desk](https://zendesk.login.gov/).
57
57
1. Start testing!
58
-
1. When you're ready to go to production, please [follow our production deployment instructions]({% link _pages/production.md %}). We'll manage your configuration's promotion to production. **The move to production may take up to two weeks.**
58
+
1. When you're ready to go to production, please [follow our production deployment instructions]({% link _pages/production.md %}). We'll manage your application's promotion to production. **The move to production may take up to two weeks.**
59
59
60
60
## If you lost access to a sandbox team
61
61
62
62
Login.gov does not manage user accounts. If you have lost access to a team:
63
63
* Request someone on your team who still has access to re-add you.
64
64
* If there is no one left with access, contact the partner agency's Login.gov Point of Contact and request that they re-add you to the team.
65
-
* If they are unable to re-add you, request that they open up a ticket through the [Partner Support Help Desk](https://zendesk.login.gov) explaining the situation and confirming that you need access. They must include either the issuer or the link to the integration configuration.
65
+
* If they are unable to re-add you, request that they open up a ticket through the [Partner Support Help Desk](https://zendesk.login.gov) explaining the situation and confirming that you need access. They must include either the issuer or the link to the application configuration.
Copy file name to clipboardExpand all lines: _pages/user-experience/help-text.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,7 +24,7 @@ sidenav:
24
24
25
25
## Help text guidance
26
26
27
-
You may include help text to alert the users to specific information that will assist them in logging in, signing up, and logging out. The help text section of the configuration workflow allows you to choose from the default help text options or request custom help text specific to your integration.
27
+
You may include help text to alert the users to specific information that will assist them in logging in, signing up, and logging out. The help text section of the app configuration workflow allows you to choose from the default help text options or request custom help text specific to your integration.
28
28
29
29
Custom help text should follow the guidelines below to be included in your integration:
0 commit comments