An authorization endpoint is an identity provider endpoint where a client starts user authentication and authorization. The client redirects the user there with parameters such as response_type, client_id, redirect_uri, and scope. section 12.3
{
"issuer": "http://localhost:9000",
"authorization_endpoint": "http://localhost:9000/oauth2/authorize", #1
"device_authorization_endpoint":
"http://localhost:9000/oauth2/device_authorization",
"token_endpoint": "http://localhost:9000/oauth2/token", #2
…
}
OIDC discovery identifies the authorization endpoint alongside the token endpoint, allowing the client to obtain the correct URL before starting the flow. section 12.3
Starting authorization-code flow
A client can redirect the user to http://localhost:9000/oauth2/authorize?response_type=code&client_id=oidc-client&redirect_uri=http://127.0.0.1:8080/login/oauth2/code&scope=openid. After successful authentication, the identity provider redirects to the specified URI with a temporary authorization code. section 12.3
The request tells the identity provider:
- Which grant response the client expects: code. section 12.3
- Which client is requesting authentication and where to redirect afterward. section 12.3
- Which scope the client requests, such as openid. section 12.3
