OIDC 对接文档

适用于标准 OAuth2 Authorization Code + OpenID Connect（RS256 ID Token + JWKS）。

Endpoints

Scope

openid profile email

Authorize URL 示例

https://sso.wantide.com/sso/authorize?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=https%3A%2F%2Fexample.com%2Fcallback&scope=openid%20profile%20email&state=RANDOM_STATE&code_challenge=S256_CHALLENGE&code_challenge_method=S256

Token 请求示例

curl -X POST 'https://sso.wantide.com/sso/token' \
  -u 'YOUR_CLIENT_ID:YOUR_CLIENT_SECRET' \
  -d 'grant_type=authorization_code' \
  -d 'code=AUTHORIZATION_CODE' \
  -d 'redirect_uri=https://example.com/callback' \
  -d 'code_verifier=ORIGINAL_PKCE_VERIFIER'

# 也支持 client_secret_post：
curl -X POST 'https://sso.wantide.com/sso/token' \
  -d 'grant_type=authorization_code' \
  -d 'client_id=YOUR_CLIENT_ID' \
  -d 'client_secret=YOUR_CLIENT_SECRET' \
  -d 'code=AUTHORIZATION_CODE' \
  -d 'redirect_uri=https://example.com/callback' \
  -d 'code_verifier=ORIGINAL_PKCE_VERIFIER'

Userinfo 请求示例

curl -H 'Authorization: Bearer ACCESS_TOKEN' 'https://sso.wantide.com/sso/userinfo'

Token 响应示例

{
  "access_token": "ACCESS_TOKEN",
  "id_token": "RS256_ID_TOKEN",
  "token_type": "Bearer",
  "expires_in": 604800,
  "scope": "openid profile email"
}

Userinfo 响应示例

{
  "sub": "USER_ID",
  "account": "user-account",
  "name": "User Name",
  "email": "user@example.com",
  "roles": ["user"]
}