question

Calle Gustafsson avatar image
Calle Gustafsson asked

OpenID connect Client Secret should not be required when using id-tokens?

When the open-id server generates id-tokens and has both "/.well-known/openid-configuration" "/.well-known/jwks.json" (jwks_uri) setup correctly the client-secret isn't used for anything.

Why is it a required property?

Authentication
10 |1200

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

1 Answer

·
Sarah Zhang avatar image
Sarah Zhang answered

Do you mean the ClientSecret field in the API Create OpenId Connection? When you create the Open Id in the GameManager, this API will be called too. The ClientSecret here is the client secret given by the ID provider. It is not prescribed by PlayFab, but is part of the OpenID Connect protocol. You can search for corresponding questions about ClientSecret through the search engine yourself.

2 comments
10 |1200

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Calle Gustafsson avatar image Calle Gustafsson commented ·

Yes. I mean that field. I know what the field is supposed to do. However what I mean is that it's not used for all different types of flows.

But sure, I can just fill in "unused" as it's not required for the flow I'm implementing.

0 Likes 0 ·
Sarah Zhang avatar image Sarah Zhang Calle Gustafsson commented ·

Thanks for clarifying and sharing your workaround, it looks like a required field in the "configuration", but not have to be a meaningful one. Glad it has no real effect on the workflow you are implementing.

0 Likes 0 ·

Write an Answer

Hint: Notify or tag a user in this post by typing @username.

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.