OpenID Connect (OIDC) detailed guidance

NHS CIS2 Authentication meets the OpenID Connect Core 1.0 Specification but not all the specification’s capabilities are supported. This guide describes what is currently supported and how to use it.

1. Registration

How to register with the NHS CIS2 Authentication OpenID Provider

2. Discovery

How to obtain configuration information about the NHS CIS2 Authentication OpenID Provider information

3. Authorization code flow

A detailed description of the Authentication Code Flow provided by the NHS CIS2 Authentication OpenID Provider

4. Scopes and claims

A detailed description of the Scope and Claims supported by the NHS CIS2 Authentication OpenID Provider

5. ACR and AMR values

How to manage the authentication methods supported by the NHS CIS2 Authentication OpenID Provider

6. Signatures

How to improve security by the use of JSON Web Signatures

7. Key management

How to manage keys when using JSON Web Signatures

8. Security considerations

Security Considerations when using OIDC and specific TLS requirements

9. Session management

Guidance and best practice for session management when using the NHS CIS2 Authentication OpenID Provider

10. Role selection

How to select and change role using NHS CIS2 Authentication

Changes to the Detailed Guidance

A summary of the changes made to the detailed guidance since it was first published

Should a Relying Party have a need to use an OpenID Connect feature not described in this guide they should contact [email protected] to discuss whether its use can be enabled.

Key words such as "MUST", "MUST NOT", "SHOULD" etc. are to be interpreted as described in RFC 2119.

Last edited: 18 June 2024 2:28 pm