Documentation Suite v26.2.1

Submit Search

GET Identity Providers

The GET /Identity/Providers operation returns the list of security identity providers configured in Keyfactor Command. Query parameters support filtering using defined criteria, control over pagination by specifying the page number and return limit, and customization of sorting based on specified fields and order. On success, the operation returns HTTP 200 OK with the details of the identity providers.

Tip: The following permissions (see Security Roles and Claims) are required to use this feature:

/identity_providers/read/

Table 563: GET Identity Providers Input Parameters

Name	In	Description
QueryString	Query	A string containing a query to limit the results (for example, field1 -eq value1 AND field2 -gt value2). The default is to return all records. Fields available for querying through the API for the most part match those that appear in the Keyfactor Command Management Portal search dropdowns for the same feature. For querying guidelines, refer to: Searching Identity Providers. The query fields supported for this operation are: AuthenticationScheme AuthorizationUrl DisplayName ProviderTypes
PageReturned	Query	An integer that specifies how many multiples of the returnLimit to skip and offset by before returning results, to enable paging. The default is 1.
ReturnLimit	Query	An integer that specifies how many results to return per page. The default is 50. Very large values can result in long processing time.
SortField	Query	A string containing the property by which the results should be sorted. Fields available for sorting through the API include: AuthenticationEnabled AuthenticationScheme DisplayName Available sort fields are affected by the query provided in QueryString. The default sort field is DisplayName.
SortAscending	Query	An integer that sets the sort order on the returned results. A value of 0 sorts results in ascending order while a value of 1 sorts results in descending order. The default is ascending.

Table 564: GET Identity Provider Response Data

Name

Description

Authentication Enabled

A Boolean indicating whether the identity provider is enabled (True or False).

Note: An identity provider cannot be disabled if the provider is used as the default identity provider for login or as the API client identity provider. Internally defined identity providers cannot be disabled. A disabled identity provider cannot be used to authenticate to Keyfactor Command.

Authentication Scheme A string indicating the authentication scheme (name) for the identity provider. This must be a unique value among identity providers.

Display Name A string indicating the display name for the identity provider. This must be a unique value among identity providers.

Id A string containing the Keyfactor Command reference GUID for the identity provider.

Parameters

An array of objects containing information for each parameter set for the identity provider. Show parameter details.

Name

Type

Example

Description

OIDCAudience

1 - String

Command- OIDC- Client

The audience value for tokens issued from the identity provider.

For Keycloak, this should be set to the same value as the Client Id. For example:

Command- OIDC- Client

This parameter is required.

Auth0APIURL

1 - String

The unique identifier defined in Auth0 or a similar identity provider for the API.

This parameter only appears if Auth0 is selected as the type and is required in that case.

Authority

1 - String

https:// keyidp-server .keyexample.com /realms /Keyfactor

The issuer/authority endpoint URL for the identity provider.

For Keycloak, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation). It is automatically returned by the Discovery Document Endpoint Fetch step. Review it to confirm that it appears correct.

This parameter is required.

Tip: When you add or update an identity provider, the provider’s discovery document is validated based on this authority URL. The discovery document is also validated periodically in the background. The following are validated:

That the discovery document is reachable using the Authority value provided and can be parsed into a valid discovery document.
That the Authority URL matches the Issuer returned in the discovery document.
That all the URLs on the discovery document are using HTTPS.
That the JSONWebKeySetUri value is included on the discovery document.
That any endpoint configuration values (Authorization Endpoint, Token Endpoint, UserInfo Endpoint, JSONWebKeySetUri) that have been saved or are being saved match—including case—the values returned in the discovery document. The UserInfo Endpoint is not a required configuration field, but if a value is provided, it must match what’s in the discovery document.

If any of these validation tests fail, any identity provider changes in process will not be saved and an error will be displayed or logged.

AuthorizationEndpoint

1 - String

https:// keyidp-server .keyexample.com /realms /Keyfactor /protocol /openid-connect /auth

The authorization endpoint URL for the identity provider.

This parameter is required.

ClientId

1 - String

Command- OIDC- Client

The ID of the client application created in the identity provider for primary application use.

For Keycloak, this should be:

Command- OIDC- Client

For more information, see Configuring Keycloak and Collecting Data for the Keyfactor Command Installation).

This parameter is required.

ClientSecret

2 - Secret

The client secret for the client you created in the identity provider to provide the primary authentication from Keyfactor Command to the identity provider.

Value

Description

Secret Value

A string containing the secret. This parameter is used when PAM is not used as the storage location.

Parameters

An object indicating the parameters to supply for PAM authentication. These will vary depending on the PAM provider.

Provider

An integer indicating the ID of the PAM provider.

Use the GET PAM Providers operation to retrieve a list of all the PAM providers to determine the ID.

For example, a username stored as a Keyfactor secret will look like:

Copy

{
   "SecretValue": "KEYEXAMPLE\svc_MyServiceName"
}

For example, a password stored as a Keyfactor secret will look like:

Copy

{
   "SecretValue": "MySuperSecretPassword"
}

A secret stored as a CyberArk PAM secret will look like (where the Provider value—1 in this example—is the Id value from GET PAM Providers and the Safe, Folder, and Object reference the information in the CyberArk safe needed for this record):

Copy

{
   "Provider": "1",
   "Parameters":{
      "Safe":"MySafeName",
      "Folder":"MyFolderName",
      "Object":"MyObjectName"
   }
}

A secret stored as a Delinea PAM secret will look like (where the Provider value—2 in this example—is the Id value from GET PAM Providers and the SecretId and SecretFieldName contain the information created in the Delinea secret server for this purpose):

Copy

{
   "Provider": "2",
   "Parameters":{
      "SecretId":"MyId"
      "SecretFieldName":"MyReferenceName"
   }
}

This parameter is required.

FallbackUniqueClaimType

1 - String

cid

A type of user claim for the identity provider containing a backup unique name for the user. This is provided in case the primary referenced name (see Unique Claim Type) does not contain a value. Some OAuth providers may provide one type of claim for users/clients of one type and another type of claim for users/clients of another type. For Keycloak, this should be:

cid

The cid (client ID) user claim type is also commonly used by other OAuth providers.

This parameter is required.

JSONWebKeySetUri

1 - String

https:// keyidp-server .keyexample.com /realms /Keyfactor /protocol /openid-connect /certs

The JWKS (JSON Web Key Set) URL for the identity provider.

This parameter is required.

NameClaimType

1 - String

preferred_ username

A type of user claim for the identity provider containing a friendly name for the user. Although the value for this field may not necessarily be unique within your identity provider (so might resolve to John Smith and the organization might have two users called John Smith), this can be confusing in Keyfactor Command, since the value is used as the user’s display name in areas such as the requester of a certificate, actors in audit logs, and users referenced in workflow instances. It is best to avoid duplicates.

For Keycloak, this should be:

preferred_ username

For Okta, this might be preferred_names (for example, john.smith@keyexample.com) or just name (for example, John Smith). For Auth0 this might be name (for example, johnsmith@keyexample.com).

This parameter is required.

Tip: The value in this field is used as the first choice to populate the username in the Keyfactor Command Management Portal header, if available. This is not the value to use when logging into Keyfactor Command. For that, see Unique Claim Type.

RequestHeaders

1 - String

groups

Custom OIDC request headers for the identity provider provided as name/value pairs.

Parameters configured in this value are added to the headers when Keyfactor Command sends an OIDC request to the OAuth server for the following request types:

Discovery Document
JSON Web Key Set
Token

If this parameter is added, the Name is required.

RequestURLParameters

1 - String

groups

Custom OIDC request URL parameters for the identity provider provided as name/value pairs.

Parameters configured in this value are added to the URL queryString parameter when Keyfactor Command sends an OIDC request to the OAuth server for the following request types:

SignIn
SignOut

If this parameter is added, the Name is required.

RoleClaimType

1 - String

groups

The value used to reference the type of group claim for the identity provider.

For Keycloak, this should be:

groups

This parameter is required.

OIDCScope

1 - String

One or more scopes that are requested during the OIDC protocol when Keyfactor Command is the relying party. Multiple scopes should be separated by spaces.

This value is not typically used for Keycloak.

SignOutURL

1 -String

https:// auth0-instance .us.auth0.com /oidc/logout

The signout URL for the identity provider.

This parameter only appears if Auth0 is selected as the type and is required in that case.

Timeout

1 - String

The number of seconds a request to the identity provider is allowed to process before timing out with an error. The default is 60.

TokenEndpoint

1 - String

https:// keyidp-server .keyexample.com /realms /Keyfactor /protocol /openid-connect /token

The token endpoint URL for the identity provider.

This parameter is required.

UniqueClaimType

1 - String

sub

A type of user claim for the identity provider containing a unique name for the user. For Keycloak, this should be:

sub

In Keycloak, this is a GUID uniquely identifying the user.

The sub (subject) user claim type is also commonly used by other OAuth providers.

See also FallbackUniqueClaimType.

This parameter is required.

Tip: The value in this field is used as the second choice to populate the username in the Keyfactor Command Management Portal header if the Name Claim Type does not contain a value in the token.

The value in this field is the one to use when logging into Keyfactor Command.

UserInfoEndpoint

1 - String

https:// keyidp-server .keyexample.com /realms /Keyfactor /protocol /openid-connect /certs

The user info endpoint URL for the identity provider.

Name	Description
Id	An integer indicating the Keyfactor Command reference ID for the parameter.
Name	A string indicating the short reference name for the parameter (for example, NameClaimType).
Display Name	A string indicating the display name for the parameter (for example, Name Claim Type).
Required	A Boolean indicating whether the parameter is required (True or False).
Data Type	An integer indicating the data type for the parameter. Possible values are: 1 - String 2 - Secret 3 - Boolean 4 - List
Value	A string indicating the value set for the parameter. This will contain values only for parameters of type 1 or 3.
Request Headers	An array of objects containing Name/Value pairs defining values for the parameter. This will contain values only for parameters of type 4 where the parameter name is RequestHeaders. For example: Copy `[ { "Name": "name_one", "Value": "value_one" }, { "Name": "name_one", "Value": "value_two" } ]`
Request URL Parameters	An array of objects containing Name/Value pairs defining values for the parameter. This will contain values only for parameters of type 4 where the parameter name is RequestURLParameters. For example: Copy `[ { "Name": "name_one", "Value": "value_one" }, { "Name": "name_one", "Value": "value_two" } ]`
Secret Value	A string indicating the value set for the parameter. This will contain values only for parameters of type 2. Due to its sensitive nature, this value is not returned in responses.

PermissionSetId

A string indicating the Keyfactor Command reference ID of the permission set applied to the identity provider.

Note: In order to view or edit an identity provider in the Keyfactor Command Management Portal or with the Keyfactor API, a user must be assigned a security role that has been granted the /identity_providers/read/ and /identity_providers/modify/ (for edits) permissions and that has the same permission set applied to it as has been applied to the identity provider.

TypeId

A string indicating the Keyfactor Command reference GUID for the type of identity provider. Possible values include:

DFB94650-E4EB-402A- B807-4F3CC91F712D (Active Directory)
F96B6464-11B7-4499- BEA7-B5AA6BA1571D (Generic—select this for Keycloak)
5AA04122-CD7C-48BA- AC11-F39E30AE8720 (Auth0)

Tip: See the Keyfactor API

An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. Reference and Utility, which allows you to call API operations and view results. It is primarily intended for validation, testing, and workflow

A workflow is a series of steps necessary to complete a process. In Keyfactor Command, it refers to the workflow builder, which allows you to automate event-driven tasks such as when a certificate is requested, revoked or found in a certificate store. development, and also serves as an interactive supplement to this API documentation. You can access it from the help menu (

) in the Management Portal.

Was this page helpful? Provide Feedback

Version v26.2.1

On This Page