OIDC/OAuth Flows with Identity Orchestration

Pass a workflow parameter in the OIDC authorize URL to route every login or registration request through a configured IO workflow before LoginRadius issues an authorization code. Lets you layer MFA, custom claims, risk checks, and progressive profiling on top of any OIDC/OAuth app without changing application code.

Integration

When to Use

USE IO + OIDC WHEN

→You need MFA or step-up authentication inside an OIDC flow

→You want custom claims injected into the ID token or access token

→You need conditional logic (consent prompts, account checks, profile enrichment) before token issuance

→You are building brand-specific authentication journeys for different OIDC apps or segments

USE STANDARD OIDC WHEN

→Your use case is straightforward authentication with no additional steps

→You have no need to inject custom claims or run conditional logic pre-token

→You do not need MFA or progressive profiling in the auth flow

Refer to the Authorization Code Flow documentation.

---

Prerequisites

Before configuring an OIDC/OAuth flow with IO, you need:

Requirement	Details
OIDC or OAuth application	Configured in Admin Console → Applications. Note the Client ID.
IO workflow	Built and published in Admin Console → Platform Config → Authentication → Workflows. Note the Workflow Name.
Script node (optional)	Required only if you need to inject custom claims into tokens.
Auth Studio style (optional)	Required only if you want branded workflow pages. Note the style name.

---

Configuration

Step 1: Create or Select an OIDC/OAuth Application

1. In the Admin Console, go to Applications (or the OAuth apps section).
2. Create a new application or select an existing one.
3. Note the Client ID: you will pass it as client_id in the authorize URL.

For full OIDC app configuration, see the Authorization Code Flow documentation.

Step 2: Build and Deploy the IO Workflow

1. In the Admin Console, go to Platform Config → Authentication → Workflows.
2. Create a new workflow from a template or from scratch.
3. Add an Auth node, any additional verification or profiling nodes, and a Success Final node.
4. Note the Workflow Name: this becomes the workflow query parameter value.
5. Click Update to publish the workflow.

For a full walkthrough of the Workflow Builder, see Building Flows from Scratch and the Node Reference.

Step 3 (Optional): Attach a Script Node for Custom Claims

If you need custom claims in the ID token or access token:

1. In the Workflow Builder, drag a Script node from the Helper Nodes section and connect it after the Auth node.
2. Use hook.accessToken.setCustomClaim() and/or hook.idToken.setCustomClaim() to inject the desired claims.
3. Save and redeploy the workflow.

For script examples and the full API reference, see the Scripts documentation.

---

How It Works

1. Authorize request: Your application redirects the user to the LoginRadius OIDC authorize endpoint with workflow=<workflowName>.
2. IO workflow executes: LoginRadius routes the request through the specified workflow. All nodes (Auth, MFA, Script, etc.) run in sequence.
3. Authorization code issued: Once the workflow completes successfully, LoginRadius issues an authorization code and redirects to your redirect_uri.
4. Token exchange: Your application exchanges the code at the token endpoint for an access token, ID token, and refresh token.
5. Custom claims included: If a Script node was used in the workflow, custom claims are present in the returned tokens.

---

Authorize URL Format

https://<siteurl>/service/oidc/{oidcAppName}/authorize
  ?client_id=<OIDC Client ID>
  &redirect_uri=<Callback URL>
  &scope=openid
  &response_type=code
  &state=<random string>
  &nonce=<unique nonce>
  &workflow=<workflowName>
  &s=<styleName>
  &debugMode=<true|false>

Parameter	Required	Description
client_id	Yes	The Client ID of the OIDC/OAuth application.
redirect_uri	Yes	The URL LoginRadius redirects to after authentication. Must be whitelisted in the app config.
scope	Yes	Must include openid. Add email, profile, or custom scopes as needed.
response_type	Yes	Set to code for Authorization Code Flow.
state	Yes	A random, unguessable string for CSRF protection.
nonce	Yes	A unique value to prevent token replay attacks.
workflow	Yes (for IO)	The name of the IO workflow to execute. Found in Admin Console → Platform Config → Authentication → Workflows.
s	No	The Auth Studio style name. Controls the branding/theme of the workflow pages.
debugMode	No	Set to true to enable debug logging during workflow execution.

---

Use Cases

STANDARD LOGIN OR REGISTRATION VIA IO + OIDC

Build a Login or Registration workflow in the IO Workflow Builder and pass its name as workflow=<workflowName>. The workflow handles the complete authentication journey: the OIDC layer issues tokens only after the workflow succeeds. Ideal when you need control over the login screen UI via Auth Studio, want to add intermediate steps like consent prompts, or need to support multiple login methods (password, social, passwordless) under a single OIDC app.

CUSTOM CLAIMS INJECTION

Use a Script node in your IO workflow to inject business-specific data into the ID token or access token: for example, a user's role, subscription tier, or tenant ID. These claims are available to your application immediately after token exchange without a separate profile API call.

MULTI-FACTOR AUTHENTICATION WITHIN AN OIDC FLOW

Add MFA to any OIDC app by building an MFA workflow in IO. The workflow enforces step-up authentication (Email OTP, Authenticator app, Push Notification) before the authorization code is issued: no changes required in the application. For a reference MFA workflow, see the MFA OTP Login template.

PROGRESSIVE PROFILING

Collect additional profile information at login time by adding a Form or Web Page node in the IO workflow. The user is shown a profile enrichment screen before authentication completes. Collected data can be stored via a Store Custom Objects node or processed in a Script node before token issuance.