> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Integrate a generic OIDC and OAuth Server application

You can configure access to custom OpenID Connect (OIDC) applications by integrating a generic OIDC Server application on IDaaS. A Server application is a client application that can communicate securely with IDaaS using a client secret in order to obtain access tokens. Tokens are requested directly from and returned to the client application.

Before you begin, complete the following:

- Identify the attributes that IDaaS must contain to establish a connection between IDaaS and the OIDC application.
- Configure the account settings of your application to accept authentication attempts from your IDaaS account.

## Add a generic OIDC and OAuth Server application

Complete the following steps:

- [Step 1: Configure the General settings](#step-1-configure-the-general-settings)
- [Step 2: Optionally, add a resource server](#step-2-optionally-add-a-resource-server)

### Step 1: Configure the General settings

1. Log in to an IDaaS account with a role assigned that allows you to configure applications on IDaaS.

2. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.

3. Click **Add**. The **Select an Application Template** page appears.

4. Do one of the following:

   - Select **OpenID Connect and OAuth Cloud Integrations** from the search drop-down list and scroll to find the application you want to add to IDaaS.
   - In the **Search bar**, enter a search option to filter for the application you want to add to IDaaS.

5. Click **Generic Server Application**. The **Add Generic Server Application** page appears.

6. Configure the following **App Settings**:

   1. Enter the **Application Name**.
   2. Enter the **Application** **Description.**

7. Configure the **OIDC Settings**.

   1. The **Client ID** is generated when you create the application on IDaaS. You cannot modify the Client ID.

   2. Select the **Client Authentication Method** from the drop-down list. When using the token, PAR, or revocation endpoints, clients use this authentication method to authenticate to the Authorization Server.

      1. If you select one of **Client Secret Basic**, **Client Secret Post**, or **Client Secret JWT**, complete the following:

         - Copy (or update and copy) the **Client Secret** value. You can then paste the **Client Secret** value into the required field of your client OIDC application account settings.
         - Optional. Set and copy the **Client Secret (Alternative)** value as an alternative option to support client secret rollover. You can then paste the **Client Secret (Alternative)** value into the required field of your client OIDC application account settings.

      note
      You can define your own Client Secret values. However, Entrust recommends that you use the strong secret value provided. You can also optionally view or regenerate a new client secret.

      2. If you select **Private Key JWT** as the **Client Authentication Method**, complete the following:

         - Select **JWKS URI** or **JWK/JWKS JSON** to provide the JSON Web Key Set (JWKS) information for the application.
           - If you select **JWKS URI**, enter the URI where IDaaS can retrieve the JWKS information.
           - If you select **JWK/JWKS JSON**, enter the JWK or JWKS JSON information directly into the text box and optionally click **Pretty Print** to tidy the formatting.
         - Select the **Supported Client Authentication Signing Algorithms** to specify the allowed signing algorithms.

      note
      When you select **Private Key JWT**, the client secret is not used for client authentication and is removed. Instead, the client uses a private key to sign a JWT assertion that is sent to the endpoints for authentication. IDaaS uses the JWKS information to retrieve the public key needed to verify the JWT assertion sent by the client.

      3. If you select **SPIFFE JWT-SVID** as the **Client Authentication Method**, complete the following:

         - In the **SPIFFE Trust Domain** field, enter the trust domain that issues the client's JWT-SVIDs, for example `trust.domain`. This field is required.
         - Provide the trust bundle that IDaaS uses to verify the JWT-SVID signature by selecting one of the following:
           - **SPIFFE Bundle JWKS URL.** Enter an HTTPS URL where IDaaS retrieves the JSON Web Key Set (JWKS) for the trust domain.
           - **SPIFFE Bundle JWKS JSON.** Paste the JWKS JSON directly. Click **Pretty Print** to format the JSON for readability.
         - In the **Allowed SPIFFE IDs** field, add the SPIFFE ID patterns that are allowed to authenticate as this application.
         - Select the **Supported Client Authentication Signing Algorithms** to specify the algorithms IDaaS accepts for the JWT-SVID signature.

      note
      When you select **SPIFFE JWT-SVID**, the client secret is not used for client authentication. Instead, the client presents a SPIFFE-issued JWT-SVID that IDaaS validates against the configured trust domain, trust bundle, and allowed SPIFFE ID patterns. For more information, see [Configure SPIFFE JWT-SVID authentication](/docs/authentication-and-security/workload-identities/configure-workload-identity-management.md#configure-spiffe-jwt-svid-authentication).

   3. Select the **OIDC Signing Certificate** used to connect to the Service Provider.

   4. From the **Access Token Signing Algorithm** drop-down list, select the signing algorithm that is used to sign the access tokens used with Resource Server APIs during authentication.

   5. The **Grant Types** are configured by default.

8. Click **Show Advanced Settings** to configure advanced settings.

   1. Enter the **Default Resource/Audience Request Value** to include this value as the resource or audience parameter for every authorization request.

9. Click **Save**.

   You should now see the **Resource Servers** tab.

note
After configuring the **General** settings, the **Resource Servers** tab appears. For Generic Server applications, **Claims**, **Customization**, and **Resource Rules** tabs are not available.

10. Proceed to _Step 2: Optionally, add a resource server_.

### Step 2: Optionally, add a resource server

1. Click the **Resource Servers** tab.
2. Click **Add Resource Server**.
3. Follow the instructions in [Add an API/URL resource server](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications/manage-resource-servers/add-an-api-url-resource-server.md).