Configure 3rd parties to work with Frontegg as IDP

This guide will walk you through how to configure your Frontegg workspace as an IDP for a 3rd party service.

Some of the use cases for this scenario can be:

  • Allow your users to login with the same identity on their docs
  • To have several applications sharing the same identity
  • To add additional internal applications sharing the same identity for internal use cases

Tools used for this tutorial
For the sake of this tutorial, we will be using OIDC playgroup as the 3rd party service.

OIDC playground is a great tool to test and debug OIDC flows.
Frontegg implements OIDC (OpenID Connect) by default as part of its hosted login offering.

Getting started
Under your hosted login configuration (Environment --> Authentication --> Login Method), make sure that the following are configured:

  • Hosted login is enabled
  • The redirectUrl of the service provider (in this https://openidconnect.net/callback) is configured under the allowed redirect URLs
17201720

On your service provider configure the authorization URL and the clientId of your Frontegg workspace.

📘

How to find my workspace urls

Frontegg implements the OIDC discovery protocol and returns all the relevant endpoints for the OIDC protocol to work.
The discovery URL will reside on https://[your-workspace-url]/.well-known/openid-configuration

📘

Finding my client ID

Each environment in Frontegg has its own client ID. To get your environment client ID to navigate to the environment settings and

30703070

On the 3rd party client side, set the authorize endpoint and the token endpoint as well as the clientId and secret respectively (in case PKCE is supported by your 3rd party service, you can omit the secret)

10341034

The OpenID connect endpoint will match the following:

After running the flow on your 3rd party client and getting the Frontegg id_token the JWT should be validated with the jwks and result in a valid user

813813

Did this page help you?