OIDC Integration with CalNet
Use the resources below to get your application up and running with OpenID Connect (OIDC) authentication.
Step 1 - OIDC Implementation Guidelines
The following guidelines ensure your OIDC integration works with the CalNet Central Authentication Service.
Supported OIDC Flows
Authorization Code Flow with Proof Key for Code Exchange (PKCE) is the only supported OIDC flow. While mobile and native applications require PKCE for security, we also require it for single-page and web apps to mitigate security challenges. Implicit and hybrid flows are not supported.
Endpoints
OIDC Discovery
The discovery endpoint allows clients to dynamically discover information about the OpenID provider (metadata). Many client libraries use this URL to discover all other settings automatically.
- Test:
https://auth-test.berkeley.edu/cas/oidc/.well-known - Production:
https://auth.berkeley.edu/cas/oidc/.well-known
All Available Endpoints
| Endpoint | Description |
|---|---|
/cas/oidc |
Issuer |
/cas/oidc/oidcAuthorize |
Authorization. Used to obtain authorization from the end-user. |
/cas/oidc/oidcAccessToken |
Token. Used to exchange an authorization code for tokens. |
/cas/oidc/oidcProfile |
UserInfo. Provides profile information about the authenticated user. |
/cas/oidc/jwks |
JWKS. Provides public keys to verify ID token signatures. |
/cas/oidc/.well-known/openid-configuration |
Discovery metadata endpoint. |
/cas/oidc/oidcLogout |
End Session. Logs the user out from the OP. |
/cas/oidc/revoke |
Revocation. Informs the OP that a token is no longer needed. |
Client Identification
CalNet will supply these values after you submit an SSO Service Request (Step 3):
- client_id: Uniquely identifies your application to the OIDC provider.
- client_secret: Used to authenticate the application and prevent impersonation.
Important Security Requirement: Per the MSSND, secrets stored on servers must be resistant to offline attacks (NIST SP 800-63B). The UC Encryption Key and Certificate Management Standard applies to client_secret credentials.
Supported Scopes and Claims
Scopes authorize access to user details (claims). For a full listing, see OIDC Scopes and Claims (KB0015637).
Standard Claims
| Scope | Claims Provided |
|---|---|
openid |
Required. Returns sub (unique ID). Tokens include iss, aud, exp, iat, at_hash. |
profile |
Basic info: name, family_name, given_name, preferred_username. |
email |
Private. Returns the user's campus email address. |
Custom Berkeley Claims
| Scope | Claims Provided |
|---|---|
berkeley_edu_default |
Attributes for authorization: uid, groups, affiliations. |
berkeley_edu_dept_number |
department_number |
berkeley_edu_cs_id |
Campus Solutions (SIS) ID. |
Step 2 - SocReg Registration
- Ensure your host system is registered in Socreg. See the Departmental Security Contact Policy.
- If handling restricted data, participate in the Web Application Security Testing program.
Step 3 - SSO Service Request
- Review the CalNet Terms of Service (KB0011616).
- Understand SSO Authorization (KB0015303) requirements.
- Submit the SSO Registration Form in ServiceNow.