Glossary Open ID Connect

Page:

Relying Party —
Relying Party (short: RP) is an app that outsources the authentication of users, which is Picturepark itself. Picturepark does not handle authentication but outsources authentication to the Picturepark IDS or any trusted Identity Provider configured in the system.
Page:

Picturepark IDS —
Picturepark IDS (short: PIDS) is the Picturepark Identity Server, which serves as the default trusted Identity Provider of your Picturepark Content Platform. All identity information (e.g. user attributes) are saved in the Picturepark IDS. You can access multiple Pictureparks with the same identity.
Page:

Open ID Provider —
OpenID Providers are implementations based on Open ID Connect, like servers or services or libraries. Open ID Providers are listed on the official Open ID Connect page: https://openid.net/developers/certified. Popular services like Google, Microsoft, or Amazon support Open ID, but each Open ID Provider can define different metadata describing the Open ID Connect configuration. Therefore not all Open ID Providers are supported with Picturepark.
Page:

OIDC —
OpenID Connect is a leading standard for authentication, specifically identity provisioning and single sign-on. It uses JSON-based identity tokens (JWT), delivered via OAuth 2.0 flows designed for web, browser-based, and native/mobile applications. OpenID Connect allows clients of all types, including Web-based, mobile, and JavaScript clients, to request and receive information about authenticated sessions and end-users. The specification suite is extensible, allowing participants to use optional features such as encryption of identity data, the discovery of OpenID Providers, and session management, when it makes sense for them. See the Picturepark Open ID Configuration for the live environment, add .well-known/openid-configuration to the identity server URL to get the configuration for your platform.
Page:

Identity Provider —
Identity providers (short: IdP, IDP) are systems that manage and maintain identity information (e.g. user attributes). Identity providers offer user authentication as a service. Picturepark outsources the user authentication to the Picturepark Identity Server as the default trusted identity provider and is thus a relying party application to it. See Wikipedia Identity Provider.
Page:

Authorization —
Authorization is the process of verifying that "you are permitted to do what you are trying to do" by granting permissions. While authorization often happens immediately after authentication (e.g., when logging into a computer system), this does not mean authorization presupposes authentication: an anonymous agent could be authorized to a limited action set. Picturepark grants permissions via assignments to user roles. See Wikipedia Authorization.
Page:

Authentication Flow —
The authentication flow is the definition of how the tokens to identify users are exchanged. Picturepark external Identity Provider must support Authorization Code Flow with PKCE. PKCE, pronounced “pixy” is an acronym for Proof Key for Code Exchange, which does not require users to provide a client_secret. The standard Authorization Code flow would require this. The main benefit is the reduced risk for native apps, as there are no embedded secrets in the source code and this in return limits exposure to reverse engineering.
Page:

Authentication —
Authentication is the act of proving that "you are who you say you are" usually done via passwords. The act of verifying the identity of a computer system user. Identity providers offer user authentication as a service. See Wikipedia Authentication.
Page:

ACR Values —
ACR Values are optional parameters provided as a space-separated string. These values specify additional context values which the authorization server shall use to process the client request for authentication. If the client provides a value the IdP understands, it will be respected but if the IdP does not understand it, the authentication request is either denied or the acr_values are sent back to the client, which can then decide if the level of authentication is satisfying and carry on with the authentication or reject it. The values appear in order of preference. Possible values may be multi-factor or phishing-resistant. See here for more information: https://ldapwiki.com/wiki/Acr_values.

Browser not supported