Protocol Configuration

Protocol configuration is used to manage core security policies such as the authentication protocols supported by the application, authorization grant types, and token expiration times. It ensures that the authentication process between your application and RootAuth meets your business requirements and security standards.

Path: Log in to the RootAuth console → Navigate to the target application → Click Configuration in the top navigation bar → Select Application – Application Management → Protocol Configuration

1. Default Protocol Type

The system currently supports the OIDC (OpenID Connect) protocol by default. Future versions will support additional protocol types such as SAML and OAuth 2.0.

2. Authorization Configuration

2.1 Grant Types (Multiple Selection)

You can select one or more authorization grant types based on your application scenario.

Grant Type	Description	Dependency
`authorization_code`	The authorization code grant type, suitable for web applications.	None
`refresh_token`	The refresh token grant type, used to obtain a new access token after the current one expires, maintaining the user's logged-in state.	Must be selected together with `authorization_code`
`client_credentials`	The client credentials grant type, suitable for server-to-server (backend service) authentication without user involvement.	None

Constraints:

At least one grant type must be selected; otherwise, the configuration cannot be saved.
If the client_credentials grant type is selected, you must fill in the Server IP Whitelist (server_ip_whitelist) to enhance security.

2.2 JWT Signature Algorithm

Used to sign ID Tokens and Access Tokens. The following algorithms are supported:

Algorithm	Type	Description
HS256	Symmetric Encryption	Uses the same secret key (App Secret) for signing and verification. Suitable for trusted environments.
RS256	Asymmetric Encryption	Uses a private key for signing and a public key for verification. Offers higher security and is recommended for open environments.

Note: When RS256 is selected, an RSA Public Key field will appear with a copy icon. You can provide this public key to your application for token verification.

2.3 Token Expiration Time

You can customize the expiration time for the following tokens to meet different security requirements:

Token Type	Default Value	Unit	Description
Authorization Code Expiration	600	second	The validity period of the authorization code, typically short.
JWT Expiration (ID Token)	7200	second	The validity period of the ID Token, representing the lifetime of the user's identity credential.
`access_token` Expiration	7200	second	The validity period of the access token, used to call resource APIs.
`refresh_token` Expiration	2592000	second	The validity period of the refresh token, used to obtain new access tokens.

Unit Switching:

A unit dropdown menu is provided to the right of each input field, supporting seconds, minutes, and hours.
You can enter a custom numerical value and select the appropriate unit. When saved, the system automatically converts the entered value to seconds for storage.
Example: Enter 10 and select minutes; the stored value will be 600 seconds.

3. OIDC Scope Configuration

Used to configure the permission scopes requested in the OIDC protocol. The system comes with pre-configured common scopes; custom scope mapping is not currently supported.

3.1 Claim Field Mapping

Maps user attributes from RootAuth to fields in the ID Token or UserInfo returned by the OIDC protocol. The default mapping is as follows:

User Attribute	Returned Field
User ID	`user_id`
Email	`email`

Support for more custom mappings will be available in future versions.

Application Configuration

Last modified: 2026-03-11Powered by

Outline