OpenID Connect

01 / Discovery

https://srs-conglomerate.com/sso/.well-known/openid-configuration/

Issuer

https://srs-conglomerate.com/sso

Authorize

https://srs-conglomerate.com/sso/authorize/

Token

https://srs-conglomerate.com/sso/token/

UserInfo

https://srs-conglomerate.com/sso/userinfo/

JWKS

https://srs-conglomerate.com/sso/jwks/

Revoke

https://srs-conglomerate.com/sso/revoke/

02 / Integration

1. Register a client and an exact HTTPS callback URL.
2. Send state, nonce and an S256 code_challenge.
3. Validate callback state and issuer. Exchange code and code_verifier for tokens.
4. Validate the ID token signature, iss, aud, exp and nonce.

Scopes: openid profile email offline_access

03 / Tokens and sessions

ES256 is the standard signature. The id_token_pq extension carries ML-DSA-65: verify both signatures and matching payloads when using this profile.

Revocation invalidates SRS ID tokens. Applications must terminate their local sessions; signing out of SRS ID does not confirm sign-out from every site.