# OpenAM Administration Guide
Chapter 6. Configuring Policy Agent Profiles

Sidebar | Prev | Up | Next

## 6.11. Configuring OAuth 2.0 & OpenID Connect 1.0 Clients

When you want to register an OAuth 2.0 client with OpenAM as the OAuth 2.0 authorization server, or register an OpenID Connect 1.0 client through OpenAM console, then create an OAuth 2.0 Client agent profile. After creating the agent profile, you can further configure the properties in the OpenAM console under Access Control > `Realm Name` > Agents > OAuth 2.0 Client > `Client Name`.

The topmost configuration fields are for both OAuth 2.0 and OpenID Connect 1.0, whereas others are specifically for OpenID Connect 1.0.

- Common Client Configuration

- OpenID Connect 1.0 Client Configuration

Common Client Configuration

The following configuration fields are common to OAuth 2.0 and OpenID Connect 1.0 clients.

Group

  Set this if you have configured an OAuth 2.0 Client agent group.

Status

  Whether the client profile is active for use.

Client password

  The client password as described by RFC 6749 in the section, Client Password.

Client type

  Confidential clients can maintain confidentiality of their credentials. Public clients cannot.

  A web application running on a server where its credentials are protected is an example of a confidential client.

  A JavaScript client running in a browser is an example of a public client.

Redirection URIs

  Specify client redirection endpoint URIs as described by RFC 6749 in the section, Redirection Endpoint. OpenAM's OAuth 2.0 authorization service redirects the the resource owner's user-agent back to this endpoint during the authorization code grant process. If your client has more than one redirection URI, then it must specify the redirection URI to use in the authorization request.

  Redirection URIs are required for OpenID Connect 1.0 clients.

Scopes

  Specify scopes in ``scope`` or ``scope`|`locale`|`localized description`` format. These scopes are to be presented to the resource owner when the resource owner is asked to authorize client access to protected resources.

Display name

  Specify a client name to display to the resource owner when the resource owner is asked to authorize client access to protected resources. Valid formats include ``name`` or ``locale`|`localized name``.

Display description

  Specify a client description to display to the resource owner when the resource owner is asked to authorize client access to protected resources. Valid formats include ``description`` or ``locale`|`localized description``.

Default Scope(s)

  Specify scopes in ``scope`` or ``scope`|`locale`|`localized description`` format. These scopes are set automatically when tokens are issued.

OpenID Connect 1.0 Client Configuration

The following optional configuration fields are for OpenID Connect 1.0 clients.

ID Token Signed Response Algorithm

  Algorithm that the ID Token for this client must be signed with

  Default: `HmacSHA256`

  Valid values are listed in JSON Web Algorithms (JWA): "alg" (Algorithm) Header Parameter Values for JWS. OpenAM supports `HmacSHA256`, `HmacSHA384`, and `HmacSHA512`.

Post Logout Redirect URI

  URI to which to redirect the user-agent after the client logout process

The access token used to update the client

  The `registration_access_token` value that you provide when registering the client, and then subsequently when reading or updating the client profile.

URI of the Client Application

  The relying party (client) URI to which the OpenID Connect Provider sends session changed notification messages using the HTML 5 postMessage API.