Start/notes.ini Parameters/OIDC_LOGIN_ENABLE_ROEID_WORKAROUNDS

OIDC_LOGIN_ENABLE_ROEID_WORKAROUNDS

Profile

Parameter
OIDC_LOGIN_ENABLE_ROEID_WORKAROUNDS
Category
General / OIDC login (workaround)
Component
Domino server (HTTP task, OIDC login)
Value range
0 (default, workaround disabled) or 1 (workaround active)
Default
0 (no workaround — Domino sends the additional fields in the request body)
Available since
14.0 (with the introduction of Domino web OIDC login)
Effective
After tell http q and load http, or after a restart of the HTTP task
GUI equivalent
None — only via notes.ini or set config OIDC_LOGIN_ENABLE_ROEID_WORKAROUNDS=1

Description

Enables workarounds for OIDC providers that strictly reject extra fields in the request body when authenticating with client_secret_basic. With OIDC_LOGIN_ENABLE_ROEID_WORKAROUNDS=1, Domino refrains from sending those fields and thereby avoids HTTP 500 errors during OIDC login.
According to HCL KB0119112, the issue manifests as the error message „Error 500 You are not authorized to perform this operation“ after a successful login at the identity provider — typically when the OIDC document in idpcat.nsf is configured to Client Secret Basic mode.

Example

OIDC_LOGIN_ENABLE_ROEID_WORKAROUNDS=1
Runtime activation via the console:
set config OIDC_LOGIN_ENABLE_ROEID_WORKAROUNDS=1
tell http q
load http

Notes

  • The parameter is explicitly a workaround for providers that strictly enforce the client_secret_basic specification — not every OIDC provider needs it.
  • Symptom before enabling: after a successful login at the IdP, Domino returns Error 500 You are not authorized to perform this operation and the browser does not arrive at the requested page (see HCL KB0119112).
  • The workaround is only required for OIDC providers that reject additional fields in the body when client_secret_basic is used.
  • Domino web OIDC login is configured in the Identity Provider Catalog (idpcat.nsf) (HCL Domino 14.5 „Configuring Web login with OIDC for web users“).
  • For the Domino REST API, OIDC configuration is done via the separate Domino REST API documentation (authentication and token validation) — this setting primarily affects the Domino web OIDC login (HTTP task).

Sources (HCL Product Documentation)