FAQ

Answers to frequent questions about access and integration.

Can I register automatically?

No. OIDC self-registration is disabled: each RP is reviewed by A3BC. Submit an access request.

Do I need an account per identity provider?

Yes. The OIDC interface is single, but segregation is per tenant: one client_id/client_secret per IdP.

Why don’t we receive a requested claim?

The user may not have provided it, or its credential is not yet validated. The operation still succeeds. Use mandatory claims or delayed sharing.

What is the difference between random and anonymized sub?

Random: no correlation possible between interactions. Anonymized: same sub for a given user and RP, but different across RPs (except RPs of the same group).

How long does the information stay available?

30 minutes after consent. With delayed sharing, according to the configured TTL.

Can we use several acr_values?

No, a single value, and it is enforced.

Where should the code exchange run?

Always server-side: the client_secret must never go into the browser or a mobile app.

How do I test a webhook locally?

Expose your server through a public tunnel (ngrok, for example) and give the URL to A3BC, which configures the consumer.