Configure institutional sign-in with SURFconext — oauth_provider

Configure institutional OIDC login through SURFconext. Register your service with SURFconext before using its client credentials with oauth_client().

Usage

oauth_provider_surfconext(
  environment = c("production", "test"),
  name = "surfconext",
  token_auth_style = NULL
)

Arguments

environment: SURFconext environment: "production" (default) or "test".
name: Optional provider name (default "surfconext").
token_auth_style: Authentication style for token requests: "header" (client_secret_basic), "body" (client_secret_post), or "public" (public client; send client_id only). The alias "none" is also accepted for "public". If NULL (default), it is inferred conservatively from discovery: "header" (client_secret_basic) is preferred, followed by "body" (client_secret_post), then "public" if none is advertised and PKCE is enabled. Set token_auth_style = "public" explicitly for a public client registration. JWT methods ("client_secret_jwt", "private_key_jwt") and mTLS methods ("tls_client_auth", "self_signed_tls_client_auth") must be selected explicitly. See oauth_provider() for the supported methods and their credentials.

Value

OAuthProvider object configured for SURFconext.

Details

Login uses the "openid" scope. Additional claims depend on the service's agreed attribute release policy; requesting "email" or "profile" does not guarantee those attributes will be released. The validated issuer and sub establish the login identity. Test and production environments require their own service configuration. See the SURFconext overview.

Examples

if (FALSE) { # \dontrun{
oauth_provider_surfconext()
oauth_provider_surfconext(environment = "test")
} # }