OIDC callback handler..

GET

/v1/iam/oidc/{providerName}/callback

Shell / cURL

curl --request GET \
  --url 'https://stratum.example.com/v1/iam/oidc/example/callback?state=example'

The provider redirects here. The URL state must equal the browser’s stratum_oidc_login cookie and match a login started on this control plane that has not been used yet (a replayed or forged callback answers 400). The code is exchanged with the PKCE verifier, the id_token is verified (signature, audience, expiry, nonce), and the Stratum user is matched by link, then by verified email, or created when the provider allows JIT. An inactive user is refused.

With a post_login the answer is a 302 that carries a one-time code, never a session token: <path>#code=<code> for a console path (the fragment never reaches a server or a Referer), <url>?code=<code> for a loopback URL. Trade the code at POST /v1/iam/oidc/exchange. Without a post_login the answer is 200 with the session in the body.

Parameters

Path Parameters

providerName

required

string

/^[a-z0-9-]{1,64}$/

Query Parameters

state

required

string

code

string

error

string

error_description

string

Responses

200

application/json

object

token

required

string

user

required

object

required

string

/^u-[a-z0-9-]+$/

email

required

string format: email

displayName

required

string

state

required

string

Allowed values: pending active suspended deleted

lastLoginAt

string format: date-time

nullable

createdAt

required

string format: date-time

updatedAt

required

string format: date-time

createdBy

required

string

mfaEnabled

Whether the user has an active TOTP MFA enrollment..

boolean

passwordChangeRequired

. Present (true) on the login response and GET /v1/iam/me while the user still has the install-time password.

boolean

mfaEnrollmentRequired

. Present (true) on the login response and GET /v1/iam/me while a TOTP enrollment is owed after a node MFA recovery.

boolean

passwordChangeRequired

. The user still has the install-time password (a one-time credential). Until POST /v1/iam/users/{userId}/password sets a new one, this session may only call GET /v1/iam/me, POST /v1/iam/logout and that endpoint; everything else answers 403 PASSWORD_CHANGE_REQUIRED.

boolean

mfaEnrollmentRequired

. A node recovery (stratum-bootstrap recover admin-mfa) removed the user’s TOTP. Until a new one is enrolled and verified (POST /v1/iam/users/{userId}/mfa/totp/enroll, then .../verify), this session may only call those two, GET /v1/iam/me and POST /v1/iam/logout; everything else answers 403 MFA_ENROLLMENT_REQUIRED. When a password change is owed too, it comes first.

boolean

Example

{
  "user": {
    "state": "pending"
  }
}

302

Redirect to the post-login URL with a one-time code.

400

Bad request.

application/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

401

Missing or invalid token.

application/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

Headers

WWW-Authenticate

string