#OIDC
Posts tagged #OIDC · 3 posts
- Getting 401s from the Domino REST API? Understand Its JWT Authentication and Scopes First
Almost every DRAPI call has to prove who you are. It doesn't use classic session/LTPA — it uses a JWT bearer token: POST to /api/v1/auth with Domino credentials for a token, then send it in the Authorization header on every request. This piece covers logging in for a token, what the scopes/aud claims control, where tokens come from (Domino-signed JWT, external OIDC, idpcat.nsf), and traps like the signing key changing on restart. Part two of the DRAPI series.
2026.08.20 - Implementation Notes: DRAPI Login via Keycloak OIDC — Works on Domino 12.0.2, No Need to Wait for 14
Wiring DRAPI (Domino REST API) up to a modern IdP like Keycloak, Azure AD, or Okta is widely assumed to require Domino 14, since most of the public documentation centres on the 14-era OIDC story. In practice, DRAPI's oidc mode works on Domino 12.0.2 — no server upgrade required. This article is the implementation notebook from reproducing the full setup locally: picking among DRAPI's three OIDC modes (jwt / oidc / oidc-idpcat), debugging the three-layer auth architecture (identity / mapping / authorization), and the four traps that ate the most time — the biggest of which is providerUrl using localhost failing across machines because Java resolves IPv4 by default. Full step-by-step lives in the companion GitHub repo and Pages site; this article doesn't repeat the setup, it focuses on decisions and pitfalls.
2026.06.01 - HCL Domino 2026 Release Highlights
HCL Domino 2026 (version 14.5.1) was officially released on March 19, 2026, introducing new features like Domino IQ, AutoUpdate, and OIDC support.
2026.04.27