Glossary
Most of the English in these docs is literal identifiers / messages / UI strings that can't be translated.
This page gives a quick reference for readers unfamiliar with the terms.
OIDC / login
| Term |
Meaning |
| OIDC (OpenID Connect) |
An identity/login standard built on top of OAuth2 |
| IdP (Identity Provider) |
The identity provider (Keycloak here; often ADFS in production) |
providerUrl |
The IdP address DRAPI connects to (to fetch config / exchange tokens) |
clientId / clientSecret |
The id/secret you get when registering an app at the IdP |
| Client Scope / scope |
Permission scope; which scopes a token carries decides what it can do |
| token |
The "pass" the IdP issues after login |
metadata / .well-known |
The IdP's published config (endpoints, key locations…) |
| PKCE |
Authorization-code protection for public clients |
Audience (aud) |
The token's intended audience; DRAPI checks it matches |
adminui block |
The keepconfig setting that makes a provider appear in the Admin UI login dropdown |
Certificates / trust
| Term |
Meaning |
| inbound |
"Others connecting in": the cert DRAPI uses to serve HTTPS |
| outbound |
"Connecting out yourself": the cert DRAPI must trust when it connects to an IdP |
| truststore / JVM cacerts |
Java's "trust list"; this is what DRAPI checks to trust an external IdP |
certstore.nsf |
Domino 12's certificate store (Certificate Manager) |
| Trusted Root |
A trusted root certificate (used to trust "the other party") |
| TLS Credential |
Certificate + private key (used to serve HTTPS yourself) |
| CA (root / intermediate) |
Certificate authority; the trust anchor is the "root" CA |
| FQDN |
Fully qualified domain name, e.g. ldat05.domino.com.tw |
| PEM / PKCS12 / KYR |
Three cert file formats (DRAPI takes PEM/PKCS12, not KYR) |
| PKIX / certification path |
Java's mechanism for validating a cert chain; errors usually mean a trust problem |
Common error messages
| Message |
What it means |
Error fetching token |
Backend token exchange failed — usually the IdP cert isn't trusted |
Error initiating authorization request |
Front-end failed to start login — often stale bad config in localStorage |
/admin/undefined |
Provider didn't load / no adminui, so the redirect URL becomes undefined |
403 Insufficient access |
Login succeeded but scopes are insufficient (authorization layer) |
unable to find valid certification path |
The cert chain isn't trusted (PKIX) |