> For the complete documentation index, see [llms.txt](https://ztrust.gitbook.io/ztrust-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ztrust.gitbook.io/ztrust-documentation/user-manual-ztrust-v2.0/guide-to-navigation/clients/clients-list.md). # Clients List

You can search for any specific client by using the search box. #### **Client ID** It pertains to the ID referenced in URIs and tokens. #### **Name** This refers to the display name of the client. It can be customized, allowing you to set any name according to your needs. #### **Type** This indicates the protocol utilized for authentication or authorization for this specific client. You can adjust this setting and choose between two options - * **OpenID Connect:** This enables clients to verify the identity of the End-User based on authentication conducted by an Authorization Server. * **SAML (Security Assertion Markup Language):** This facilitates web-based authentication and authorization scenarios, including cross-domain single sign-on (SSO), and utilizes security tokens containing assertions to transmit information. #### **Description** This pertains to the description for the Client. You can establish any description that helps you identify the client effectively. #### **Home URL** This denotes the default URL that the authentication server has to use when redirecting or linking back to the client. #### **Import Client** Once you click Import Client, you will be directed to the screen below.

#### **Resource file** To upload a file from your local machine or any path, click on Browse to select the file. You can upload either a JSON or XML file. #### **Clear**

If you've selected a file but decide not to upload it, click on Clear. clicking on Clear will prompt a confirmation message. Choose Clear to remove the file or Cancel to retain it.

#### **Client ID** This refers to the client identifier registered with the Identity Provider. This field is essential because it is used in URIs and tokens. It's mandatory when configuring a client. In the case of SAML, it represents the expected issuer value from authentication requests. #### **Name** This refers to the display name of the client. It can be customized, allowing you to set any name according to your needs. #### **Description** This pertains to the description for the Client. You can establish any description that helps you identify the client effectively. #### **Always display in UI** This is a toggle button, when enabled (toggled ON), ensures the client is always listed in the Account UI, even if the user has no active session. If turned OFF, the client will not appear in the Account UI if there is no active session. You can switch this ON or OFF based on your needs. #### **Type** This indicates the protocol utilized for authentication or authorization for this specific client. There are two options - * **OpenID Connect:** This enables clients to verify the identity of the End-User based on authentication conducted by an Authorization Server. * **SAML (Security Assertion Markup Language):** This facilitates web-based authentication and authorization scenarios, including cross-domain single sign-on (SSO), and utilizes security tokens containing assertions to transmit information. #### **Save** If you're satisfied with the changes and want to implement them, click on Save. #### **Cancel** If you've made changes that you don't wish to apply, click on Cancel. Click the Refresh button to see the latest settings.

You can also modify the number of clients displayed per screen by choosing your preferred option from the dropdown menu. #### **Create Client** If you want to create a new client, simply click on Create Client. Upon doing so, you will be directed to the following screen.

#### **Client type**

This indicates the protocol utilized for authentication or authorization for this specific client. You can adjust this setting and choose between two options - * **OpenID Connect:** This enables clients to verify the identity of the End-User based on authentication conducted by an Authorization Server. * **SAML (Security Assertion Markup Language):** This facilitates web-based authentication and authorization scenarios, including cross-domain single sign-on (SSO), and utilizes security tokens containing assertions to transmit information. You can choose the most suitable option from the dropdown menu based on your requirements. #### **Client ID** This refers to the client identifier registered with the Identity Provider. This field is essential because it is used in URIs and tokens. It's mandatory when configuring a client. In the case of SAML, it represents the expected issuer value from authentication requests. #### **Name** This refers to the display name of the client. It can be customized, allowing you to set any name according to your needs. #### **Description** This pertains to the description for the Client. You can establish any description that helps you identify the client effectively. #### **Always display in UI** This is a toggle button, when enabled (toggled ON), ensures the client is always listed in the Account UI, even if the user has no active session. If turned OFF, the client will not appear in the Account UI if there is no active session. You can switch this ON or OFF based on your needs. #### **Next** Once you've entered the above details, click Next to proceed with creating the Client. #### **Back** This option is disabled on this screen as it is the initial configuration step for creating a client, and you cannot return to any previous settings. #### **Cancel** If you wish to cancel the client creation and discard the changes, click on Cancel. Clicking Next will redirect you to the following screen.

#### **Client Authentication** This is a toggle button. When enabled (toggled ON), the OIDC type is set to confidential access. When turned OFF, it is set to public access. You can switch this ON or OFF based on your requirements. #### **Authorization** This toggle button, when enabled (toggled ON), activates fine-grained authorization support for a client. When turned OFF, this feature is disabled. You can adjust this setting based on your specific requirements. #### Authentication Flow

You can choose the authentication flow by ticking the checkbox beside each of these options. The table below displays the various types of flows along with a brief description for each.

Type of Flow	Description
Standard flow	This option activates standard OpenID Connect redirect-based authentication using an authorization code. Enabling this checkbox adds support for 'Authorization Code Flow' to this client.
Direct access grants	By selecting this checkbox, support for Direct Access Grants is enabled. This allows the client to access the user's username/password directly and exchange it with the ZTrust server for an access token.
Implicit flow	Selecting this checkbox enables support for OpenID Connect redirect-based authentication without requiring an authorization code.
Service accounts roles	Selecting this checkbox enables authentication for this client to ZTrust and retrieves an access token specifically dedicated to this client.
OAuth 2.0 Device Authorization Grant	Selecting this checkbox activates support for the OAuth 2.0 Device Authorization Grant. This indicates that the client is an application installed on a device with limited input capabilities or lacking a suitable browser.
OIDC CIBA Grant	Selecting this checkbox activates support for OIDC CIBA Grant, indicating that the user is authenticated through an external authentication device rather than the user's browser.

#### **Next** Once you've entered the above details, click Next to proceed with creating the Client. #### **Back** To return to the previous settings screen, click Back. Upon clicking Back, you will be redirected to the previous screen, which is the General Settings page.

#### **Cancel** If you wish to cancel the client creation and discard the changes, click on Cancel. Clicking Next will redirect you to the following screen.

#### **Root URL** This value is added to the beginning of the URL when ZTrust uses a configured relative URL. #### **Home URL** This denotes the default URL that the authentication server has to use when redirecting or linking back to the client. #### **Valid redirect URIs**

This refers to the valid URI pattern to which a browser can redirect after a successful login or logout. Enter the desired URI Pattern and click on the '+ Add valid redirect URIs' to add it. You can select the '-' symbol if you wish to remove a particular URI pattern. #### **Valid Post redirect URIs**

This pertains to the valid URI pattern to which a browser can redirect after a successful logout. Enter the desired URI pattern and click on the '+ Add valid post logout redirect URIs' to add it. You can select the '-' symbol if you wish to remove a particular URI pattern. #### **Web Origins**

This setting manages [Cross-Origin Resource Sharing (CORS)](/ztrust-documentation/user-manual-ztrust-v2.0/key-terminologies.md#cross-origin-resource-sharing-cors). The domain URLs listed here are included in the access token sent to the client application. The client application utilizes this data to determine whether to permit a CORS request to be initiated. You can input any domain URL and click on the '+ Add web origins' symbol to add it. If you wish to remove a specific URL, you can select the '-' symbol. #### **Save** If you're satisfied with the changes and want to implement them, click on Save. #### **Back** To return to the previous settings screen, click Back. Upon clicking Back, you will be redirected to the previous screen, which is the Capability Config page.

#### **Cancel** If you've made changes that you don't wish to apply, click on Cancel. After selecting Save, you will be directed to the following screen.

### **General Settings** #### **Client ID** This refers to the client identifier registered with the Identity Provider. This field is essential because it is used in URIs and tokens. It's mandatory when configuring a client. In the case of SAML, it represents the expected issuer value from authentication requests. #### **Name** This refers to the display name of the client. It can be customized, allowing you to set any name according to your needs. #### **Description** This pertains to the description for the Client. You can establish any description that helps you identify the client effectively. #### **Always display in UI** This is a toggle button, when enabled (toggled ON), ensures the client is always listed in the Account UI, even if the user has no active session. If turned OFF, the client will not appear in the Account UI if there is no active session. You can switch this ON or OFF based on your needs.

### **Access settings** #### **Root URL** This value is added to the beginning of the URL when ZTrust uses a configured relative URL. #### **Home URL** This denotes the default URL that the authentication server has to use when redirecting or linking back to the client. #### **Valid redirect URIs**

This setting manages [Cross-Origin Resource Sharing (CORS)](/ztrust-documentation/user-manual-ztrust-v2.0/key-terminologies.md#cross-origin-resource-sharing-cors). The domain URLs listed here are included in the access token sent to the client application. The client application utilizes this data to determine whether to permit a CORS request to be initiated. You can input any domain URL and click on the '+ Add web origins' symbol to add it. If you wish to remove a specific URL, you can select the '-' symbol. #### **Admin URL** This is the URL to the Admin interface of the client.

### **Capability Config** #### **Client Authentication** This is a toggle button. When enabled (toggled ON), the OIDC type is set to confidential access. When turned OFF, it is set to public access. You can switch this ON or OFF based on your requirements. #### **Authorization** This toggle button, when enabled (toggled ON), activates fine-grained authorization support for a client. When turned OFF, this feature is disabled. You can adjust this setting based on your specific requirements. #### **Authentication Flow**

You can select the authentication flow by ticking the checkbox beside each of these options. The table below displays the various types of flows along with a brief description for each.

Type of Flow	Description
Standard flow	This option activates standard OpenID Connect redirect-based authentication using an authorization code. Enabling this checkbox adds support for 'Authorization Code Flow' to this client.
Direct access grants	By selecting this checkbox, support for Direct Access Grants is enabled. This allows the client to access the user's username/password directly and exchange it with the ZTrust server for an access token.
Implicit flow	Selecting this checkbox enables support for OpenID Connect redirect-based authentication without requiring an authorization code.
Service accounts roles	Selecting this checkbox enables authentication for this client to ZTrust and retrieves an access token specifically dedicated to this client.
OAuth 2.0 Device Authorization Grant	Selecting this checkbox activates support for the OAuth 2.0 Device Authorization Grant. This indicates that the client is an application installed on a device with limited input capabilities or lacking a suitable browser.
OIDC CIBA Grant	Selecting this checkbox activates support for OIDC CIBA Grant, indicating that the user is authenticated through an external authentication device rather than the user's browser.

### **Login settings**

#### **Login Theme**

The dropdown provides different theme options for the login page, including OTP Entry, New User Registration, and the Login screen for the specific client. #### **Consent required** This toggle button determines whether users are required to consent to client access. When enabled (turned ON), users must provide consent. Conversely, when disabled (turned OFF), users are not required to give consent. You can adjust this setting according to your preferences. #### **Display client on screen** This setting applies only if Consent required is enabled for this client. When deactivated (toggled OFF), the consent screen will only display consents corresponding to configured client scopes. However, when activated (toggled ON), there will also be an additional item on the consent screen related to the client itself. You can toggle this setting ON or OFF as per your requirements. #### **Consent screen text** This pertains to the text that will be shown when this client scope is added to a client with consent required. By default, it displays the name of the client scope if left empty.

### **Logout Settings** #### **Front channel logout** This toggle button, when activated (turned ON), mandates a browser redirect to the client for logout. When deactivated (turned OFF), the server executes a background invocation for logout. You can adjust these settings based on your needs. Once enabled, two additional fields are also activated: Front-Channel Logout URL. #### **Front-channel logout URL** This field specifies the URL that prompts the client to log itself out when a logout request is sent to this realm via the end\_session\_endpoint. If not provided, it defaults to the base URL. This field is customizable, allowing you to modify it as needed. #### **Backchannel logout URL** This field specifies the URL that triggers the client to log out when a logout request is sent to the realm via the end\_session\_endpoint. If omitted, no logout requests will be sent to the client in this scenario. You can modify it according to your requirements. #### **Backchannel logout session required** It is a toggle button, when activated (turned ON), adds the Session ID claim to the Logout Token sent via the Backchannel Logout URL. When deactivated (turned OFF), the SID isn't included. You're free to customize this according to your needs. #### **Backchannel logout revoke offline sessions** This toggle button, when activated (turned ON), adds the revoke\_offline\_acccess event to the Logout Token sent via the Backchannel Logout URL. ZTrust will then revoke offline sessions upon receiving a Logout Token with this event. When deactivated (turned OFF), this specific event isn't included in the Logout Token. You can customize this setting according to your needs. #### **Save** If you're satisfied with the changes and want to implement them, click on Save. #### **Revert** If you've made changes that you don't wish to apply, click on Revert.

You can navigate between different setting screens using this section. Simply click on the settings type you wish to configure.

By clicking on the three dots next to a specific client, you will be presented with the following options: Export or Delete.

#### **Export** To download all settings and configurations related to a specific client, click on Export. This action will save all details and configurations in JSON format. #### **Delete** If you no longer need a specific client, click on Delete to remove it. Upon clicking Delete, a confirmation prompt will appear as shown below.

Click on Delete to remove it, or click on Cancel to keep it.