3.1.1 Clients List

The Clients List section in ZTrust allows administrators to manage clients, configure their authentication and authorization settings, and control how they interact with the system. Clients represent applications or services that request authentication from ZTrust.

Searching for Clients:

You can quickly find a specific client using the search box at the top of the Clients List page. Simply enter the Client ID or Name, and the results will be filtered automatically.

Searching for Clients:

Each client in ZTrust includes the following details:

Client ID - A unique identifier used in URIs and tokens.

Name - A display name for the client, customizable based on your preference.

Type - The authentication protocol used by the client:

OpenID Connect (OIDC): Allows clients to verify the identity of end-users.
SAML: Facilitates cross-domain SSO using security assertions.

Description - A short explanation about the client to help identify its purpose.

Home URL - The default URL used by the authentication server when redirecting or linking back to the client.

Importing a Client:

To import a client:

Click Import Client.
Choose a resource file (JSON or XML) by clicking Browse.

{
"clientId": "account",
"name": "${client_account}",
"rootUrl": "${authBaseUrl}",
"baseUrl": "/realms/test/account/",
"surrogateAuthRequired": false,
"enabled": true,
"alwaysDisplayInConsole": false,
"clientAuthenticatorType": "client-secret",
"redirectUris": [
"/realms/test/account/*"
],
"webOrigins": [],
"notBefore": 0,
"bearerOnly": false,
"consentRequired": false,
"standardFlowEnabled": true,
"implicitFlowEnabled": false,
"directAccessGrantsEnabled": false,
"serviceAccountsEnabled": false,
"publicClient": true,
"frontchannelLogout": false,
"protocol": "openid-connect",
"attributes": {
"realm_client": "false",
"post.logout.redirect.uris": "+"
},
"authenticationFlowBindingOverrides": {},
"fullScopeAllowed": false,
"nodeReRegistrationTimeout": 0,
"defaultClientScopes": [
"web-origins",
"acr",
"roles",
"profile",
"basic",
"email"
],
"optionalClientScopes": [
"address",
"phone",
"organization",
"offline_access",
"microprofile-jwt"
],
"access": {
"view": true,
"configure": true,
"manage": true
}
}

Upload the file from your local machine or any accessible path.
Fields Explanation
1. Resource File (optional)
  - Allows you to import a client configuration from a JSON or XML file instead of entering details manually.
  - If provided, most fields will auto-fill.
2. Client ID (required)
  - A unique identifier for the client within the realm.
  - Used by applications to request authentication from ZTrust.
  - Example: my-web-app, mobile-app, ztrust-dashboard.
3. Name (optional but recommended)
  - A human-readable name for the client.
  - Helps administrators identify it easily in the console.
  - Example: ZTrust Dashboard or HR Management System.
4. Description (optional)
  - A short explanation about the purpose of this client.
  - Example: "Client used for SSO authentication of the HR portal."
5. Announcement (optional)
  - Can be used to add notes or special instructions about the client.
  - Example: "This client will be deprecated soon."
6. Always Display in UI (toggle)
  - If enabled, this client will always appear in the ZTrust login selection screen.
  - Useful when there are many clients and you want to highlight specific ones.
7. Type (optional)
  - Defines the application type or protocol type of the client.
  - Could be used internally to categorize clients (e.g., OIDC, SAML, Service, etc.).

Creating a New Client

To create a new client:

Navigate to Clients in the left menu.
Click on Create Client.
You’ll be redirected to the Create Client screen.

Client Type

Defines the protocol used for authentication and authorization. Options:

OpenID Connect (OIDC) → Used for identity verification and authentication via tokens.
SAML → Used for web-based authentication and cross-domain SSO using XML assertions. Choose based on your application’s needs.

Client Authentication

This is a toggle button. When enabled (toggled ON), the OIDC type is set to confidential access.

When turned OFF, it is set to public access.

You can switch this ON or OFF based on your requirements.

Authorization

This toggle button, when enabled (toggled ON), activates fine-grained authorization support for a client. When turned OFF, this feature is disabled.

You can adjust this setting based on your specific requirements.

Authentication Flow

You can choose the authentication flow by ticking the checkbox beside each of these options.

The table below displays the various types of flows along with a brief description for each.

Type of Flow

Description

Standard flow

This option activates standard OpenID Connect redirect-based authentication using an authorization code. Enabling this checkbox adds support for 'Authorization Code Flow' to this client.

Direct access grants

By selecting this checkbox, support for Direct Access Grants is enabled. This allows the client to access the user's username/password directly and exchange it with the ZTrust server for an access token.

Implicit flow

Selecting this checkbox enables support for OpenID Connect redirect-based authentication without requiring an authorization code.

Service accounts roles

Selecting this checkbox enables authentication for this client to ZTrust and retrieves an access token specifically dedicated to this client.

OAuth 2.0 Device Authorization Grant

Selecting this checkbox activates support for the OAuth 2.0 Device Authorization Grant. This indicates that the client is an application installed on a device with limited input capabilities or lacking a suitable browser.

OIDC CIBA Grant

Selecting this checkbox activates support for OIDC CIBA Grant, indicating that the user is authenticated through an external authentication device rather than the user's browser.

Once you've entered the above details, click Next to proceed with creating the Client.

Back

To return to the previous settings screen, click Back.

Upon clicking Back, you will be redirected to the previous screen, which is the General Settings page.

Cancel

If you wish to cancel the client creation and discard the changes, click on Cancel.

Clicking Next will redirect you to the following screen.

Login Settings

Root URL

Base URL used for relative paths in the client configuration.

Example:

If Root URL = https://example.com
And Valid Redirect URI = /dashboard
The final redirect URL becomes: https://example.com/dashboard.

Home URL

Default URL where the authorization server redirects after login.

Example:

If you want users to go directly to their dashboard after login, set Home URL to: https://example.com/dashboard.

Valid Redirect URIs

Add URLs where users can be redirected after successful login.
Click + Add valid redirect URIs to include multiple URIs.
Use - to remove unwanted URIs.

Examples:

https://example.com/dashboard
http://localhost:3000/* (Example : for development)

Valid Post Logout Redirect URIs

Define where users should be redirected after logout.
Similar add/remove controls as above.
Example:
- Root URL = https://example.com
- Valid Redirect URI = /auth/callback → Final URL = https://example.com/auth/callback

Web Origins

Used for CORS (Cross-Origin Resource Sharing).
Define allowed domains that can make API calls with tokens.
This setting manages Cross-Origin Resource Sharing (CORS).
Example:
- Valid Redirect URIs → https://example.com/*
- Web Origins → https://example.com
- Do not use "*" in production, because it allows any domain to access tokens("Use it in local environment")