What it does

• Pushed Authorization Requests (PAR) – no sensitive parameters in the browser URL
• private_key_jwt client authentication – no client secret to store
• DPoP sender-constrained tokens and PKCE (S256)
• Decrypts (ECDH-ES+A256KW) and verifies (ES256) the ID token; checks issuer, audience, nonce and expiry
• Generates and stores your signing and encryption keys automatically and publishes the public JWKS for the Singpass / Corppass portal
• Maps claims for both providers: Singpass person (sub) and Corppass person + company (act.sub, entity_id, entity_name)
• Optional auto-provisioning of OutSystems users
• Corppass authorization info (authinfo / tpauthinfo roles) captured at login via the DPoP userinfo endpoint
• Admin console with a step-by-step setup guide, provider-specific hints and copy buttons for the Redirect URI and JWKS URL
• Clear error reporting: provider error / error_description surfaced in an IdentityProviderError

Supported providers: Singpass FAPI 2.0 (Login), Corppass FAPI 2.0 (Login). Tested with MockPass (opengovsg) and designed against the published Singpass and Corppass FAPI 2.0 specifications.

This component started from the Forge OIDC Client component by OutSystems (https://www.outsystems.com/forge/component-overview/13850/oidc-client-o11), licensed under BSD-3-Clause, and has been extended for the Singpass and Corppass FAPI 2.0 profiles. It is an independent component and is not endorsed by OutSystems or GovTech Singapore.