Client Registration

1. Access the Resource Registry

First, check the general page to make sure that you want to register an OIDC client and that you are entitled to do so.

Registering a relying party (a service) requires the following steps:

• Go to the Resource Registry on https://rr.aai.switch.ch. When asked to select an organisation to log in with, choose your organisation if available or choose "Switch edu-ID" otherwise.
• Authenticate at the selected organisation.
  In case you chose "Switch edu-ID" and you don't yet have an edu-ID account, please create an account by clicking on "Create account" on the login page.
  
  Note: On the first login, the Resource Registry will ask you to agree that the shown data will be stored in the Resource Registry and potentially published on the Switch web pages that list all OpenID Connect services.

2. Register your client in the Resource Registry

When logged into the Resource Registry, click on "Resources" in the blue bar, then on "Add a Resource Description" and select "OpenID Connect resource". Carefully read the remarks for each part of the form in order to correctly register your resource.

In the "Basic Resource Information":

• If you want it registered in the Test Federation, make sure to choose "Switch edu-ID [Test]" as approving home organisation.
• If you want it registered in the Prod Federation, please choose your own home organization as approving home organization.

Follow the whole registration process and read the instructions carefully.

OIDC IdP Discovery endpoints:

• Production:
  https://login.eduid.ch/.well-known/openid-configuration
• Test:
  https://login.test.eduid.ch/.well-known/openid-configuration

3. Specify the intended audience

Configure which identities are allowed to access the client in the resource registry. You can then also further filter them via parameter in the authentication request.

For testing purposes, we recommend using the Demo organisations for which you can self-create test affiliations.

Also check the attributes form. The edu-ID supports all relevant claims for OIDC. Mark them as required if you want your client to get them. You see more details about the claims in our attribute specifications. Click on each attribute to check the details (like their format and whether they are released as array or single value).

Note that only identities that you have allowed as intended audiences will be shown in the identity chooser.

4. Request approval

• When all sections of the Resource Description are finished, click on "Submit for approval". You then will see on the next page which persons will review and approve your registration.
• After the approval is given, wait for another two hours for the changes to be propagated to the edu-ID OpenID Provider. Afterwards, you can test the login from your client.