1. Home >
2. OpenId Connect >
3. API Reference - v1.0 >
4. Resource Owner Password Grant

Resource Owner Password Grant

Use this API to authenticate a given user’s username and password. It makes use of the OpenID password grant and upon success will create a session and return an access token.

Resource URL

https://<region>.onelogin.com/oidc/token

Header Parameter

new Buffer(`${client_id}:${client_secret}`).toString('base64');

Resource Parameter

Request Parameter

Sample Request Body

username=rich&password=password&client_id=ba88ac70-1234-0135-527a&grant_type=password&scope=openid

Sample Response

{
    "access_token": "NWE4Nzg2ZDEtNzQyMS00ZDViLThjMjctMGQwNjlmZjU5MWNkBGjFElT7CWzl0d....",
    "expires_in": 3600,
    "token_type": "Bearer",
    "refresh_token": "897987AGBEtNzQyMS00ZDViLThjMjctMGQwNjlmZjU5MWNkBGjFElT7CWzl0d...."
}

{
    "error": "invalid_request",
    "error_description": "Resource not found"
}

{
    "error": "unsupported_grant_type",
    "error_description": "unsupported grant_type requested (xxxx)"
}

{
    "error": "invalid_request",
    "error_description": "invalid authorization header value format"
}

{
    "error": "invalid_request",
    "error_description": "Authentication Failed"
}

{
    "error": "invalid_request",
    "error_description": "Authentication Failed: Invalid user credentials"
}

{
    "error": "invalid_request",
    "error_description": "MFA is required for this user"
}

{
    "error": "invalid_request",
    "error_description": "User is locked. Access is unauthorized"
}

{
    "error": "invalid_request",
    "error_description": "User is suspended. Access is unauthorized"
}

{
    "error": "invalid_request",
    "error_description": "Password expired"
}

{
    "error": "invalid_request",
    "error_description": "Access is unauthorized"
}

Response Elements

Sample Code

cURL

Replace sample values indicated by < > with your actual values.

curl -XPOST "https://<region>.onelogin.com/oidc/token" \
-H "Authorization: Basic <base64 encoded client_id:client_secret>" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=password&username=<username>&password=<password>&client_id=<client_id>&scope=openid"

Postman Collection

Replace sample variables indicated by {{ }} with your actual values.

Download for the OpenId Connect API

Have a Question?

Have a how-to question? Seeing a weird error? Ask us about it on StackOverflow.

Found a bug? Submit a support ticket.

Have a product idea or request? Share it with us in our Ideas Portal.

StackOverflow discussions about "[onelogin] openid connect"

• Votes
• Newest
• Relevance
• Active
• 56 results

• 6
  Votes

  A: SAML for Native Mobile Apps(Android and IOS)

  Answered Apr 02 2018

  session you've established with an SSO provider) between native apps that also support SAML the same way. https://spin.atomicobject.com/2016/09/01/sharing-web-data-wkwebview/ Basically, if you do this, you'll also be supporting SSO on mobile via SAML (or OpenID Connect, if you go that route) …

  androidiossaml-2.0onelogin
• 5
  Votes

  1
  Answers

  Q: How to use onelogin SSO with AngularJS?

  Asked Jun 20 2016

  questions: 1> Onelogin is using SAML instead of OpenID Connect. I am not asking what's the difference between these two, but what is recommended since everyone is moving towards OpenID Connect? 2> Does Onelogin supports AngularJS? I don't see any documentation for onelogin API with AngularJS & Node See Here … I was looking into Onelogin for SSO. We have applications written in .NET, AngularJS + Node. None of these applications are mobile applications. After going through their documentation I have few …

  samlonelogin
• 3
  Votes

  A: Does OneLogin support client session management via OIDC?

  Answered Nov 16 2018

  https://openid.net/specs/openid-connect-session-1_0.html: 2.1. OpenID Provider Discovery Metadata These OpenID Provider Metadata parameters MUST be included in the Server's discovery … responses when Session Management and Discovery are supported: check_session_iframe ... end_session_endpoint ... I don't see these metadata parameters in the OneLogin discovery metadata, so it looks like Session Management is not supported. …

  javascriptangularopenidoneloginopenid-connect
• 2
  Votes

  A: How to Validate an Access Token for OAuth2 + PCKE flow

  Answered Apr 25 2019

  returned from the auth code flow https://developers.onelogin.com/openid-connect/api/authorization-code-grant worked, and the access_token only returned {"active":false} after it expired. Make sure you are not setting the Authorization header, and only set your client_id in the payload. … I'm using OIDC with PKCE, and I managed to call the https://openid-connect.onelogin.com/oidc/token/introspection endpoint with a token retrieved via the authorization code flow: $ curl -i -d "token …

  apisessionlogintokenonelogin
• 2
  Votes

  Q: Python/Django library for registering multiple SSO Identity Providers(OpenID Connect)

  Asked Nov 08 2019

  I'm working on a project written in Python(Django) and i recently added an SSO option for logging in with OneLogin accounts. There's already support for Microsofts Azure SSO from an earlier feature … . I'm looking for a library which can somehow register different identity providers(Microsoft, OneLogin, Facebook, etc...) and then wrap the similar login logic into a single class, which would handle …

  pythondjangopython-3.xsingle-sign-ononelogin

Loading...