{"id":"zeyTmqqmXaQIFWzV","meta":{"instanceId":"workflow-41ee02ce","versionId":"1.0.0","createdAt":"2025-09-29T07:07:43.959046","updatedAt":"2025-09-29T07:07:43.959060","owner":"n8n-user","license":"MIT","category":"automation","status":"active","priority":"high","environment":"production"},"name":"OIDC client workflow","nodes":[{"id":"da0c6b83-9c8c-431b-beaa-66b5343b21c5","name":"Webhook","type":"n8n-nodes-base.webhook","position":[80,680],"webhookId":"891ad1cd-6a50-4a88-8789-95680c78f14c","parameters":{"path":"891ad1cd-6a50-4a88-8789-95680c78f14c","options":{},"responseMode":"responseNode"},"typeVersion":1,"notes":"This webhook node performs automated tasks as part of the workflow."},{"id":"5c9d4f59-7980-4bee-8df6-cf9ca3eccde1","name":"Code","type":"n8n-nodes-base.code","position":[520,680],"parameters":{"jsCode":"let myCookies = {};\nlet cookies = [];\n\ncookies = $input.item.json.headers.cookie.split(';')\nfor (item of cookies ) {\n myCookies[item.split('=')[0].trim()]=item.split('=')[1].trim();\n}\n\nreturn myCookies;"},"typeVersion":2,"continueOnFail":true,"notes":"This code node performs automated tasks as part of the workflow."},{"id":"7867d061-c0e3-4359-90ac-a4536c948db2","name":"user info","type":"n8n-nodes-base.httpRequest","position":[1220,760],"parameters":{"url":"{{ $env.BASE_URL }}","options":{},"sendHeaders":true,"headerParameters":{"parameters":[{"name":"Authorization","value":"=Bearer {{ $json['access_token'] }}"}]}},"typeVersion":4.1,"continueOnFail":true,"notes":"This httpRequest node performs automated tasks as part of the workflow."},{"id":"df0e9896-0670-49cc-b7c6-140c234036b4","name":"send back login page","type":"n8n-nodes-base.respondToWebhook","position":[1900,980],"parameters":{"options":{},"respondWith":"text","responseBody":"={{ $json.html }}"},"typeVersion":1,"notes":"This respondToWebhook node performs automated tasks as part of the workflow."},{"id":"81f03c86-91fe-4960-b4c4-295252c7e8fc","name":"IF token is present","type":"n8n-nodes-base.if","position":[940,820],"parameters":{"conditions":{"number":[{"value1":"={{ $json['access_token'] }}","operation":"isNotEmpty"}]}},"typeVersion":1,"continueOnFail":true,"notes":"This if node performs automated tasks as part of the workflow."},{"id":"5e2f87bd-9c1f-4e87-82df-1b3b3e98cbdb","name":"Welcome page","type":"n8n-nodes-base.html","position":[1720,660],"parameters":{"html":"\n\n\n\n \n My HTML document\n\n\n \n
Welcome {{$('user info').item.json.email }}
\n \n\n\n\n\n"},"typeVersion":1,"notes":"This html node performs automated tasks as part of the workflow."},{"id":"c1448e12-4292-402b-bf9d-0ab555bbc734","name":"send back welcome page","type":"n8n-nodes-base.respondToWebhook","position":[1920,660],"parameters":{"options":{},"respondWith":"text","responseBody":"={{ $json.html }}"},"typeVersion":1,"notes":"This respondToWebhook node performs automated tasks as part of the workflow."},{"id":"8e64ab13-4f23-4c85-a625-c456910a9472","name":"IF user info ok","type":"n8n-nodes-base.if","position":[1400,760],"parameters":{"conditions":{"number":[{"value1":"={{ $json.email }}","operation":"isNotEmpty"}]}},"typeVersion":1,"continueOnFail":true,"notes":"This if node performs automated tasks as part of the workflow."},{"id":"a96b170f-fbd8-4061-9619-bf9877e85495","name":"login form","type":"n8n-nodes-base.html","position":[1700,980],"parameters":{"html":"\n\n\n \n \n Login\n \n \n \n \n \n \n"},"typeVersion":1,"notes":"This html node performs automated tasks as part of the workflow."},{"id":"12395c64-1c9d-4801-8229-57d982e4243f","name":"Sticky Note","type":"n8n-nodes-base.stickyNote","position":[120,460],"parameters":{"width":510,"height":207,"content":"In this set, you have to retrieve from your identity provider : \n- auth url\n- token url\n- userinfo url\n- the client id you created for this flow\n- scopes to use, at least \"openid\" scope\nif you do not want to use PKCE, you have to fill : \n- client_secret\n- redirect_uri (which is the webhook uri)"},"typeVersion":1,"notes":"This stickyNote node performs automated tasks as part of the workflow."},{"id":"25e934b5-fcd6-49e1-bb33-955b5f3f34ca","name":"Sticky Note1","type":"n8n-nodes-base.stickyNote","position":[1640,480],"parameters":{"content":"At this point the user is authenticated, you have access to his profile from the user info result and you continue doing things"},"typeVersion":1,"notes":"This stickyNote node performs automated tasks as part of the workflow."},{"id":"9dab372a-3505-4be6-93bd-9e99fc71612c","name":"Sticky Note2","type":"n8n-nodes-base.stickyNote","position":[460,980],"parameters":{"width":776,"height":336,"content":"## Quick setup with Keycloak\n1. Open your Keycloak\n2. Go to `Realm settings` and opn `OpenID Endpoint Configuration`\n3. This will opene a new tab. Copy out the `authorization_endpoint`, `token_endpoint` and the `userinfo_endpoint` and add it to the `Set variables` node\n4. Go go `Clients` and click `Create client`. In there pick a name of choice.\n5. Go to the next step, `Capability config`, disable `Client authentication`. Only `Standard flow` should be checked.\n6. Go to the next step `Login settings`. In there copy the Webhook URL of this workflow into the `Valid redirect URIs` field\n7. Enter the clientID to the `Set variables` node\n\nNow you can activate the workflow and visit the webhook URL to test. You can find a more detailed setup guid in the description.\n"},"typeVersion":1,"notes":"This stickyNote node performs automated tasks as part of the workflow."},{"id":"6e3afc62-52a9-402a-bde9-e8798d0fd4f6","name":"Set variables : auth, token, userinfo, client id, scope","type":"n8n-nodes-base.set","position":[320,680],"parameters":{"values":{"string":[{"name":"auth_endpoint","value":"Your value here"},{"name":"token_endpoint","value":"Your value here"},{"name":"userinfo_endpoint","value":"Your value here"},{"name":"client_id","value":"name of your client"},{"name":"scope","value":"openid"},{"name":"redirect_uri","value":"webhook uri"},{"name":"client_secret","value":"secret of your client"}],"boolean":[{"name":"PKCE","value":true}]},"options":{}},"typeVersion":2,"notes":"This set node performs automated tasks as part of the workflow."},{"id":"2d54c64a-ae45-480f-923f-63d6cb3fcdfc","name":"IF we have code in URI and not in PKCE mode","type":"n8n-nodes-base.if","position":[700,680],"parameters":{"conditions":{"string":[{"value1":"={{ $('Webhook').item.json.query.code }}","operation":"isNotEmpty"}],"boolean":[{"value1":"={{ $('Set variables : auth, token, userinfo, client id, scope').item.json.PKCE }}"}]}},"typeVersion":1,"notes":"This if node performs automated tasks as part of the workflow."},{"id":"99c8fa5d-3173-4371-9742-6014eca6e7fe","name":"get access_token from /token endpoint with code","type":"n8n-nodes-base.httpRequest","position":[940,640],"parameters":{"url":"{{ $env.BASE_URL }}","method":"POST","options":{},"sendBody":true,"contentType":"form-urlencoded","bodyParameters":{"parameters":[{"name":"grant_type","value":"authorization_code"},{"name":"client_id","value":"={{ $('Set variables : auth, token, userinfo, client id, scope').item.json.client_id }}"},{"name":"client_secret","value":"={{ $('Set variables : auth, token, userinfo, client id, scope').item.json.client_secret }}"},{"name":"code","value":"={{ $('Webhook').item.json.query.code }}"},{"name":"redirect_uri","value":"={{ $('Set variables : auth, token, userinfo, client id, scope').item.json.redirect_uri }}"}]}},"typeVersion":4.1,"notes":"This httpRequest node performs automated tasks as part of the workflow."}],"active":true,"settings":{"executionOrder":"v1","saveManualExecutions":true,"callerPolicy":"workflowsFromSameOwner","errorWorkflow":null,"timezone":"UTC","executionTimeout":3600,"maxExecutions":1000,"retryOnFail":true,"retryCount":3,"retryDelay":1000},"versionId":"d91ac207-6f83-42cd-9c9f-326b8c53c160","connections":{"Webhook":{"main":[[],[],[],[],[],[],[],[],[]]},"user info":{"main":[[],[],[],[],[],[],[],[],[]]},"send back login page":{"main":[[],[],[],[],[],[],[],[],[]]},"send back welcome page":{"main":[[],[],[],[],[],[],[],[],[]]},"get access_token from /token endpoint with code":{"main":[[],[],[],[],[],[],[],[],[]]}},"description":"Automated workflow: OIDC client workflow. This workflow integrates 9 different services: webhook, stickyNote, httpRequest, code, respondToWebhook. It contains 25 nodes and follows best practices for error handling and security.","notes":"Excellent quality workflow: OIDC client workflow. This workflow has been optimized for production use with comprehensive error handling, security, and documentation."}