OpenID Connect Configuration

To facilitate secure authentication and seamless integration for third-party applications and digital health services, Stern Apotheke (Naunhof) provides standardized OpenID Connect (OIDC) endpoints. This configuration allows authorized clients to verify the identity of users through our trusted authentication server, ensuring that sensitive pharmaceutical and personal data remains protected under strict security protocols.

Discovery Document

For automated configuration, developers can retrieve the full set of OIDC metadata by accessing the standard discovery endpoint. This document provides all necessary URLs, supported scopes, and cryptographic keys required to establish a secure connection.

• Discovery URL: https://sternen-apotheke-naunhof.de/.well-known/openid-configuration

Technical Endpoints

The following endpoints are utilized during the OIDC handshake to manage authorization, token exchange, and user information retrieval:

• Authorization Endpoint: Used to initiate the authentication flow and request user consent.
• Token Endpoint: Used by clients to exchange authorization codes for access tokens and ID tokens.
• UserInfo Endpoint: Provides a standardized way to retrieve claims about the authenticated user.
• JWKS URI: Contains the public keys used to verify the digital signatures of the ID tokens issued by our system.

Supported Scopes and Claims

Our implementation supports standard OIDC scopes to ensure minimal data exposure and adherence to privacy-by-design principles. Supported scopes include:

• openid: Essential for OIDC identity verification.
• profile: Access to basic user profile information.
• email: Access to the user's verified email address.

For developers implementing third-party integrations, please ensure that all requests are made over HTTPS and that your application strictly validates the iss (issuer) and aud (audience) claims to maintain the integrity of the authentication session. If you require specific client credentials or custom scope configurations, please contact our technical administration team via our official website.