> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ulm.m1amdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Digital Identity Management Support

Digital Identity Management fully supports the OAuth 2.0 ([RFC-6749](https://datatracker.ietf.org/doc/html/rfc6749)) and [OpenID Connect base standards](https://openid.net/specs/openid-connect-core-1_0.html), as well as the Proof Key for Code Exchange (PKCE) extensions for Authorization Code Grant ([RFC-7636](https://datatracker.ietf.org/doc/html/rfc7636)) and OpenID Connect discovery protocols referenced in this guide. Although this guide presents only our recommended best practices according to each kind of application you may want to build, other options are available according to the defined standards, such as the now-deprecated Implicit and Hybrid authorization grant types, as well as the trusted-party Resource Owner Password Credentials Grant.

In Digital Identity Management, as an extension to the OIDC and OAuth 2.0 standards, access, refresh, and ID tokens are all issued as JSON Web Tokens (JWTs, [RFC-7519](https://datatracker.ietf.org/doc/html/rfc7519)). This means that the tokens are no longer opaque to the RP. The RP can inspect JWTs to determine things like the token validity, or to perform verification by checking the expiry time and signature. Explanations on how to use the JWT for the purpose of authentication are provided in each application-specific SSO topic.

Digital Identity Management supports the following scopes and supplies the respective claim data per scope:

| Scope | Standard? | Description |
| - | - | - |
| `openid` | Y | Requests that Digital Identity Management issues an ID token (in addition to an access token) with at least the `sub` value populated. Requesting an ID token enables OIDC as opposed to OAuth 2.0. |
| `profile` | Y | Requests the `name`, `family_name`, `given_name`, `picture`, `locale`, and `updated_at` claims from Digital Identity Management. |
| `email` | Y | Requests the `email` and `email_verified` claims from Digital Identity Management. |
| `phone` | Y | Requests the `phone_number` and `phone_number_verified` claims from Digital Identity Management. |
| `offline_access` | Y | Requests that Digital Identity Management issues a refresh token along with the access token or ID token. |
| `com.uxpsystems.ulm.partner` | N | A Digital Identity Management extension scope. It enables use of the access token to call Digital Identity Management's `/privacy/users/*/partners/*` API for managing an user's privacy settings for the requesting RP. |
| `com.uxpsystems.ulm` | N | A Digital Identity Management extension scope. It enables use of the access token to call any or all Digital Identity Management Rest APIs (including Process APIs) on behalf of this user.In other words, this effectively grants full control over the user. This scope should be limited to applications that will manage the user's data such as a user's self-service profile. |
| `entitlements` | N | Requests Digital Identity Management's `entitlements` claims. |
| Digital Identity Management also supplies the following claim data, if requested using the appropriate scopes: | | |

| Claim | Standard? | Description |
| - | - | - |
| `sub` | Y | Stands for **Subject** and is a unique identifier for the user. This identifier for a given user may or may not be different for a each RP. This value is guaranteed not to change even if the user changes the properties of their account (for example, changes email address or phone number).If your application wants to store user data, it should use the **Subject** string as the unique identifier. |
| `email` | Y | Primary email address of a user |
| `email_verified` | Y | Specifies whether a user's email address has been verified by Digital Identity Management |
| `phone_number` | Y | Mobile phone number of a user |
| `phone_number_verified` | Y | Specifies whether a user's phone number has been verified by Digital Identity Management |
| `name` | Y | Full name of a user (that is, first name and last name) |
| `family_name` | Y | Last name of a user |
| `given_name` | Y | First name of a user |
| `picture` | Y | URL of where the user's avatar is hosted |
| `locale` | Y | Language setting of a user, if available |
| `updated_at` | Y | The last time the user's profile (that is, the Digital Identity Management User entity) was updated; expressed in UNIX Epoch timestamp format |
| `entitlements` | N | End user's entitlements data for this relying party, if entitlements are configured.The entitlements system allows Digital Identity Management to provide access to information about some of a user's Digital Identity Management Subscriptions without granting full access to all of that user's Digital Identity Management data, through use of the `com.uxpsystems.ulm` scope. This is most useful for external relying parties controlled by entities outside of your organization who need to know if a user has an active subscription of a particular type. For example, a third-party streaming media service that your application resells, or to which your application provides access, can check that the user has purchased the service, and potentially what tier of service as well. Configuration of the entitlements system is outside the scope of this guide. Reach out to the Digital Identity Management team for more information about how Digital Identity Management Entitlements work. |
| **Parent topic:**[OAuth 2.0 and OpenID Connect](../topics/oAuth2andOpenIDConnect) | | |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.