Back to docs index

VIS-specific OAuth Parameters

OpenID Connect assurance (acr_values)

acr_values is a standard, request-only protocol parameter, not an application registration override. Send a space-separated list containing urn:dhamma:vis:mfa to request VIS TOTP verification through the existing require_mfa flow, including its enrollment grace and generic-user rules. Unknown values are ignored. The request is voluntary: unmet assurance is not an OAuth error.

The ID token includes acr=urn:dhamma:vis:mfa only when requested and the linked browser session has verified TOTP, including after Google, Apple or Office365 sign-in. It is never included in UserInfo. Applications requiring MFA must validate the ID token and deny access if that exact claim is absent. Discovery advertises the supported value in acr_values_supported.

Registration overrides

In addition to the standard Authorize endpoint OAuth parameters, you can include extra parameters in the authentication request. For example here we add the app_name and allow_sign_up parameters:

https://identity.dhamma.org/oauth/authorize?allow_sign_up=true&app_name=custom+app+name&client_id=XXX&locale=en&redirect_uri=YYY&response_type=code&scope=default&state=ZZZ

These parameters’ default values can be customized per application in the application edit page in the VIS UI.

Param	Description	Examples	Default Value
allow_generic_oldstudent*	Allow sign in with the oldstudent/behappy credentials	true, false	false
allow_sign_in_with_apple	Allow the user to sign in with their Apple account	true, false	true
allow_sign_in_with_google	Allow the user to sign in with their Google account	true, false	true
allow_sign_in_with_office365	Allow the user to sign in with their Office365 account (@dhamma.org email)	true, false	true
allow_sign_up	Allow the user to sign up before sign in (public websites)	true, false	false
custom_sign_up_url	Replace the Sign up button URL on the login page. Leave blank to keep the VIS sign-up page. Keyword :locale is replaced by the current locale.	https://my.app/:locale/signup
app_name	Override your app name	My App, Mon Application
back_button	Display a button to cancel login and go back to your app	true, false	false
back_button_text	Text of the back button	Go back to the form
back_button_url	URL to get back to	https://my.app/form
cancel_mfa_link_text	Text of the cancel link on the TOTP page. The link will be displayed only if cancel_mfa_link_url is set.	Click here to cancel your request	Cancel
cancel_mfa_link_url	URL of the cancel link on the TOTP page	https://my.app/return
confirm_identity	Prompt user to reenter their password even if they are signed in	true, false	false
extra_agreement_title	Add title to the agreement users acknowledge upon sign up	My App agreement
extra_agreement_text	Add text to the agreement users acknowledge upon sign up	My App will use your data for ..._
iframe	so iframe layout is used	true, false	false
locale	locale to use for VIS screen	en, fr, ko...	en
login_message	A message to display on the login page	Some message
login_title	Main title for the login page	Sign in to prefill your form
mfa_message	Optional text displayed on the TOTP page	This action requires a two-steps login
require_mfa	Prompt user to enter a TOTP. An application's true setting cannot be disabled by a request. Ignored when the user has not set up TOTP yet and has a require_mfa_from_date value in the future. A false request value is ignored when the application is configured to require MFA.	true, false	false

*: when allow_generic_oldstudent is true, request-level require_mfa (including arming by acr_values) is ignored. An application's require_mfa=true still applies.