$code_verifier ='TiGVEDHIRkdTpif4zLw8v6tcdG2VJ.vP4r0fuLhsXIj'

# Hash the code verifier using SHA-256
$hasher = [System.Security.Cryptography.HashAlgorithm]::Create("sha256")
$hashOfSecret = $hasher.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($code_verifier))

# Convert to Base64 URL encoded (slightly different to normal Base64)
$clientSecret = [System.Convert]::ToBase64String($hashOfSecret)
$clientSecret = $clientSecret.Split('=')[0]
$clientSecret = $clientSecret.Replace('+', '–')
$clientSecret = $clientSecret.Replace('/', '_')

# Output the results
Write-Output ("`r`nThe code verifier is: `r`n`r`n$code_verifier")
Write-Output ("`r`nAnd code challenge is:`r`n`r`n$clientSecret" )

# Wait for a keypress
Write-Host "`r`nPress any key to continue...`r`n" -ForegroundColor Yellow
[void][System.Console]::ReadKey($true)

4.2.2 Requesting an authorization code

You must request an authorization code from the authentication service before you can obtain an identity token.

1. From your website, post the following information to the MyID authorization URL:

   https://<server>/web.oauth2/connect/authorize

   For the standalone authentication service, this is:

   https://<server>/web.oauth2.ext/connect/authorize

   • client_id – the ID of your system; for example:

     myid.openid

   • scope – set this to one of the scopes listed in the AllowedScopes parameter of your appsettings.Production.json file; for example:

     openid

   • redirect_uri – set this to the URL of the page on your website to which the authorization code will be returned. This must be the same as the URL you specified in the appsettings.Production.json file.

   • response_type – set this to code

   • code_challenge – if you are using PKCE, set this to the PKCE code challenge you generated. This is the Base64 URL-encoded SHA-256 hash of the random code verifier you created.

   • code_challenge_method – if you are using PKCE, set this to S256

   • state – this value is returned in the redirect, allowing you to persist data between the authorization request and the response; you can use this as a session key.

   When you post this request, the MyID authentication service prompts you for your user credentials. The available methods of authentication depend on how you have configured your system; the same methods are available for authentication as are available in the MyID Operator Client.

   If you are using the standalone authentication service, only FIDO is currently supported as a logon method.

   

   Note: If there is only one authentication method available, this stage is skipped.

2. Complete the authentication using your method of choice; for example, security questions or FIDO.

   Note: You may need to ensure that the MyID Client Service is running on your PC; for example, smart cards and VSCs require the MyID Client Service.

   If you configured your system to require consent using the RequireConsent parameter, the end user must allow your external system to access their information on the MyID authentication service:

   

   Note: The name displayed on this screen is the ClientName parameter you set up in the appsettings.Production.json configuration file.

3. Capture the code parameter that is returned to the page you specified in the redirect_uri parameter.

   This is your authorization code, which can be used once to request an identity token. If you need to request another identity token, you must first request another authorization code and go through the user authentication procedure again.