We are trying to use OIDC to enroll and manage users, and UMA to protect our backend APIs. Our OAuth client is a mobile application that uses Google to authenticate the user in the mobile app. This process happens only between the mobile app, the user and Google. Gluu is not involved at this stage. The outcome of this process is a Google id_token stored in the mobile app. Our idea is to use OIDC implicit flow with Gluu to enroll that user. 1. The mobile app would pass the following to Gluu in a single request: client_id, scope, redirect_uri and the Google id_token to an endpoint (which one?) 2. the Google id_token would be verified by a custom script. If the id_token is valid, create a new user (if he doesn't exist) and authenticate him in Gluu (same logic as gplus custom script). 3. return a Gluu id_token and access_token (with attributes uma_authorize) to the mobile app. We have managed to create an OIDC client profile with the correct scopes, get an AAT token (with basic authentication not Google) and we have tested the whole UMA flow successfully. But we can't find a way to use the custom scripts properly. This where we are stuck: 1. We don't have the need for a login form. (such as gpluslogin.xhtml). We only need an endpoint to post the parameters (scope, client_id, google id_token). Is there a way to customize this? 2. Then assuming we solved #1 we want to trigger the execution of a custom script that would validate the google id_token, enroll a new user and authenticate existing ones (like gplus custom script). 3. If #2 returns True, how do we manage to return the tokens defined in our Gluu OIDC client profile? Thanks in advance for your help!