Configuring an OpenID Connect Client in Liberty

<feature>openidConnectClient-1.0</feature>
<feature>transportSecurity-1.0</feature>

• Configure an openidConnectClient element that works with the default Liberty server OpenID Connect Provider. The following is an example of a minimal configuration that works with the default OpenID Connect Provider.

  The client must have a configured application available at the given URL pattern that can handle redirect requests from an OpenID Connect Provider. This URL must also precisely match the redirect URL registered for the client with the OP.

  Avoid trouble:

  If you are using an outbound proxy, note that the OpenID Connect RP does not provide a means to route requests through a proxy host automatically.

  If you must use a proxy to access the OpenID Connect Provider (OP), the value that you enter for any OP-related URL property must contain the proxy host and port, not the external OP host and port. In most cases, you can replace the OP host and port with the proxy host and port. The URL that you enter must be visible to both the RP and client (browser or application). For further guidance on how to determine the correct URL to use, contact your proxy administrator.

  In this example, the client expects the SSL port to be set to 443.

  <openidConnectClient id="client01"
      clientId="client01"
      clientSecret="{xor}LDo8LTor"
      authorizationEndpointUrl="https://server.example.com:443/oidc/endpoint/OidcConfigSample/authorize"
      tokenEndpointUrl="https://server.example.com:443/oidc/endpoint/OidcConfigSample/token">
  </openidConnectClient>

  In this sample minimal configuration, the following default values are assumed:

  • scope=openid profile: The scope of openid is required, and you can use the scope attribute to edit required scopes. For example, you can change the required scope to openid profile email.
  • This RP registers its redirect URL with the OP as https://<host name>:<ssl port>/oidcclient/redirect/client01, where both the host name and ssl port are automatically resolved, and client01 is the id of the openidConnectClient configuration element. If there is a proxy in front of the RP, you can override the host name and port with the attribute redirectToRPHostAndPort, and set redirectToRPHostAndPort to https://<host name>:<ssl port>.
• Configure an openidConnectClient element with discovery. The following example shows a minimal configuration that automatically discovers the OpenID Connect provider.

  <openidConnectClient id="RP"
      clientId="ebb996943plm4450bdb674c211a9fab0"
      clientSecret="g12ciZL1zsVYk6yXTMa2iopa8TBwC178CGq42mdJCALYCdQT1kE1ecB010GE"
      discoveryEndpointUrl="https://example.server.com/oidc/endpoint/OidcConfigSample/.well-known/openid-configuration">
  </openidConnectClient>

  If a discovery endpoint is configured, other configured OIDC endpoints are ignored. All endpoints are replaced with the following discovered endpoints: "issuer", "authorization_endpoint", "token_endpoint", "userinfo_endpoint", "jwks_uri", and "revocation_endpoint".

<sslDefault sslRef="DefaultSSLSettings" />
<ssl id="DefaultSSLSettings" keyStoreRef="myKeyStore" trustStoreRef="myTrustStore" />
<keyStore id="myKeyStore" password="{xor}EzY9Oi0rJg==" type="jks" location="${server.config.dir}/resources/security/BasicKeyStore.jks" />
<keyStore id="myTrustStore" password="{xor}EzY9Oi0rJg==" type="jks" location="${server.config.dir}/resources/security/BasicTrustStore.jks" />

OpenID Connect is configured to use the default SSL configuration that is specified by the server. Therefore, the default SSL configuration for the server must use the truststore that is configured for OpenID Connect.

In addition to using the SSL default configuration as shown in the example, an outbound default SSL configuration can be configured on the sslDefault element with the outboundSSLRef attribute. If the outbound default attribute is specified, then the SSL configuration that is specified by the outboundSSLRef attribute is used for outbound connections. You can override the default and specify the host and port to use for an outbound connection by using outbound SSL filters in the SSL configuration. For more information, see Outbound filters for SSL configurations and Configuring SSL settings for outbound communications.

To configure the Liberty OpenID Connect client to use a third-party OpenID Connect Provider such as (Microsoft Azure or Google), you must configure the following attributes. The attribute values can be obtained by calling the OP's discovery endpoint, which provides a JSON document at the path that is formed by concatenating the string /.well-known/openid-configuration to the issuer.

For more OpenID Connect Client configuration options, see OpenID Connect Client.

When the openidConnectClient-1.0 feature is enabled and the openidConnectClient element is not configured with an authFilterRef attribute, any unauthenticated request is authenticated through the OpenID Connect provider.

For more information on configuring the authentication filter, see Authentication Filters.

You can configure Liberty as an OpenID Connect Relying Party to multiple OpenID Connect Providers by creating multiple openidConnectClient elements and multiple Authentication Filters. Each openidConnectClient element defines one Single-Sign-On relationship with one OpenID Connect Provider, and use the authFilterRef attribute to reference to one Authentication Filter.

You can configure a Liberty OpenID Connect client to support the RS256 signature algorithm in an ID Token. The Liberty OpenID Connect client's default signature algorithm is HS256. If you configure RS256 as the ID Token's signature algorithm by setting signatureAlgorithm="RS256", you must configure both the trustStoreRef and trustAliasName, unless the OP supports a JWK endpoint.

The openidConnectClient-1.0 feature uses an Authorization Code grant type to request a user authentication token, and you can configure the Liberty openidConnectClient-1.0 feature to use an implicit grant type by adding grantType="implicit" to the server.xml file. If your Liberty server and OpenID Connect provider are in different firewalls, you must use this configuration option.

By default, the Liberty OpenID Connect Client's redirect servlet listens on the /oidcclient context root, and its redirect URL format is https://<host_name>:<ssl_port>/oidcclient/redirect/<configuration_ID>. If you cannot use this context root, set a different context root in the server configuration.

<oidcClientWebapp contextPath="/acme/openid" />

The resulting redirect URL format is https://<host_name>:<ssl_port>/acme/openid/redirect/<configuration_ID>.