Page Comparison

...

The OIDC OP plugin is the successor to the original GEANT-funded add-on to Shibboleth and is now available as an offically-supported plugin for IdP V4.1 and above. It provides conformant OIDC OP functionality alongside the SAML and CAS support previously native to the IdP software.

...

Starting with V3.1, the plugin also includes support for some OAuth 2 features, acting as a more generalized Authorization Service in the OAuth framework.

Please review the OPReleaseNotes when installing or upgrading a new version.

Plugin Installation

Please review the OPReleaseNotes when installing or updating this plugin.

Enabling the Module

For a detailed guide on configuring modules, see the ModuleConfiguration topic. Once the plugin has been installed, its module should be enabled automatically for you:

...

Systems upgraded to V4.1 are also likely to require adding the idp.searchForProperties=true property to their idp.properties file, or else an explicit reference would have to be added to the new property file added by the module. It's best to clean up the property loading situation prior to using plugins that add their own.

...

Because this plugin is considerably more extensive than most, there are more touchpoints to the rest of the IdP configuration and a larger-than-usual set of initial setup steps needed before it can be used. The IdP may not even startup properly until many some of them are completed.

First Steps

...

The additional files created in conf/examples (oidc-attribute-resolver.xml and oidc-attribute-filter.xml) are intended as a source of examples to copy into your own files. The most critical definitions needed are the rules for creating and releasing the "sub" claim, as that as is a required OIDC feature (see OIDC OP#ClaimSetup). If you want to use them the example files directly (unlikely), you can copy them elsewhere and make us use of them as you see fit.

Key Generation

The OP plugin relies on supports keys in the JWK format as well as the more typical PEM format. There are some advantages to using the JWK format in optimizing which keys are tried in certain cases. There is no particular advantage to reusing any existing keys your IdP may be using, but you can if you prefer to do so.

The default configuration expects to have two RSA keys (one for signing and one for decryption), and one EC key. They are expected to be in locations defined via the following properties (with the shipping defaults shown):

...

Keys may be generated using the provided wrapper wrappers, in bin/jwtgen.sh and bin/jwtgen.bat:

...

The OIDC "issuer" value needs to be determined, and the OpenID discovery document needs to be made accessiibleaccessible.

The issuer value is set in conf/oidc.properties and must be a URL using the "https" scheme that contains host, and optionally, port number and path components and no query or fragment components. It generally must resolve to the root of the deployment in question. As a result, while it may be the same as one's SAML entityID, it often cannot be, as SAML does not conflate identity and location in this fashion.

...

idp.oidc.issuer = https://your.issuer.example.org

A common way for RPs clients to configure themselves against an OP is to read the openid-configuration resource as defined in https://openid.net/specs/openid-connect-discovery-1_0.html.

A template for this file is created in static/openid-configuration.json. You will need to update it to match your configuration. At minimum this means replacing "{{ service_name }}" with the host portion of your issuer value.

For the RP In order for clients to locate the file, you will either have to:

• Configure your Java container or other web server "front-end" to publish it at this exact location (obviously the prefix depends on your issuer value):

https://your.issuer.example.org/.well-known/openid-configuration

• Or (more typically), configure that location to route into your IdP at "/idp/profile/oidc/configuration" to generate the document more dynamically.

...

<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
	<property name="profileConfigurations">
		<list>
			<ref bean="OIDC.SSO" />
			<ref bean="OIDC.UserInfo"/>
            <ref bean="OAUTH2.Token"/>
			<ref bean="OAUTH2.Revocation"/>
			<ref bean="OAUTH2.Introspection" />
		</list>
	</property>
</bean>

Obviously this relies on a lot of defaulted behavior, but the full documentation "proper" includes more detailed information about how to adjust profile settings.

...

You will of course need to adjust the JSON to match the client you are testing, for which the documentation should help.

Full Configuration

Please refer to the topics below for more detailed information on different aspects of the extension.

• Client Registration (Metadata and Dynamic)

• Client Resolution

• User Authentication

• Client Authentication

• Attribute/Claims Resolution

  • The "sub" Claim

• Attribute Filtering

• Security Configuration

• Profile Configuration

• OP Discovery

Use Cases

• Client Credentials Grant

• Authorization Code Affinity