Current File(s): conf/oidc.properties, conf/authn/oauth2client-authn-config.xml
Format: Native Spring

Overview

The authn/OAuth2Client login flow supports an extensible set of back-ends and is designed to handle all of the supported OAuth client authentication types.

Like the IdP itself, this flow supports the CredentialValidator interface and the chaining of CredentialValidator plugins in arbitrary sequences.

General Configuration

Most features of this flow can be configured with conf/oidc.properties. Some advanced features require Spring configuration, and the file conf/authn/oauth2client-authn-config.xml will be imported if it is created and populated, and supports definitions of beans into the proper Spring flow context. It is analagous to conf/authn/password-authn-config.xml from the IdP proper.

All of the CredentialValidator types supported by the IdP are supported here (the links here are to the implementation class' Javadoc rather than the IdP documentation). There are two additional validators provided and wired in as the default configuration to provide backward compatibility supporting both client secrets resolved from metadata and signed JWT authentication. The compatibility validators generally don’t require any special configuration. The main reason for customizing the chain of validators is to add validation of client secrets against other back-ends (e.g., using LDAP to validate “service accounts” issued to clients).

• shibboleth.LDAPValidator

• shibboleth.JAASValidator

• shibboleth.KerberosValidator

• shibboleth.HTPasswdValidator

With the exception of LDAP, the other beans above are not pre-configured with special beans or properties to control their behavior as they are in the IdP’s own configuration. As a result you would need to directly inherit from and confgure these beans appropriately to use them.

In the case of LDAP, a default shibboleth.LDAPAuthenticationFactory bean is installed as in the Password flow, and supports a similar set of properties as documented on the LDAPAuthnConfguration page, but apart from the pooling properties that are reused from the original configuration, the others are renamed to insert “OAuth2Client” into the property names to enable separation of the search location and any other settings that need to be unique. For example, the documented property named “idp.authn.LDAP.ldapURL” is named “idp.authn.OAuth2Client.LDAP.ldapURL” for this use case.

Aside from the more specific back-end configurations, there are beans and properties defined for some general configuration independent of the back-end chosen. They are all listed in the reference section below.

The most important bean is shibboleth.authn.OAuth2Client.Validators, a List of CredentialValidator plugins that should be used to perform the authentication processing.

A property named idp.authn.OAuth2Client.requireAll controls whether the credentials must be validated successfully by all applicable plugins in the list, or just one.

Combining plugins tends to be more complex but the default, requiring only a single valid result, is fairly simple to deal with. One obvious issue is that you should make sure to set the property named idp.authn.OAuth2Client.removeAfterValidation to false if you apply the "require all" mode to prevent the client information from being pulled mid-request.

Basic Features

<util:list id="shibboleth.authn.OAuth2Client.Validators">
    <ref bean="shibboleth.LDAPValidator" />
</util:list>

<util:list id="shibboleth.authn.OAuth2Client.Validators">
    <ref bean="shibboleth.OIDCClientInfoValidator" />
    <ref bean="shibboleth.JWTValidator" />
    <ref bean="shibboleth.LDAPValidator" />
</util:list>

<util:list id="shibboleth.authn.OAuth2Client.Validators">
    <ref bean="shibboleth.OIDCClientInfoValidator" />
    <ref bean="shibboleth.JWTValidator" />
    <bean parent="shibboleth.LDAPValidator" p:matchExpression="^\S+\.\d+$" />
</util:list>

    <!-- Separate list of flows to apply to OAuth2 client authentication. -->
    <util:list id="custom.OAuth2Client.PostLoginSubjectCanonicalizationFlows">
        <ref bean="c14n/simple" />
    </util:list>

Advanced Features

Reference

<util:list id="shibboleth.AvailableAuthenticationFlows">
 
    <bean p:id="authn/OAuth2Client" parent="shibboleth.AuthenticationFlow"
            p:order="%{idp.authn.OAuth2Client.order:1000}"
            p:nonBrowserSupported="true"
            p:passiveAuthenticationSupported="true"
            p:forcedAuthenticationSupported="true"
            p:proxyRestrictionsEnforced="true"
            p:proxyScopingEnforced="false"
            p:discoveryRequired="false"
            p:lifetime="PT60S"
            p:inactivityTimeout="PT60S"
            p:reuseCondition-ref="shibboleth.Conditions.FALSE"
            p:activationCondition-ref="#{'%{idp.authn.OAuth2Client.activationCondition:shibboleth.Conditions.TRUE}'.trim()}"
            p:subjectDecorator="#{getObject('%{idp.authn.OAuth2Client.subjectDecorator:}'.trim())}">
        <property name="supportedPrincipalsByString">
            <bean parent="shibboleth.CommaDelimStringArray"
                c:_0="#{'%{idp.authn.OAuth2Client.supportedPrincipals:}'.trim()}" />
        </property>
    </bean>
 
</util:list>

Notes

The idp.authn.OAuth2Client.retainAsPrivateCredential property should be used with caution, as it retains the password and makes it available in plaintext form within server memory at various stages.