Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

7023 OIDC to staging #7092

Merged
merged 3 commits into from
Nov 29, 2023
Merged

7023 OIDC to staging #7092

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b97084e
add new example
dmuelle Nov 20, 2023
eada111
Update examples.adoc
dmuelle Nov 20, 2023
4ee1750
edits per review
dmuelle Nov 21, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion modules/reference/pages/feature/openidConnectClient/examples.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ The following examples demonstrate configuration options for the OpenID Connect
- <<#oauth,Accept an OAuth 2.0 bearer access token without redirecting to an OpenID Connect provider>>
- <<#context,Modify the context root>>
- <<#params,Pass request parameters to OpenID Connect>>

- <<#access-token,Check the access token for user and group information>>

[#minimal]
=== Minimal configuration for Open Liberty to act as an OpenID Connect client
Expand Down Expand Up @@ -360,3 +360,19 @@ To provide extra authorization parameters to the OP, configure `authzParameter`
----

To configure parameters for the token endpoint, use the `tokenParameter` element.

[#access-token]
=== Check the access token for user and group information

If `userIdentifier` or `groupIdentifier` values are not found in the ID token, Open Liberty can also check in the access token and the `UserInfo` endpoint.

Set the `tokensOrderToFetchCallerClaims` attribute to `AccessToken IDToken Userinfo`, as shown in the following example.

[source,xml]
----
<openidConnectClient tokensOrderToFetchCallerClaims="AccessToken IDToken Userinfo" userIdentifier="unique_name" groupIdentifier="aud" ... />
----

In this example, Open Liberty checks for `userIdentifier` and `groupIdentifier` values first in the access token, then the ID token, and lastly, calls the `UserInfo` endpoint. If the values are not found in any of those locations, an unauthorized response code is returned.

If the `tokensOrderToFetchCallerClaims` attribute is not specified, the default value is `IDToken` and Open Liberty checks only the ID token for user and group information.