Reference of OAuth 2.0 and OpenID Connect 1.0 client implementation in SSO Server authentication method OpenIDConnectMethod.

Registration

Process

1. Create OpenIDConnectMethod authentication method in SSO Server 
   • PUT /sso-api/method/oidc.method.1
   • className=ubilogin.method.provider.openidconnect.OpenIDConnectMethod
2. Get provider metadata from your OpenID Connect provider
   • GET issuer/.well-known/openid-configuration
   • If provider metadata is not available then need to manually construct provider metadata with required parameters
3. Register provider metadata with SSO Server
   • PUT /sso-api/method/oidc.method.1/$attribute/metadata
4. Read jwks_uri parameter from provider metadata, and get provider JSON Web Keys 
   • GET jwks_uri
5. Register provider keys with SSO Server
   • PUT /sso-api/method/oidc.method.1/$attribute/jwks
6. Get registration request from SSO Server
   • GET /sso-api/method/oidc.method.1/$attribute/registration
   • If provider does not support registration protocol then this step is optional
7. Send registration request to OpenID Connect provider, and receive registration response
   • If provider does not support registration protocol then need other method to register SSO Server as client, and receive client_id and client_secret
8. Register registration response with SSO Server
   • PUT /sso-api/method/oidc.method.1/$attribute/registration
   • If provider does not support registration protocol then need to manually construct registration response with required parameters

/sso-api/method/{id}/$attribute/metadata

/sso-api/method/{id}/$attribute/jwks

/sso-api/method/{id}/$attribute/registration

Authentication Request

This chapter describes how SSO Server constructs Authorization Request from information in Provider Metadata and Registration Response.

Request parameters

Signed request

Registration parameter "request_object_signing_alg" controls if SSO Server creates signed request. If parameter is not defined then request is not signed.

See also Signed and encrypted request - SSO

Response

Receives authorization code

Token Request

Request parameters

Client credentials

Registration parameter "token_endpoint_auth_method" controls what client credentials are sent with request. Default value is "client_secret_basic"

See also Client credentials - SSO

Token Validation

SSO Server attempts to choose one of the following token validation mechanisms.

ID Token

Enabled if "id_token" is present in Token Response, and if "id_token_signed_response_alg" Client Configuration value is not "none"

UserInfo

Enabled if "userinfo_endpoint" is defined in Provider Metadata..

Introspection

Enabled if "introspection_endpoint" is defined in Provider Metadata.

Configuration

Configuration strings 

It is possible to configure OpenID Connect method via management UI. Following table lists, which parameters can be added info Configuration section when OpenID Connect method is selected.

Client metadata

When registering the client metadata as JSON, Ubisecure SSO provides the following extensions:

An example client metadata with Ubisecure extensions:

{
  "redirect_uris": [
    "https://sso.example.com/method/redirect"
  ],
  "grant_types": [
    "authorization_code"
  ],
  "response_types": [
    "code"
  ],
  "jwks": {
    "keys": [
      {
        "kid": "dDRiW2EFbhJs_GKIH20MIOdRjt0",
        "kty": "RSA",
        "n": ...
        "e": "AQAB"
      }
    ]
  },
  "scope": "openid",
  "id_token_signed_response_alg": "RS256",
  "id_token_encrypted_response_alg": "RSA-OAEP",
  "id_token_encrypted_response_enc": "A128GCM",
  "request_object_signing_alg": "RS256",
  "token_endpoint_auth_method": "private_key_jwt",
  "client_id": "test-client",
  "ubisecure_request_object_query_parameters": [
      "client_id",
      "scope",
      "response_type",
      "acr_values",
      "claims"
  ],
  "ubisecure_request_parameters": {
  	"acr_values": "my-static-acr-values",
    "claims": {
      "some-complex": {
        "key": {
          "value": true
        }
      },
      "another-complex": {
        "some-key": {
          "test": true
        }
      }
    }
  }
}

This would translate to an authorization request

GET /authorization?request=eyJ...&client_id=test-client&scope=openid&response_type=code&acr_values=my-static-acr-values&claims=%7B%22some-complex%22%3A%7B%22key%22%3A%7B%22value%22%3Atrue%7D%7D%2C%22another-complex%22%3A%7B%22some-key%22%3A%7B%22test%22%3Atrue%7D%7D%7D

Compatibility flags

The following compatibility flags are supported for OpenID Connect authentication methods