Project: 3Scale (Orchestration & Management / API Gateway)
File: oidc.md

```shell docker run --rm -p 8000:8080 forgerock-docker-public.bintray.io/forgerock/openam:6.0.0 ``` And open `http://localhost:8000/openam/`. Accept the license, fill out the admin password (user is amAdmin). Create a test realm, create OAuth provider OpenID Connect. Then the OIDC Discovery works: ```shell curl http://localhost:8000/openam/oauth2/realms/test/.well-known/openid-configuration ``` And returns following JSON: ```json { "requestparametersupported": true, "claimsparametersupported": false, "introspection_endpoint": "http://localhost:8000/openam/oauth2/realms/root/realms/test/introspect", "checksessioniframe": "http://localhost:8000/openam/oauth2/realms/root/realms/test/connect/checkSession", "scopes_supported": ["address", "phone", "openid", "profile", "email"], "issuer": "http://localhost:8000/openam/oauth2/test", "idtokenencryptionencvalues_supported": ["A256GCM", "A192GCM", "A128GCM", "A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512"], "acrvaluessupported": [ ], "authorization_endpoint": "http://localhost:8000/openam/oauth2/realms/root/realms/test/authorize", "requestobjectencryptionencvalues_supported": ["A256GCM", "A192GCM", "A128GCM", "A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512"], "rcsrequestencryptionalgvaluessupported": ["RSA-OAEP", "RSA-OAEP-256", "A128KW", "RSA15", "A256KW", "dir", "A192KW"], "claims_supported": [ "zoneinfo", "address", "profile", "name", "phone_number", "given_name", "locale", "family_name", "email" ], "rcsrequestsigningalgvalues_supported": [ "PS384", "ES384", "RS384", "HS256", "HS512", "ES256", "RS256", "HS384", "ES512", "PS256", "PS512", "RS512" ], "tokenendpointauthmethodssupported": ["clientsecretpost", "privatekeyjwt", "clientsecretbasic"], "tokenendpoint": "http://localhost:8000/openam/oauth2/realms/root/realms/test/accesstoken", "responsetypessupported": [ "code token id_token", "code", "code id_token", "device_code", "id_token", "code token", "token", "token id_token" ], "requesturiparameter_supported": true, "rcsresponseencryptionencvalues_supported": ["A256GCM", "A192GCM", "A128GCM", "A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512"], "endsessionendpoint": "http://localhost:8000/openam/oauth2/realms/root/realms/test/connect/endSession", "rcsrequestencryptionencvalues_supported": ["A256GCM", "A192GCM", "A128GCM", "A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512"], "version":

"rcsresponseencryptionalgvaluessupported": ["RSA-OAEP", "RSA-OAEP-256", "A128KW", "A256KW", "RSA15", "dir", "A192KW"], "userinfo_endpoint": "http://localhost:8000/openam/oauth2/realms/root/realms/test/userinfo", "idtokenencryptionalgvaluessupported": ["RSA-OAEP", "RSA-OAEP-256", "A128KW", "A256KW", "RSA15", "dir", "A192KW"], "jwksuri": "http://localhost:8000/openam/oauth2/realms/root/realms/test/connect/jwkuri", "subjecttypessupported": ["public"], "idtokensigningalgvalues_supported": [ "PS384", "ES384", "RS384", "HS256", "HS512", "ES256", "RS256", "HS384", "ES512", "PS256", "PS512", "RS512" ], "registration_endpoint": "http://localhost:8000/openam/oauth2/realms/root/realms/test/register", "requestobjectsigningalgvalues_supported": [ "PS384", "ES384", "RS384", "HS256", "HS512", "ES256", "RS256", "HS384", "ES512", "PS256", "PS512", "RS512" ], "requestobjectencryptionalgvaluessupported": ["RSA-OAEP", "RSA-OAEP-256", "A128KW", "RSA15", "A256KW", "dir", "A192KW"], "rcsresponsesigningalgvalues_supported": [ "PS384", "ES384", "RS384", "HS256", "HS512", "ES256", "RS256", "HS384", "ES512", "PS256", "PS512", "RS512" ] } ``` And the jwk endpoint: ```shell curl http://localhost:8000/openam/oauth2/realms/root/realms/test/connect/jwk_uri ``` ```json { "keys": [ { "kty": "RSA", "kid": "DkKMPE7hFVEn77WWhVuzaoFp4O8=", "use": "enc", "alg": "RSA-OAEP", "n": "i7t6m4d02dZ8dOe-DFcuUYiOWueHlNkFwdUfOs06eUETOV6Y9WCXu3D71dbF0Fhou69ez5c3HAZrSVS2qC1Htw9NkVlLDeED7qwQQMmSr7RFYNQ6BYekAtnScFHpq8Tx4BzhcDb6P0-PHCo-bkQedxwhbMD412KSM2UAVQaZ-TW-ngdaaVEs1Cgl4b8xxZ9ZuApXZfpddNdgvjBeeYQbZnaqU3b0P5YE0s0YvIQqYmTjxh4RyLfkt6sBS1obWUOC-0ChRWlpWE7QTEVEWJP5yt8hgZ5MecTmBi3yZ0ts3NsL83413NdbWYh-ChtP696mZbJozflF8jR9pewTbQ", "e": "AQAB" }, { "kty": "RSA", "kid": "4iCKFB0RXIxytor1r3ToBdRievs=", "use": "sig", "alg": "RS256", "n": "i7t6m4d02dZ8dOe-DFcuUYiOWueHlNkFwdUfOs06eUETOV6Y9WCXu3D71dbF0Fhou69ez5c3HAZrSVS2qC1Htw9NkVlLDeED7qwQQMmSr7RFYNQ6BYekAtnScFHpq8Tx4BzhcDb6P0-PHCo-bkQedxwhbMD412KSM2UAVQaZ-TW-ngdaaVEs1Cgl4b8xxZ9ZuApXZfpddNdgvjBeeYQbZnaqU3b0P5YE0s0YvIQqYmTjxh4RyLfkt6sBS1obWUOC-0ChRWlpWE7QTEVEWJP5yt8hgZ5MecTmBi3yZ0ts3NsL83413NdbWYh-ChtP696mZbJozflF8jR9pewTbQ", "e": "AQAB" }, { "kty": "RSA", "kid": "DkKMPE7hFVEn77WWhVuzaoFp4O8=", "use": "enc", "alg": "RSA-OAEP-256", "n": "i7t6m4d02dZ8dOe-DFcuUYiOWueHlNkFwdUfOs06eUETOV6Y9WCXu3D71dbF0Fhou69ez5c3HAZrSVS2qC1Htw9NkVlLDeED7qwQQMmSr7RFYNQ6BYekAtnScFHpq8Tx4BzhcDb6P0-PHCo-bkQedxwhbMD412KSM2UAVQaZ-TW-ngdaaVEs1Cgl4b8xxZ9ZuApXZfpddNdgvjBeeYQbZnaqU3b0P5YE0s0YvIQqYmTjxh4RyLfkt6sBS1obWUOC-0ChRWlpWE7QTEVEWJP5yt8hgZ5MecTmBi3yZ0ts3NsL83413NdbWYh-ChtP696mZbJozflF8jR9pewTbQ", "e": "AQAB" }, { "kty": "RSA", "kid": "DkKMPE7hFVEn77WWhVuzaoFp4O8=", "use": "enc", "alg": "RSA1_5", "n": "i7t6m4d02dZ8dOe-DFcuUYiOWueHlNkFwdUfOs06eUETOV6Y9WCXu3D71dbF0Fhou69ez5c3HAZrSVS2qC1Htw9NkVlLDeED7qwQQMmSr7RFYNQ6BYekAtnScFHpq8Tx4BzhcDb6P0-PHCo-bkQedxwhbMD412KSM2UAVQaZ-TW-ngdaaVEs1Cgl4b8xxZ9ZuApXZfpddNdgvjBeeYQbZnaqU3b0P5YE0s0YvIQqYmTjxh4RyLfkt6sBS1obWUOC-0ChRWlpWE7QTEVEWJP5yt8hgZ5MecTmBi3yZ0ts3NsL83413NdbWYh-ChtP696mZbJozflF8jR9pewTbQ", "e": "AQAB" }, { "kty": "EC", "kid": "pZSfpEq8tQPeiIe3fnnaWnnr/Zc=", "use": "sig", "alg": "ES512", "x": "AHdVKbNDHym-MiUh6caaod_ktp8PXN6g1zIKLzlaCSOZP82KKaQsfwltAKnMrw129nVx-2kt8x1J1pp1ADe9HtXt", "y": "AUqhRKcYvA6lElI3UrfqvpuhVsyEFBQ4cME9v4WGnRcpriiTVaUC7YfCtQJT9F8Oc21vi57Sp3Mq_vw5ueRd", "crv": "P-521" }, { "kty": "EC", "kid": "I4x/IijvdDsUZMghwNq2gC/7pYQ=", "use": "sig", "alg": "ES384", "x": "k5wSvW6JhOuCj-9PdDWdEA4oH90RSmC2GTliiUHAhXj6rmTdE2S-zGmMFxufuV", "y": "XfbR-tRoVcZMCoUrkKtuZUIyfCgAy8b0FWnPZqevwpdoTzGQBOXSNi6uItN_o4tH", "crv": "P-384" }, { "kty": "EC", "kid": "Fol7IpdKeLZmzKtCEgi1LDhSIzM=", "use": "sig", "alg": "ES256", "x": "N7MtObVf92FJTwYvY2ZvTVT3rgZp7a7XDtzT_9Rw7IA", "y": "uxNmyoocPopYh4k1FCc41yuJZVohxlhMo3KTIJVTP3c", "crv": "P-256" } ] } ``` OIDC does not use JWT by default, so it has to be enabled in Services > OAuth2 Provider > Use Stateless Access & Refresh Tokens. Then it needs to be configured to use public key cryptography instead of shared secret by selecting any RS cypher as "OAuth2 Token Signing Algorithm" in the Advanced tab (need to save the previous page before changing the tab). Create an Application to generate Access Token in Applications > OAuth 2.0 > Add Client. Fill all the fields with some bogus values (even the scope and default scope). Recommended way of getting the Access Token is using Insomnia - cross platform HTTP client. Use the "tokenendpoint" and "authorizationendpoint" values from the OIDC Discovery endpoint as Authorization and Access Token URL. In case you get 401 when creating the token terminate Forgerock docker and start again. After getting JWT Insomnia can make authenticated requests to APIcast. But APIcast needs the Forgerock public key, so it can verify JWT signature. The JWK endpoint from OIDC Discovery provides JWK encoded certificates. Use the one with alg RS256 and convert it to normal RSA certificate: Before it can be configured in the policy it needs to be formatted to the one line format like Keycloak uses. APIcast does OIDC Discovery only when downloading configuration from System. Passing configuration file from filesystem won't trigger that process. It is possible to mock System API by static files and a simple webserver: ```shell gem install adsf cd examples/configuration/oidc/ adsf ``` And edit `examples/configuration/oidc/admin/api/services/oidc/proxy/configs/production/latest.json` to provide the correct public key. Start keycloak: ```shell docker run -e DBVENDOR=H2 -e KEYCLOAKUSER=keycloak -e KEYCLOAK_PASSWORD=keycloak -p 8000:8080 jboss/keycloak:4.3.0.Final ``` Get OIDC Discovery: ```shell curl http://localhost:8000/auth/realms/master/.well-known/openid-configuration ``` ```json { "issuer": "http://localhost:8000/auth/realms/master", "authorization_endpoint": "http://localhost:8000/auth/realms/master/protocol/openid-connect/auth", "token_endpoint": "http://localhost:8000/auth/realms/master/protocol/openid-connect/token", "tokenintrospectionendpoint": "http://localhost:8000/auth/realms/master/protocol/openid-connect/token/introspect", "userinfo_endpoint": "http://localhost:8000/auth/realms/master/protocol/openid-connect/userinfo", "endsessionendpoint": "http://localhost:8000/auth/realms/master/protocol/openid-connect/logout", "jwks_uri": "http://localhost:8000/auth/realms/master/protocol/openid-connect/certs", "checksessioniframe": "http://localhost:8000/auth/realms/master/protocol/openid-connect/login-status-iframe.html", "granttypessupported": ["authorizationcode", "implicit", "refreshtoken", "password", "client_credentials"], "responsetypessupported": [ "code", "none", "id_token", "token", "id_token token", "code id_token", "code token", "code id_token token" ], "subjecttypessupported": ["public", "pairwise"], "idtokensigningalgvalues_supported": ["RS256"], "userinfosigningalgvaluessupported": ["RS256"], "requestobjectsigningalgvalues_supported": ["none", "RS256"], "responsemodessupported": ["query", "fragment", "form_post"], "registration_endpoint": "http://localhost:8000/auth/realms/master/clients-registrations/openid-connect", "tokenendpointauthmethodssupported": ["privatekeyjwt", "clientsecretbasic", "clientsecretpost", "clientsecretjwt"], "tokenendpointauthsigningalgvaluessupported": ["RS256"], "claimssupported": ["sub", "iss", "authtime", "name", "givenname", "familyname", "preferred_username", "email"], "claimtypessupported": ["normal"], "claimsparametersupported": false, "scopessupported": ["openid", "address", "email", "offlineaccess", "phone", "profile"], "requestparametersupported": true, "requesturiparameter_supported": true, "codechallengemethods_supported": ["plain", "S256"], "tlsclientcertificateboundaccess_tokens": true } ``` Get JWK: ```shell curl http://localhost:8000/auth/realms/master/protocol/openid-connect/certs ``` ```json { "keys": [ { "kid": "3g-I9PWt6NrznPLcbE4zZrakXar27FDKEpqRPlD2i2Y", "kty": "RSA", "alg": "RS256", "use": "sig", "n": "iqXwBiZgN2q1dCKU1PvzyiGacdQhfqgxQST7GFlWUPUljV9uHrLOadWadpxRAuskNpXWsrKoUhDxtSpUIRJj6hL5YTlrvv-IbFwPNtD8LnOfKL043ZdSOe3aT4R4NrBxUomndILUESlhqddylVMCGXQ81OB73muc9ovR68Ajzn8KzpU_qegh8iHwk-SQvJxIIvgNJCJTC6BWnwS9Bw2ns0fQOZZRjWFRVh8BjkVdqa4vCAb6zw8hpR1y9uSNG-fqUAPHy5IYQaD8k8QX0obxJ0fld61fH-Wr3ENpn9YZWYBcKvnwLm2bvxqmNVBzW4rhGEZb9mf-KrSagD5GUw", "e": "AQAB" } ] } ```