OIDC Inbount Identity

##Overview

In this tutorial, we will see how you can integrate inbound external oauth2 provider authentication in the Janssen server. If you are looking for social login support then check out passport module for that.

We will use interception authentication script for whole flow. Currently, It supports Authorization Code Flow and client_secret_post token endpoint auth method.

Authentication Flow

You can add any external OAuth2 server authentication option and add authenticated users to your Janssen server A.K.A. Inbound-identity.

mermaid
sequenceDiagram

title OIDC Inbound Identity Flow

participant browser as Browser
participant rp as RP
participant jans as Jans Authz Server
participant eidp as External Provider

autonumber
browser->>rp: Request page
browser->>jans: Invoke /authorize endpoint
jans->>browser: Present "Login with OAuth2" button
browser->>browser: User click on button
browser->>eidp: Redirect login request
loop n times - (multistep authentication)
eidp->>browser: Present login screen
browser->>eidp: Present login credentials
end
eidp->>eidp: Authenticate user
eidp->>jans: Redirect to callback url with success response(code)
jans->>jans: Validate code, id_token, userinfo
opt if new user
jans->>jans: Dynamic enrollment or registration
end
jans->>jans: Create internal Jans session
jans->>rp: Redirect with Success response
rp->>rp: Validate response
rp->>browser: Page is accessed

Prerequisites

• A Jans-auth Server (installation instructions here)
• The external oauth2 server authentication script
• External OAuth2 Provider credentials: you can choose any external OP server that follows OAuth2 standards and authentication features.
• RP application: This is your application that will be used by your users and where you want to add this auth feature.

Configure Janssen server

1. Add Custom Script

• Download script from here.

• This script needs to accept one property oidc_creds_file. which is a JSON file with your external oauth2 server details

// oidc_creds_file: /opt/oidc.json
{
   "op_server": "https://your.external.oauth2.server",
   "client_id": "xxxxxxxxxxxxxxxx-xxxxx-external-oauth2",
   "client_secret": "xxxxxxxxxxxxxx-xxxxx-external-oauth2",
   "authorization_uri": "https://your.external.oauth2.server/xx/xxxx",
   "token_uri": "https://your.external.oauth2.server/oauth/xx/xxx",
   "userinfo_uri": "https://your.external.oauth2.server/xxx/xxx",
   "redirect_uri": "https://your.jans.server/jans-auth/postlogin.htm",
   "scope": "openid profile email",
   "auto_redirect": false,
   "title": "Login with OAuth2"
}

Property	Description
op_server	Your external OAuth2 server FQDN
client_id	Client id of your external OAuth2 server
client_secret	Client secret of your external OAuth2 server
authorization_uri	Authorization endpoint of your external OAuth2 server
token_uri	Token endpoint of your external OAuth2 server
userinfo_uri	Userinfo endpoint of your external OAuth2 server
redirect_uri	Sample: https://<your.jans.server>/jans-auth/postlogin.htm, This is redirect URL where your OAuth2 server redirect back with code. Use this same URL to configure redirect urls at your external OAuth2 server.
scope	OAuth scopes
auto_redirect	If true, it will automatically redirect to external OAuth2 server otherwise you will get one button on jans login page.
title	This property is used to set text for a button which is shown on jans login page

3. Download oidc-jans-login.xhtml from here and place it here /opt/jans/jetty/jans-auth/custom/pages/auth/oidc/. If folders are not there then create them in the same order. Rename it to oidc.xhtml.

4. Follow these instructions to add script in jans server. In the name field, you can add oidc. This name will be your acr value.

5. Restart jans-auth server service jans-auth restart

Testing at RP application

RP(Relying party) is an application that will be used by your users when you want to add authentication and protect resources. Once you initiate auth request from your RP Application make sure to add acr_values=oidc in the request. acr_values is your script name as configured above.