IBM Verify

 View Only
Expand all | Collapse all

OIDC - Discovery endpoint

  • 1.  OIDC - Discovery endpoint

    Posted Fri January 11, 2019 02:37 AM
    Hello, 

    I have a question regarding the OpenID Connect Spec in ISAM for a OP scenario where ISAM is acting as a OP Provider against Amazon web services. 

    Do anybody know how to enable or configure the ISAM OIDC discovery endpoint so it comforts the /.well-known/openid-configuration requirements? When you configure a OIDC endpoint via API protection the metadiscovery endpoint is automatically set in ISAM but a requirement from AwS IAM is to have the metadata endpoint as:

    https://web-reverse-proxy.com/.well-known/openid-configuration

    Has anybody in the community successfully setup and configured this? Any assistance would be appreciated.

    Thanks

    Best regards
    Magnus

    ------------------------------
    Magnus
    ------------------------------


  • 2.  RE: OIDC - Discovery endpoint

    Posted Fri January 11, 2019 02:50 AM
    The OpenID Connect Discovery 1.0 incorporating errata set 1 reference:

    https://openid.net/specs/openid-connect-discovery-1_0.html

    ------------------------------
    Magnus Bengtsson
    ------------------------------

    Original Message


  • 3.  RE: OIDC - Discovery endpoint

    Posted Fri January 11, 2019 05:47 AM
    Hello,

    You should use the HTTP Transformation capability in the SAM Reverse Proxy to match on the "well known" endpoint and modify the request so that it ends up at the SAM-specific endpoint on AAC junction.

    I'm afraid I don't have example XSL for this to hand but perhaps someone else on this forum can provide for us.

    Cheers... Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message


  • 4.  RE: OIDC - Discovery endpoint

    Posted Mon January 14, 2019 02:39 AM
    This will do the replace of a found pattern in the URI, keeping everything before and after the match.
    Update the path_to_match and path_to_replace with your values.  

    <?xml version="1.0" encoding="UTF-8"?>
    <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
    <xsl:variable name="path_to_match" select="'match'"/>
    <xsl:variable name="path_to_replace" select="'replace'"/>
    <!--Firstly, strip any space elements -->
    <xsl:strip-space elements="*"/>
    <xsl:variable name="path" select="//HTTPRequest/RequestLine/URI"/>
    <xsl:template match="/">
    <xsl:choose>
    <xsl:when test="contains($path,$path_to_match)">
    <!-- Call rewrite template -->
    <HTTPRequestChange>
    <xsl:apply-templates select="//HTTPRequest/RequestLine/URI"/>
    </HTTPRequestChange>
    </xsl:when>
    </xsl:choose>
    </xsl:template>
    <xsl:template match="//HTTPRequest/RequestLine/URI">
    <xsl:variable name="before" select="substring-before($path, $path_to_match)"/>
    <xsl:variable name="after" select="substring-after($path, $path_to_match)"/>
    <xsl:variable name="newuri" select="concat($before, $path_to_match, $after)"/>
    <URI>
    <xsl:value-of select="$newuri" disable-output-escaping="yes"/>
    </URI>
    </xsl:template>
    </xsl:stylesheet>

    ------------------------------
    Scott Andrews
    ------------------------------

    Original Message


  • 5.  RE: OIDC - Discovery endpoint

    Posted Mon January 14, 2019 03:24 AM

    Hello Scott,

    Thanks, will check that!

    Best regards
    Magnus



    ------------------------------
    Magnus Bengtsson
    ------------------------------

    Original Message


  • 6.  RE: OIDC - Discovery endpoint

    Posted Mon January 14, 2019 02:43 AM
    Edited by Peter Volckaert Mon January 14, 2019 07:56 AM
    Hi,

    Or alternatively, as a quick-but-not-so-dirty-fix, you can simply put the openid_configuration where you want it to be and how you want it to be. So in: https://web-reverse-proxy.com/.well-known/openid-configuration. I have noticed that the openid_configuration generated by ISAM may lack certain fields and/or has too much entries (for example when talking about keys). So it is likely you will end up changing the openid_configuration to your likings anyway.

    == Update ==
    To do this you must create a extra folder in the management root of your Reverse Proxy. So using Secure Web Settings -> Manage Reverse Proxy -> Manage Management Root -> select "Junction Root" -> File/New/Directory to create the directory .well_known directory. And then similarly create a file openid_configuration where you put exactly what you want openid_configuration to be. And of course you must set the ACL's right so that the file is e.g. publicly available.
    == End of Update ==

    Kind regards, Peter.

    ------------------------------
    Peter Volckaert
    Sales Engineer
    IBM Security
    ------------------------------

    Original Message


  • 7.  RE: OIDC - Discovery endpoint

    Posted Mon January 14, 2019 10:19 AM
    Hello Peter,

    Thanks!

    I have implemented this in the meanwhile when Im looking into the http transformation rule. We are thinking of going down that route so the configuration is only at one place and also if we change any settings we dont need to update it manually.

    Best regards
    Magnus

    ------------------------------
    Magnus Bengtsson
    ------------------------------

    Original Message


  • 8.  RE: OIDC - Discovery endpoint

    Posted Tue April 28, 2020 07:35 AM
    Hi peter/Folks,

    I am working on 9.0.0 where Discovery is under limitation. But, the solution peter is saying would work in 9.0.0 ?
    It would be helpful to integrate an Application which supports only OpenID Connect. We have ISAM 9.0.0 version upgrade but it would take considerable amount of time


    Thanks,
    Usman

    ------------------------------
    UsmanAli Shaik
    ------------------------------

    Original Message


  • 9.  RE: OIDC - Discovery endpoint

    Posted Thu April 30, 2020 03:30 AM
    Edited by Peter Volckaert Thu April 30, 2020 03:31 AM
    Hi Usman,

    Yes, this work-around will also work on 9.0.0 since it's just a file exposed in the WebSEAL's web space.

    Kind regards, Peter

    ------------------------------
    Peter Volckaert
    Senior Sales Engineer
    Authentication and Access
    IBM Security
    ------------------------------

    Original Message


  • 10.  RE: OIDC - Discovery endpoint

    Posted Thu April 30, 2020 05:26 AM
    Hi Peter,

    Thanks a bunch for adding light for hope to achieve it.

    I m doing a lab on it. I have two versions 9.0.3 and 9.0.7

    9.0.3 is having complete setup to test the discovery url and its output.

    Firstly took the metadata.json file from 9.0.7 File Download under oidc_op_confroance zip.

    Then followed the steps you provided on 9.0.3 and pasted the metadata.json file content into openid-configuration in 9.0.3


    accessed the url   https://web-reverse-proxy.com/.well-known/openid-configuration 
    but output is return the file content only not the compiled one.


    Am i missing still something !! any help here please to fix it.

    Thanks,
    usman



    ------------------------------
    UsmanAli Shaik
    ------------------------------

    Original Message


  • 11.  RE: OIDC - Discovery endpoint

    Posted Thu April 30, 2020 09:59 AM
    Hi Peter,

    I have two instances of ISAM 9.0.3 and 9.0.7

    From  9.0.7 instance downloaded oidc_op_conformance.zip and from there took metadata.json file

    Then went to 9.0.3 and followed your steps by pasting the metadata.json file content into it.

    Created openID connect provider ISAMOP and partner in it also. Tried to access the url 

    https://web-reverse-proxy.com/.well-known/openid-configuration then it returned the file content as it is in openid-configuration file not the compiled output

    Any light here please.


    Thanks,
    Usman





    ------------------------------
    Ujjwal Kumar
    ------------------------------

    Original Message


  • 12.  RE: OIDC - Discovery endpoint

    Posted Thu April 30, 2020 12:20 PM
    Edited by Gianluca Gargaro Thu April 30, 2020 12:29 PM
    Hello Ujjwal 

    what you miss probably is a transformation rule on response that set correct application/json  content-type

    so create a  file named openid-configuration under /.well-known directory ( that also need to be created ) with the json object you need .. like this





    create a transformation rule for Response that has  the following content ( you can name it oauth-info-transf.xslt ) :

    <?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">

  <xsl:strip-space elements="*" />

  <xsl:template match="/">
    <HTTPResponseChange>
      <xsl:apply-templates />
    </HTTPResponseChange>
  </xsl:template>

  <xsl:template match="//HTTPResponse/Headers/Header">
    <xsl:choose>
      <xsl:when test="Header/@name='content-type'"/>
      <xsl:otherwise>
        <Header action="update" name="content-type">application/json</Header>
      </xsl:otherwise>
    </xsl:choose>
  </xsl:template>

</xsl:stylesheet>​



    and in the webseal conf add the following :


    [http-transformations]


    oauth-infoservice = oauth-info-transf.xslt


    [http-transformations:oauth-infoservice]
    request-match = response:GET /.well-known/*





    this will create a response like if you go to the metadata endpoint :













    ------------------------------
    Gianluca Gargaro
    IBM
    Roma
    ------------------------------

    Original Message


  • 13.  RE: OIDC - Discovery endpoint

    Posted Mon May 04, 2020 06:25 AM
    Hi Gianluca,

    Thanks for your time to help us.

    There is no way that this file would be calculated/compiled by ISAM and populate the respective attributes with their values in the JSON response ?

    My understanding in 9.0.7 its happening automatically or there also would be hard-coding manually ?


    Thanks,
    Usman

    ------------------------------
    UsmanAli Shaik
    ------------------------------

    Original Message


  • 14.  RE: OIDC - Discovery endpoint

    Posted Mon May 04, 2020 06:56 AM
    Hello Usman

    yes , since 9040 we expose the oauth metadata endpoint

    https://www.ibm.com/support/knowledgecenter/SSPREK_9.0.4/com.ibm.isam.doc/config/concept/OAuthEndpoints.html


    As you can see in my second screenshot,  that content has been created automatically when I hit the https://server.oauth.com/mga/sps/oauth/oauth20/metadata/<Definition_Name> endpoint ( in my case the definition name is OIDC but is just an example ) .

    What I did for you is to copy that json response and place it in an "hardcoded" file uder webseal document root so that you can get it via  https://web-reverse-proxy.com/.well-known/openid-configuration

    Now if you use ISAM 9.0.4.0 and above and you still would like to have that metadata json by using https://web-reverse-proxy.com/.well-known/openid-configuration 
     you can still use an http tranformation rule that change the request from https://web-reverse-proxy.com/.well-known/openid-configuration   to https://web-reverse-proxy.com/mga/sps/oauth/oauth20/metadata/<Definition_Name> 




    ------------------------------
    Gianluca Gargaro
    IBM
    Roma
    ------------------------------

    Original Message