Skip to content

Commit 762fe11

Browse files
author
Justin Richer
committed
Update README.md
removed outdated configuration information and pointed to wiki, closes mitreid-connect#561
1 parent 7b1477c commit 762fe11

File tree

1 file changed

+2
-123
lines changed

1 file changed

+2
-123
lines changed

‎openid-connect-client/README.md‎

Lines changed: 2 additions & 123 deletions
Original file line numberDiff line numberDiff line change
@@ -4,130 +4,9 @@
44

55
This project contains an OpenID Connect Client implemented as a Spring Security AuthenticationFilter. The client facilitates a user's authentication into the secured application to an OpenID Connect Java Spring Server following the OpenID Connect Standard protocol.
66

7-
For an example of the Client configuration, see the [Simple Web App] project.
8-
97
## Configuring ##
108

11-
Configure the client by adding the following XML to your application context security making changes where necessary for your specific deployment.
12-
13-
Open and define an HTTP security configuration with a reference to a custom ***AuthenticationEntryPoint***, described below:
14-
15-
<security:http auto-config="false" use-expressions="true" disable-url-rewriting="true" entry-point-ref="authenticationEntryPoint" pattern="/**">
16-
17-
Specify the access attributes and/or filter list for a particular set of URLs needing protection:
18-
19-
<security:intercept-url pattern="/**" access="hasAnyRole('ROLE_USER','ROLE_ADMIN')" />
20-
21-
Indicate that ***OIDCAuthenticationFilter*** authentication filter should be incorporated into the security filter chain:
22-
23-
<security:custom-filter before="PRE_AUTH_FILTER" ref="openIdConnectAuthenticationFilter" />
24-
25-
Then close the HTTP security configuration:
26-
27-
</security:http>
28-
29-
Define a custom ***AuthenticationEntryPoint*** to use a login URL via a bean declaration:
30-
31-
<bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
32-
<property name="loginFormUrl" value="/openid_connect_login" />
33-
</bean>
34-
35-
NOTE: The ***loginFormUrl*** value is post-pended to the URI of the application being secured to define the ***redirect_uri***, the value passed to the OIDC Server and, if the ***OIDCAuthenticationUsingChooserFilter*** is configured, also the Account Chooser Application.
36-
37-
Define an ***AuthenticationManager*** with a reference to a custom authentication provider, ***OpenIDConnectAuthenticationProvider***:
38-
39-
<security:authentication-manager alias="authenticationManager">
40-
<security:authentication-provider ref="openIDConnectAuthenticationProvider" />
41-
</security:authentication-manager>
42-
43-
Define the custom authentication provider. Note that it does not take a UserDetailsService as input at this time but instead makes a call to the UserInfoEndpoint to fill in user information.
44-
45-
<bean id="openIdConnectAuthenticationProvider" class="org.mitre.openid.connect.client.OIDCAuthenticationProvider" />
46-
47-
### Configuring the OIDCAuthenticationFilter ###
48-
49-
The ***OIDCAuthenticationFilter*** filter is defined with the following properties:
50-
51-
****authenticationManager*** -- a reference to the ***AuthenticationManager***
52-
****errorRedirectURI*** -- the URI of the Error redirect
53-
54-
Additionally, it contains a set of convenience methods to pass through to parameters on the ***OIDCServerConfiguration*** object that defines attributes of the server that it connects to:
55-
56-
* ***issuer*** -- the root issuer string of this server (required)
57-
* ***authorizationEndpointUrl*** -- the URL of the Authorization Endpoint (required)
58-
* ***tokenEndpointUrl*** -- the URL of the Token Endpoint (required)
59-
* ***jwkSigningUrl*** -- the URL of the JWK (public key) Endpoint for token verification
60-
* ***clientId*** -- the registered client identifier (required)
61-
* ***clientSecret*** -- the registered client secret
62-
* ***userInfoUrl*** -- the URL of the User Info Endpoint
63-
* ***scope*** -- space-separated list of scopes; the required value "openid" will always be prepended to the list given here
64-
65-
Configure like so:
66-
67-
<bean id="openIdConnectAuthenticationFilter"
68-
class="org.mitre.openid.connect.client.PlainOIDCAuthenticationFilter">
69-
<property name="authenticationManager" ref="authenticationManager" />
70-
<property name="errorRedirectURI" value="/login.jsp?authfail=openid" />
71-
<property name="issuer" value="http://server.example.com:8080/openid-connect-server/" />
72-
<property name="authorizationEndpointUrl" value="http://sever.example.com:8080/openid-connect-server/openidconnect/auth" />
73-
<property name="tokenEndpointUrl" value="http://sever.example.com:8080/openid-connect-server/openidconnect/token" />
74-
<property name="jwkSigningUrl" value="http://server.example.com:8080/openid-connect-server/jwk" />
75-
<property name="clientId" value="someClientId" />
76-
<property name="clientSecret" value="someClientSecret" />
77-
<property name="userInfoUrl" value="http://server.example.com:8080/open-id-connect-server/userinfo" />
78-
<property name="scope" value="profile email address phone" />
79-
</bean>
80-
81-
### Configuring the OIDCAuthenticationUsingChooserFilter ###
82-
83-
For talking to multiple IdPs using an Account chooser, the ***OIDCAuthenticationUsingChooserFilter*** can be configured and used. [The Client -- Account Chooser protocol] documentation details the protocol used between the Client and an Account Chooser application.
84-
85-
The ***OIDCAuthenticationUsingChooserFilter*** Authentication Filter has the following properties:
86-
87-
****authenticationManager*** -- a reference to the ***AuthenticationManager***,
88-
****errorRedirectURI*** -- the URI of the Error redirect,
89-
* ***accountChooserURI*** -- to denote the URI of the Account Chooser, and
90-
* ***accountChooserClient*** -- to identify the Client to the Account Chooser UI application.
91-
* ***oidcServerConfigs*** -- a map of ***OIDCserverConfiguration***s to encapsulate the settings necesary for the client to communicate with each respective OIDC server,
92-
93-
Each ***OIDCServerConfiguration*** entry in ***OIDCserverConfiguration*** map is keyed to the ***issuer*** returned from the Account Chooser Application and enumerates the following properties:
9+
For an example of the Client configuration, see the [Simple Web App](https://github.com/mitreid-connect/simple-web-app) project.
9410

95-
****authenticationManager*** -- a reference to the ***AuthenticationManager***,
96-
* ***issuer*** -- the root issuer string of this server (required)
97-
* ***authorizationEndpointUrl*** -- the URL of the Authorization Endpoint (required)
98-
* ***tokenEndpointUrl*** -- the URL of the Token Endpoint (required)
99-
* ***jwkSigningUrl*** -- the URL of the JWK (public key) Endpoint for token verification
100-
* ***clientId*** -- the registered client identifier (required)
101-
* ***clientSecret*** -- the registered client secret
102-
* ***userInfoUrl*** -- the URL of the User Info Endpoint
103-
* ***scope*** -- space-separated list of scopes; the required value "openid" will always be prepended to the list given here
11+
Full documentation is available on the [project documentation wiki pages](https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/wiki/Client-configuration).
10412

105-
Configure like so:
106-
107-
<bean id="openIdConnectAuthenticationFilter"
108-
class="org.mitre.openid.connect.client.OIDCAuthenticationUsingChooserFilter">
109-
<property name="errorRedirectURI" value="/login.jsp?authfail=openid" />
110-
<property name="authenticationManager" ref="authenticationManager" />
111-
<property name="accountChooserURI" value="http://sever.example.com:8080/account-chooser" />
112-
<property name="accountChooserClientID" value="FGWEUIASJK" />
113-
<property name="oidcServerConfigs">
114-
<map>
115-
<entry key="http://sever.example.com:8080/Fopenid-connect-server">
116-
<bean class="org.mitre.openid.connect.client.OIDCServerConfiguration">
117-
<property name="issuer" value="http://server.example.com:8080/openid-connect-server/" />
118-
<property name="authorizationEndpointUrl" value="http://sever.example.com:8080/openid-connect-server/openidconnect/auth" />
119-
<property name="tokenEndpointUrl" value="http://sever.example.com:8080/openid-connect-server/openidconnect/token" />
120-
<property name="jwkSigningUrl" value="http://server.example.com:8080/openid-connect-server/jwk" />
121-
<property name="clientId" value="someClientId" />
122-
<property name="clientSecret" value="someClientSecret" />
123-
<property name="userInfoUrl" value="http://server.example.com:8080/open-id-connect-server/userinfo" />
124-
<property name="scope" value="profile email address phone" />
125-
</bean>
126-
</entry>
127-
<entry key=". . .
128-
</map>
129-
</property>
130-
</bean>
131-
132-
[The Client -- Account Chooser protocol]: https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/blob/master/account-chooser/docs/protocol.md
133-
[Simple Web App]: https://github.com/mitreid-connect/simple-web-app

0 commit comments

Comments
 (0)