Table of Contents

OpenID Connect Provider

Presentation

OpenID Connect is a protocol based on REST, OAuth 2.0 and JOSE stacks. It is described here: http://openid.net/connect/.

LL::NG can act as an OpenID Connect Provider (OP). It will answer to OpenID Connect requests to give user identity (trough ID Token) and information (trough User Info end point).

As an OP, LL::NG supports a lot of OpenID Connect features:

Configuration

OpenID Connect Service

See OpenID Connect service configuration chapter.

IssuerDB

Go in General Parameters » Issuer modules » OpenID Connect and configure:

For example, to allow only users with a strong authentication level:
$authenticationLevel > 2

Configuration of LL::NG in Relying Party

Each Relying Party has its own configuration way. LL::NG publish its OpenID Connect metadata to ease the configuration of client.

The metadata can be found at the standard "Well Known" URL: http://auth.example.com/.well-known/openid-configuration

An example of its content:

{
   "end_session_endpoint" : "http://auth.example.com/oauth2/logout",
   "jwks_uri" : "http://auth.example.com/oauth2/jwks",
   "token_endpoint_auth_methods_supported" : [
      "client_secret_post",
      "client_secret_basic"
   ],
   "token_endpoint" : "http://auth.example.com/oauth2/token",
   "response_types_supported" : [
      "code",
      "id_token",
      "id_token token",
      "code id_token",
      "code token",
      "code id_token token"
   ],
   "userinfo_signing_alg_values_supported" : [
      "none",
      "HS256",
      "HS384",
      "HS512",
      "RS256",
      "RS384",
      "RS512"
   ],
   "id_token_signing_alg_values_supported" : [
      "none",
      "HS256",
      "HS384",
      "HS512",
      "RS256",
      "RS384",
      "RS512"
   ],
   "userinfo_endpoint" : "http://auth.example.com/oauth2/userinfo",
   "request_uri_parameter_supported" : "true",
   "acr_values_supported" : [
      "loa-4",
      "loa-1",
      "loa-3",
      "loa-5",
      "loa-2"
   ],
   "request_parameter_supported" : "true",
   "subject_types_supported" : [
      "public"
   ],
   "issuer" : "http://auth.example.com/",
   "grant_types_supported" : [
      "authorization_code",
      "implicit",
      "hybrid"
   ],
   "authorization_endpoint" : "http://auth.example.com/oauth2/authorize",
   "check_session_iframe" : "http://auth.example.com/oauth2/checksession",
   "scopes_supported" : [
      "openid",
      "profile",
      "email",
      "address",
      "phone"
   ],
   "require_request_uri_registration" : "false",
   "registration_endpoint" : "http://auth.example.com/oauth2/register"
}

Configuration of Relying Party in LL::NG

Go in Manager and click on OpenID Connect Relying Parties, then click on Add OpenID Relying Party. Give a technical label (no spaces, no special characters), like “sample-rp”;

You can then access to the configuration of this RP.

Exported attributes

You can map here the attribute names from the LL::NG session to an OpenID Connect claim.

Claim name Associated scope Type Example of corresponding LDAP attribute
sub openid string uid
name profile string cn
given_name profile string givenName
family_name profile string sn
middle_name profile string
nickname profile string
preferred_username profile string displayName
profile profile string labeledURI
picture profile string
website profile string
email email string mail
email_verified email boolean
gender profile string
birthdate profile string
zoneinfo profile string
locale profile string preferredLanguage
phone_number phone string telephoneNumber
phone_number_verified phone boolean
updated_at profile string
formatted address string registeredAddress
street_address address string street
locality address string l
region address string st
postal_code address string postalCode
country address string co

So you can define for example:

The specific sub attribute is not defined here, but in User attribute parameter (see below).

Extra Claims

By default, only claims that are part of standard OpenID Connect scopes will be sent to a client. If you want to send a claim that is not in the OpenID Connect specification, you need to declare it in the Extra Claims section

If you want to make custom claims visible to OpenID Connect clients, you need to declare them in a scope.

Add your additional scope as the Key, and a space-separated list of claims as the Value:

In this example, an OpenID Client asking for the timelord scope will be able to read the rebirth_count and bloodline claims from the Userinfo endpoint.

Any Claim defined in this section must be mapped to a LemonLDAP::NG session attribute in the Exported Attributes section

Options

Macros

You can define here macros that will be only evaluated for this service, and not registered in the session of the user.

Display