Questions tagged [openid-connect]
OpenID Connect (OIDC) is a REST-friendly protocol for the (possibly cross-domain) exchange of user identity built on top of the OAuth 2.0 and JWT specifications.
5,318
questions
0
votes
0
answers
3
views
Terraform Cloud: dynamic provider credentials and aliases
Following this example from Hashicorp, I'm struggling to understand the right way to populate Aliases for AWS Providers.
Let's assume I've got 2 AWS Roles in 2 different accounts, OIDC is configured ...
0
votes
1
answer
8
views
React SPA authentication with Azure AD B2C using implicit flow even though it's disabled
I'm trying to get this sample app, located at github, working with my Microsoft Entra ID (FKA Azure AD) IdP and MSAL 2.0. The React app is deployed as an Azure App Service. Right now though, I get the ...
0
votes
1
answer
14
views
Multiple OAuth2AuthorizedClientManagers in a single Spring Boot application in Spring Security 5.8
We are in the process of upgrading to Spring Security 5.8 in preparation for the bigger update to 6 and have the case where we require multiple AuthorizedClientManagers in a single Spring Boot ...
0
votes
2
answers
111
views
Blazor WASM OIDC authentication with Microsoft identity provider
I am trying to set up SSO with a Blazor WebAssmebly app (.NET 7).
On the Azure AD side of things, I have registered an application (SPA) with a login callback URI of https://localhost/authentication/...
0
votes
1
answer
12
views
Why can't OIDC authorization code flow be all back channel?
I've been learning OIDC, especially authorization code flow.
The front channel just gets the authorization code, and then sends this to the client's back end code which then makes a back channel call ...
0
votes
0
answers
20
views
Blazor WASM OIDC authentication issues with Google Identity Provider
I am trying to set up SSO login/logout for a Blazor WebAssembly app (.NET 7).
For the Google Identity Provider (IP):
I have set up a new app in Google Cloud APIs, and I'm using the MS example from ...
0
votes
1
answer
34
views
Local development with Spring Cloud Gateway and Keycloak for frontend developers
I have a problem with local development for our frontend developers in context of security.
Prerequisites:
Frontend App on ReactJS
Keycloak as IdP provider (OpenID Connect)
Standard authorization ...
0
votes
0
answers
15
views
What is a recommended grant expiry time in Oauth2?
We've had a longstanding bug with our app that uses the Oauth2 protocol. We have a server running Node with the oidc-provider package, and also a Redis instance which stores refresh tokens, grants etc....
1
vote
0
answers
52
views
How can I get access token in keycloak?
I want to login using authorization_code flow with keycloak.
I input correct username and password to login form, but I could NOT get tokens.
my environment
keycloak: docker with quay.io/keycloak/...
-2
votes
1
answer
25
views
OIDC1.0 SLO not working in Spring Authorization Server
I have one Spring Boot application using Spring Authorization Server 3.1.2. It is using OAuth2 and OIDC1.0 for Authentication. I have two clients one is the order-client ,and the other is product-...
1
vote
1
answer
33
views
Azure AD Front-channel logout URL and SameSite cookie in ASP.NET
I've been investigating implementing Azure AD for an old web forms ASP.NET application and came across an issue when trying to use single sign out via the Front-channel logout URL in the App ...
0
votes
0
answers
21
views
Passport OIDC Authentication Strategy Problem
I am facing an issue with my OIDC Authentication with Passport. The project is in NodeJS, Typescript. The infra of the project is microservices with a proxy forwarding the requests to the ...
0
votes
2
answers
46
views
Flask-OIDC Keycloak HTTPS Redirect on Localhost
This is the development setup I have. All host references are localhost.
I am using Flask-OIDC 2.0.3 along with Keycloak 22.0.3 (running on Docker as a service). The Flask app runs on port 8080, ...
0
votes
0
answers
24
views
Why I get System.Exception: Correlation failed in ASP.NET and angular OIDC?
I have some troubles with correct realization of OpenIdConnect (OIDC) for my angular and asp.net core api application. In my asp.net application I have installed the Microsoft.AspNetCore....
0
votes
1
answer
39
views
Why do I not get an authorization code from Cognito on successful ALB authentication?
I currently
use an AWS ALB to handle incoming traffic to my application
have Cognito set up to handle login auth at the ALB level, with federated Okta login
have response type code set
am able to ...
0
votes
1
answer
57
views
How To Share Authentication Context between C# OpenIdConnectAuthenticationExtensions Library and Microsoft Graph API
We have a C# webforms website where I am prompting the user for Azure AD authentication. I do so with the following code:
app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions()
{
...
1
vote
0
answers
25
views
CAS Delegated authentication SAML/OIDC
I'm trying to test a POC with CAS Delegated Authentication PAC4J.
The target Authentication flow is the following:
Client requests access to SP (SAML client)
SP redirects to my CAS Server (SAML IDP)
...
0
votes
1
answer
26
views
Authentication Flow with Local User Database and Identity Provider, from Web and/or Mobile device
We have a web application that supports two forms of login: one form uses an internal user database, and the other form uses either SSO or an external Identity Provider. A successful login results in ...
0
votes
0
answers
19
views
Include OpenID Connect claims to Firebase sign-in attributes
We are using Google Identity platform as an Identity provider, and we currently have two providers:
Email / Password
SAML (SSO)
We use it only as authentication. Once the user is authenticated, we ...
0
votes
0
answers
21
views
Keycloak extension for custom signed JWT Token (Keycloak 22.0.x)
I want to add an extension to the Keycloak (22.0.x) a new endpoint. That endpoint shall return a signed JWT contain certain user information. This token will be persisted by a service and later used ...
0
votes
1
answer
62
views
Multiple instances of Spring Authorization Server
I'm currently building a backend using Spring to build a backend and authenticating using Spring Authorization Server. After some trial and error, this is now working and authenticates the user with ...
0
votes
1
answer
61
views
How can I mock Authorization Code flow login in IdentityServer?
I'm trying to get a response containing the code for (future) exchange for a token. WHen I execute the following call in Postman:
GET https://localhost:7101/connect/authorize
?client_id=tyr-idp
&...
0
votes
1
answer
47
views
IdentityServer: Scope openid not found in store or not supported by requested resource indicators
I'm requesting GET following this example. In my case, it's this.
GET /connect/authorize?
client_id=tyr-idp&
scope=openid&
response_type=code&
redirect_uri=https://localhost_4200/login&...
0
votes
0
answers
43
views
Validating JWT token using x5c claim from jwks, good or bad practise?
I am implementing a Azure AD authentication scheme currently, and have been reading up on validating accesstokens, but have found conflicting information about using the certificate from the x5c claim ...
0
votes
0
answers
20
views
User Registration Fails In Keycloak
I am performing User Registration process in Django with Keycloak for which I deployed Keycloak docker container (JBoss/Keycloak Version: 16.1.1) and Python version 3.8 and Django Version 4.2.5 .When ...
0
votes
0
answers
29
views
How to Seamlessly Implement OIDC Single Sign-On in React jswith Node.js Backend?
I am new to OIDC (OpenID Connect) and need guidance on how to implement an OIDC login flow in my Angular application with a Node.js backend. below is my backend code for the OIDC flow, but I'm not ...
0
votes
2
answers
47
views
Ideas/Suggestions implementing some OpenID authentication use-case involving android app and NFC
I am working on a project where we want to integrate some additional authentication mechanism that involves mobile devices and NFC tags. As a simplification for explaining the problem, one could ...
0
votes
1
answer
35
views
Multitenancy in Quarkus: get tenant ID from SecurityIdentity instead of request path
I'm experimenting with OIDC multitenancy in Quarkus.
The examples in the official documentation use the request path to infer the tenant id and then select the OIDC config based on that.
What I want ...
0
votes
0
answers
41
views
Pull user details from UserModel in Keycloak
I have not implemented spring security with keycloak. So, SecurityContext is null. I can see that eventlisteners are able to pull the userID and userName. I am implementing a custom logging mechanism, ...
3
votes
1
answer
62
views
MinIO + OpenID (Keycloak) on AKS failed to verify TLS
Hi I am at a loss when it comes to configuring OIDC (Keycloak) with MinIO (both are deployed on same AKS cluster). I have configured an Ingress for both, both use the same wildcard cert that I got ...
0
votes
1
answer
48
views
Gitlab CI/CD error: script config should be a string or a nested array of strings up to 10 levels deep
Guys, simple ci/cd definition:
image: ansible:latest
.assume-role: &assume-role
id_tokens:
GITLAB_OIDC_TOKEN:
aud: https://gitlab.com
script:
- >
STS=($(aws sts assume-...
0
votes
0
answers
17
views
What does it mean to "disable SameSite for some components"?
In the ASP.NET documentation about SameSite cookies, is says (bold mine):
Some forms of authentication like OpenID Connect (OIDC) and WS-Federation default to POST based redirects. The POST based ...
0
votes
1
answer
14
views
What is the url expected on the open id client.callback method? How do I get the tokens?
I'm trying to implement this flow: https://github.com/panva/node-openid-client#authorization-code-flow
I've done the previous steps, but I don't understand what is the URL expected in the client....
0
votes
0
answers
33
views
Creating an EKS cluster with an OIDC provider for IRSA using eksctl
I create an AWS EKS cluster with
eksctl create cluster ...
The cluster is created and shows an OIDC provider URL
If I look in the Authentication tab it shows No oidc identity providers
Is this the ...
0
votes
1
answer
24
views
How do I use Firebase as an opendID provider in Unity?
I got the user to login using the Firebase SDK inside my Unity app
But I want to use some features inside Unity Gaming Services (UGS), and for that, the user must be logged in. The main reason I'm ...
1
vote
0
answers
36
views
Redirect to app URL in place of Authority URL (https://login.microsoftonline.com/) after deployment on QA sever
I am using AzureAD authentication in my existing application which is in ASP.NET MVC.
I have tested this application in localhost and it was working fine but when I have deployed this application in ...
0
votes
0
answers
39
views
Symfony 6.3 oidc token Handler
i got a question about OpenIdConnect in the doc they say
By default, the OidcTokenHandler creates an OidcUser with the claims. To create your own User from the claims, you must create your own ...
-1
votes
0
answers
39
views
How to migrate FilterSecurityInterceptor to AuthorizationFilter spring-security 6
I was using a very older version of spring security and wanted to migrate to the latest version of spring Security 6.1.3
While reading I was able to migrate some of it but was stuck at updating ...
0
votes
0
answers
14
views
Implementing Authentication with external provider (e.g. Twitch)
I'm developing a web application consiting of two parts: a Flask REST API as a backend and a React.js SPA as a frontend.
Now I'm at the stage of implementing authentication via an external provider (...
0
votes
0
answers
22
views
Quarkus oidc - getting userInfo as JWT
I use the quarkus-oidc for communicate with keycloak. When this library calls the userInfo endpoint, a have exception because the library expect the json response, but keycloak sends response as ...
-1
votes
1
answer
16
views
Is it possible to login an identity provider with a google account and register a different email account?
I’m looking for an open source identity provider which I can login via my google account. I.e. the idp can forward my authentication request to google. At the same time I can register a different ...
0
votes
0
answers
37
views
Approach to have a SSO like flow in mobile app web view for accessing web pages after authentication using OIDC
Have implemented OAuth2 based authentication flow using open id connect in our cross platform mobile application.
Need to access web pages within our mobile app web view/ browser but the mobile web ...
0
votes
1
answer
28
views
Modify keycloak default realm on administrative console url
On keycloak when you are trying to access the administrative console, it goes to a url https://<domain>/admin/master/console/. Which the master on the url is the default realm
Image
Is there a ...
0
votes
0
answers
39
views
Set HttpClient Basic Auth Header per client on backchannel logout in IdentityServer4 2.5.4 (.Net Core 2.1)
Remark: I know that .Net Core 2.1 is old, but at this moment I cannot update. It is planned for the future.
Situation:
One client needs a Basic Authentication header to accept the Back-Channel Logout ...
0
votes
1
answer
32
views
How do I get more claims out of my Cognito user such as email?
I have a .NET 7 Web API that I'm integrating with AWS Cognito. I expect users to supply a bearer token in order to access the endpoints.
The API does not allow users to sign in or have a sign in page ...
0
votes
0
answers
11
views
is can changed [...nextauth].ts file location? in nextauth, keycloak
redirect_uri=http%3A%2F%2F127.0.0.1%3A3000%2Fapi%2Fauth%2Fcallback%2Fhyundai
This is the keycloak redirect_uri address that appears when you press the signIn button.
I can confirm that it is api/auth/...
0
votes
0
answers
61
views
Failed on OIDC vault group
I am building a vault with oidc enabled. I have created oidc configuration and roles including group and group alias. But it turns out that I am facing an issue related to
failed to fetch groups: Get ...
0
votes
1
answer
29
views
How can I provide sub claim within access token for ClientCredentials flow?
I've run into a problem on how to add sub claim to access token for machine to machine communication (ClientCredentials flow). The reason for doing this is because AWS/GCP is adding this claim always. ...
0
votes
1
answer
105
views
Pass IDP tokens to Frontend directly from Keycloak
I am using React for front-end,
Spring boot as OAuth2 resource servers in the backend and
Keycloak as my native authorization server.
Recently I started using Keycloak so I might be missing something. ...
0
votes
1
answer
41
views
Azure AD Login flow to Blazor Server application require admin approval
"I have developed a Blazor Server application with Azure AD authorization out of the box. When I log in using my developer account, it works seamlessly. However, when I attempt to log in with ...