[WIP] docs: access token new endpoints(/login, /userinfo, /v2/logout) #64
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
**1. access token**
- Enhance the NJS Code to capture the `access_token` sent by the IdP.
- Store the `access_token` in the k/v store as same as we store `id_token` and `refresh_token`
**2. new endpoints**
- Add `/userinfo` endpoint:
- Add a map variable of `$oidc_userinfo_endpoint` as same as authz and token endpoints here (`openid_connect_configuration.conf`) .
- Expose `/userinfo` endpoint here(`openid_connect.server_conf`) in a location block of NGINX Plus to interact with IdP's `userinfo_endpoint` which is defined in the endpoint of`well-known/openid-configuration`.
- The nginx location block should proxy to the IdP’s `userinfo_endpoint` by adding `access_token` as a bearer token.
```
Authorization : Bearer <access_token>
```
- The response coming from IdP should be returned back to the caller as it is.
- Expose `/login` endpoint:
- Expose the `/login` endpoint as a location block here (`openid_connect.server_conf`)
- Proxy it to the IdP's `authorization_endpoint` configured in the map variable of `$oidc_authz_endpoint` in (`openid_connect_configuration.conf`).
- This would outsource the login function to IdP as its configured.
- Expose `/v2/logout` endpoint:
- Expose the `/v2/logout` endpoint as a location block here (`openid_connect.server_conf`)
- Add a map variable of `$oidc_end_session_endpoint` as same as authz and token endpoints here (`openid_connect_configuration.conf`) .
- Proxy it to the IdP's `end_session_endpoint` to finish the session by IdP.
- Expose `/v2/_logout` endpoint:
- Expose `/v2/_logout` endpoint which is a callback from IdP as a location block here (`openid_connect.server_conf`) to handle the following sequences.
- 1. Redirected by IdP when IdP successfully finished the session.
- 2. NGINX Plus: Clear session cookies.
- 3. NGINX Plus: Redirect to either the original landing page or the custom logout page by calling
- Add a map of `$post_logout_return_uri`: After the successful logout from the IdP, NGINX Plus calls this URI to redirect to either the original page or a custom logout page. The default is original page based on the configuration of `$redirect_base`.
**3. add endpoints in `configure.sh`**
- IdP's userinfo endpoint
- IdP's end session endpoint
…-endpoints feat: access token & new endpoints (/login, /userinfo, /v2/logout)
added doctoc for automatic toc creation broke getting started info out into new doc
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Background:
/loginendpoint/userinfoendpointdemo) in the repo of https://github.com/nginxinc/nginx-openid-connect.Description: