Connector - OpenID Connect (SSO - SLO)

Context:

This purpose of this documentation is to document the interactions between Edifice and third party clients via OpenId Connect (OIDC).

Headlines:

• Authentication Flow

  • Authenticate users via Edifice

• Test OIDC access to your application client

  • Retrieve generation token code

  • Retrieve token

  • Retrieve standard attributes in accordance with OpenId Connect

• OIDC Back-chanel Logout and Single-Logout (SLO)

• References

Authentication Flow:

Edifice has supports the following flows:

• Authorization Code

• Resource Owner Password

• Client Credential

1 - Authenticate users via EDIFICE:

If you are a publisher or an application user, request Edifice Support to register your application, also note that Edifice does not support Dynamic client registration

Create a new connector of type OAuth 2.0 from the admin console

Fields to configure from Edifice:

• Identifier: [client_id] this is your unique identifier oAuth2

• URL: Thew external address to which you wish to access.

• openId: ???

• Scope: Access authorization to user info from the external application which is has to be openId.

• Identification Mode: Use code for a web application and password for a mobile application.

• Client secret: Parameter used to secure communication.

Configuration from third-party side:

• Fetch the temporary code using: https://domaine.ent/auth/oauth2/code

• Fetch token using: https://domaine.ent/auth/oauth2/token

• Fetch user infos: https://domaine.ent/auth/oauth2/userinfo

• Client_id: “identifier“ field

• Client_secret

• Scope

2 - Test OIDC access to your application client:

1 - Retrieve generation token code

From your browser, enter the URL valid for your use case. You will then be redirected towards the service URL with the response code included in the parameter URL.

Note that If the user is not connected to the Edifice platform he will be redirected automatically to the login page.

• URL example:

The response should look like the following:

2- Retrieve Token

The ID token, used to authenticate the user, is retrieved along with the Access Token when the scope ‘openid’ is used.

Aside from the required fields stated in section 2 of the OIDC official doc., the ID Token also includes the following:

• sub : User Id

• email : User email address if it exists

• name : User display name

Using a request client HTTP such as cUrl, Postman, Insomnia etc … We can get the Token needed in order to proceed with the authentication procedure by following these steps:

• Example with cUrl:

• Response after a successful request:

3- Retrieve standard attributes in accordance with OpenId Connect

Here are some useful attributes obtained from the UserInfo request:

• sub: User ID.

• name: Display name

• given_name: Name.

• family_name: Last name.

• preferred_username: Shorthand name by which the End-User wishes to be referred to.

• email: User email address.

• phone_number: User phone number.

Here you can find the full list of attributes provided

In order to access these attributes, it’s necessary to add the parameter GET ‘version=oidc1.0’ to the standard request.

• Example:

The user should be redirected towards the third party URL with the userInfos

3 - OIDC Back-Channel Logout and Single Logout (SLO)

Edifice Admin setup:

In the connectors section linked to the selected structure in the admin console add the logout URL in order to receive the user logout infos from your Identity system provider.

Open

field in the admin panel of the ENT

Fetch User Logout Token :

After verification, each service associated receives a logout token in JWT format via Logout URL already filled in the admin panel.

The response is in JSON encoded base 64 and signed with a public Key. After decryption it contains the user infos.

Response after decryption:

References:

• OpenID Connect full official documentation: https://openid.net/specs/openid-connect-core-1_0.html

• OpenID Connect Authentication using Authorization Code Flow: https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth

• OpenID Connect Dynamic Client Registration: https://openid.net/specs/openid-connect-registration-1_0.html

• OpenID Connect ID Token required fields : https://openid.net/specs/openid-connect-core-1_0.html#IDToken

• OpenID Connect List of provided attributes: https://openid.net/specs/openid-connect-core-1_0.html#Claims

• OpenID Connect Back-Channel logout actions: https://openid.net/specs/openid-connect-backchannel-1_0.html#BCActions

• Edifice Support Page: https://edifice.io/contact/