Configuring OAuth authentication
Solution Hub has the possibility to use the OpenID protocol for the log in process. OpenID is an open, decentralized protocol for authentication on the internet, allowing users to sign in to multiple websites using a single identity. It leverages the concept of single sign-on, where a user gains access to multiple services after a single authentication. OpenID utilizes URLs as identifiers and enables users to verify their identity through OpenID providers. OpenID is an extension to the OAuth protocol and is used by Solution Hub. In the further Documentation the term OAuth will be used more often as it is the more common name and often used as synonym for OpenID.
Difference between OAuth and OpenID
OAuth and OpenID are two distinct protocols commonly used together to enable authentication and authorization in web application. OAuth is an authorization protocol that allows an application to access resources on behalf of a user without needing to know the user's password. It facilitates secure and standardized authorization between different services.
On the other hand, OpenID is an authentication protocol that allows a user to sign in to a website or application using their existing credentials, without creating a new user account. It enables the use of a single identity (Single Sign-On) across different services. OAuth focuses on granting access to protected resources, while OpenID focuses on verifying the user's identity.
Together, OAuth and OpenID provide a comprehensive solution for both authorization and authentication, ensuring secure access to resources while simplifying the user experience across multiple services.
Configuration of the authentication mode
The settings for this configuration can be found in the file config/environment_settings.xml within the group oauth
OAuth Attributes
| Attribute | Description |
|---|---|
authflow.grantType | The Grant Type defines the actual OAuth flow. PASSWORD (legacy): User enters credentials in Solution Hub, which are forwarded to the authorization server. Not recommended due to vulnerabilities. AUTHORIZATION_CODE: Recommended. Redirects to Identity Provider for login. Authorization code is exchanged for JWT. |
authflow.authenticationEndpoint | URL to an authentication endpoint of the identity provider. If empty, OAuth is disabled. |
authflow.tokenEndpoint | URL to a token endpoint of the identity provider. If empty, OAuth is disabled. |
authflow.logoutEndpoint | URL to log out from the identity provider. |
authflow.userName.attribute | Attribute that carries the username. |
authflow.clientID | Identifier of the client at the identity provider. |
authflow.clientSecret | Secret generated by the identity provider. |
authflow.clientScope | Limits application's access to a user's account. |
authflow.localRedirectUrl | Redirect URL after successful authorization code flow. |
authflow.additionalProperties | Comma-separated key-value pairs added to the auth server URL. |
authflow.proxy.host | Proxy host name. Empty value disables proxy mode. |
authflow.proxy.port | Proxy port. |
authflow.proxy.authType | Proxy authentication scheme. |
authflow.proxy.user | Username for proxy auth. |
authflow.proxy.password | Password for proxy auth. |
authflow.http.connectTimeout | Timeout for connecting to remote peer. |
authflow.http.readTimeout | Timeout for socket read operations. |
authflow.http.ciphers | Cipher Suites for TLS (comma separated). |
authflow.http.certificate | X509-certificate in Base64 or file reference format file:/absolute-path. |
authflow.http.checkValidity | Validity check for certificate expiration. |
authflow.http.checkCertChain | Verifies certificate chain signatures. |
authflow.http.checkSignersAgainstTrustStore | Verifies signer is in the trust store. |
authflow.http.checkPeerAgainstTrustStore | Verifies remote peer certificate is in trust store. |
Configuration for validation of a JWT token
| Attribute | Description |
|---|---|
verify.plainAuthenticationServerUrl | URL to the certificate endpoint of an identity provider. Used to obtain public key. |
verify.keyIdentityProvider | Key for JWT validation. Supports JWK, Base64 X509, public-keys, and file references. |
verify.jwtKeyAlgorithm | Algorithm used for JWT token verification. |
verify.http.connectTimeout | Timeout for connecting to remote peer. |
verify.http.readTimeout | Timeout for socket read operations. |
verify.http.ciphers | Cipher Suites for TLS (comma separated). |
verify.http.certificate | X509-certificate in Base64 or file reference format file:/absolute-path. |
verify.http.checkValidity | Validity check for certificate expiration. |
verify.http.checkCertChain | Verifies certificate chain signatures. |
verify.http.checkSignersAgainstTrustStore | Verifies signer is in the trust store. |
verify.http.checkPeerAgainstTrustStore | Verifies remote peer certificate is in trust store. |
Solution Hub OAuth-Servlets
In the OAuth authentication flow, the service represents the client and must provide two endpoints used to exchange information between the service and the identity provider. These URLs require proper IP configuration.
| URL | Description |
|---|---|
*/oauth/redirect | Sends the code request to the identity provider. Invoke this URL to begin authorization flow. |
*/oauth/callback | Callback URL that receives the authorization code and requests the JWT. |
* stands for the monitor URL, e.g., http://localhost:8090/monitor