1 of 37

OpenID Connect

Michal Prochazka, Dominik Bucik

AAI workshop 11 September 2018

​

European Life Sciences Infrastructure for Biological Information

www.elixir-europe.org

European Life Sciences Infrastructure for Biological Information

www.elixir-europe.org

2 of 37

Outline

  • Registration into the ELIXIR Test Environment
  • How to setup and connect service into the ELIXIR test env
    • Existing applications with OIDC support
    • Web service on a server
      • Apache module mod_auth_openidc
    • JavaScript client in a browser
    • Own implementation
  • Registration procedure to production environment

3 of 37

Registration into the ELIXIR Test Environment

www.elixir-europe.org

4 of 37

Obtaining the ELIXIR ID

  • Visit LS Login Test registration page

​

​

  • Someone of you already have an account

​

https://signup.aai.lifescience-ri.eu/registrar/?vo=lifescience_test

5 of 37

Service Registration

  • Write an email to aai-contact@elixir-europe.org with request to register your service into the ELIXIR test env.

​

  • You will receive a link to the Google docs form
    • Fill as much as possible
    • Name, description, contacts and technical details (attributes, scopes) are required�
  • After the approval from ELIXIR AAI
    • Only users from ELIXIR test virtual organization can access your service
    • OR you can select which groups will have an access from ELIXIR test virtual organization
      • You can manage group yourself

6 of 37

Application with OIDC support

www.elixir-europe.org

7 of 37

Required configuration options

  • Authorization Code Flow (server side apps)
    • Client ID
    • Client secret
    • Redirect URIs
    • Scopes

​

  • Implicit Code Flow (JavaScript based apps)
    • Client ID
    • Redirect URIs
    • Scopes

8 of 37

Register service

  • Visit https://login.elixir-czech.org/oidc/
  • Choose Self-service Client Registration

9 of 37

Register service in MITREid (2)

  • In the Main tab fill „Name“
    • Put there a name of the assigned virtual machine

​

  • and „Redirect URIs“

​

​

  • In the Access tab in „Grant Types“ choose „authorization code“
  • ​
  • Store Client ID and Client secret (will be used later)

https://[your machine]/oauth2callback

10 of 37

Step 1 - Main tab

Callback: https://[your machine]/oauth2callback

11 of 37

Step 2 - Access tab

12 of 37

Web service on a server

www.elixir-europe.org

13 of 37

Web service on server

  • Apache module which protects your application
    • Application doesn’t need to be aware of federated login
    • Useful for closed source applications
    • Data are available via environment variables

  • Installation of an Apache mod_auth_openidc
    • In Debian 9 version 2.1.6 is included, in Debian testing 2.3.3
    • We recommend to use latest version

14 of 37

Web service on server

  • Install dependencies and necessary software

​

  • Download latest version of libcjose and mod-auth-openidc

​

​

​

​

​

  • Install packages

​

​

#> apt install apache2 git vim wget libjansson4 libhiredis0.13 libcurl3

#> wget https://github.com/zmartzone/mod_auth_openidc/releases/download/v2.3.0/libcjose0_0.5.1-1.stretch.1_amd64.deb

#> wget https://github.com/zmartzone/mod_auth_openidc/releases/download/v2.3.3/libapache2-mod-auth-openidc_2.3.3-1.stretch.1_amd64.deb

#> dpkg -i libcjose0_0.5.1-1.stretch.1_amd64.deb libapache2-mod-auth-openidc_2.3.3-1.stretch.1_amd64.deb

15 of 37

Web service on server

  • Enable modules in Apache

​

  • Restart Apache

​

  • Check Apache configuration

​

​

​

​

​

​

#> a2enmod auth_openidc cgi ssl

#> apache2ctl -t

Syntax OK

#> systemctl restart apache2

16 of 37

Configure Apache

OIDCProviderMetadataURL https://login.elixir-czech.org/oidc/.well-known/openid-configuration�OIDCProviderMetadataRefreshInterval 3600�OIDCClientID b2bc0708-ec82-418b-a727-42526a99f29c # (fill yours)�OIDCClientSecret Eowd2VeXuJ88eFpaEowd2VeXuJ88eFpaEowd2VeXuJ88eFpa # (fill yours)�OIDCScope "openid profile"�OIDCRedirectURI /oauth2callback�OIDCCryptoPassphrase randompassword�

<Location /oauth2callback>� #non-existent location for returning from OIDC server� AuthType openid-connect� Require valid-user� </Location>� <Location /cgi-bin/>� #actually protected URLs� AuthType openid-connect� Require valid-user� </Location>

​

17 of 37

Configure Apache

  • Open configuration file from Apache

​

​

  • Append text from the previous slide at the end of the file before the </VirtualHost> tag
  • Enable the configuration file and restart Apache

​

​

​

#> nano /etc/apache2/sites-available/default-ssl.conf

#> a2ensite default-ssl.conf

#> service apache2 restart

18 of 37

Sample CGI script

  • Located in /usr/lib/cgi-bin/index.cgi

​

#!/bin/bash

​

echo -e "Content-type: text/plain\n"

​

echo -e "Printing environment variables for OIDC\n\n"

​

set | grep OIDC_

​

19 of 37

Login as a user

  • visit the protected URL

​

​

https://[machine_name]/cgi-bin/

20 of 37

Data in CGI variables

Printing environment variables for OIDC���OIDC_CLAIM_aud=22602425-bf20-4e36-b096-dd38417918c0�OIDC_CLAIM_auth_time=1524500299�OIDC_CLAIM_exp=1524501330�OIDC_CLAIM_iat=1524500730�OIDC_CLAIM_iss=https://login.elixir-czech.org/oidc/�OIDC_CLAIM_jti=8dd2b3e5-b173-47e6-8b15-3e01839f4ae8�OIDC_CLAIM_kid=rsa1�OIDC_CLAIM_nonce=l3lwZIKhzQY7Xyml4socbAWLU11bscRW2OC5C721PVk�OIDC_CLAIM_sub=a78efcaa0459f492590tefa3cece12875a0a3504@elixir-europe.org

​

​

21 of 37

JavaScript client

www.elixir-europe.org

22 of 37

JavaScript client

  • Certified OIDC library is oidc-client-js
  • https://github.com/IdentityModel/oidc-client-js/
  • Runs in browser, cannot protect client_secret -> implicit grant flow
  • Registration procedure is the same , only in „Grant Types“ choose „implicit“ and you don’t need Client Secret
  • in „Redirect URI(s)“ fill URL for callback

​

​

  • If the client uses Resource Server other than userInfo you have to deal with CORS headers

​

https://[machine_name]/callback.html

23 of 37

Callback URL

  • Copy content from the http://pasted.co/8b4ecf5b
    • Password to view: elixirECCB2018

#> nano /var/www/html/callback.html

24 of 37

Minimalistic client in JavaScript

  • Copy content from the http://pasted.co/f3bbca15
    • Password to view: elixirECCB2018

#> nano /var/www/html/index.html

25 of 37

Application logic

  • Copy content from the http://pasted.co/29a2d029
    • Password to view: elixirECCB2018
  • Fill the configuration variable according to your client

​

#> nano /var/www/html/app.js

26 of 37

Download oidc-client-js library

  • Clone the repository to your application folder using git

#> git clone https://github.com/IdentityModel/oidc-client-js.git /var/www/html/oidc-client-js-1.4.1

#> cd /var/www/html/oidc-client-js-1.4.1

#> git checkout 1.4.1

27 of 37

Test it

Visit https://machine_name]/

​

​

​

​

​

Virtual machines and clients created during this meeting will be deleted on 18th of September 2018.

28 of 37

Own implementation

www.elixir-europe.org

29 of 37

Own implementation

  • Own implementation is easy
  • Login in 3 steps
    • authentication of user and obtaining access code
    • exchange access code and client_secret for access token
    • exchange access token for user claims
  • First has to obtain URLs from

​

https://login.elixir-czech.org/oidc/.well-known/openid-configuration

​

    • authorization endpoint
    • token endpoint
    • userInfo endpoint

​

30 of 37

Own implementation - step 1

  • Redirect browser to the authorization endpoint

​

https://login.elixir-czech.org/oidc/authorize?

response_type=code

&scope=openid+email+profile+address+phone

&client_id=<client_id>

&redirect_uri=<where to redirect back>

&state=<random value against XSRF attack>

​

31 of 37

Own implementation - step 2

  • OP returns browser to the URL specified in parameter redirect_uri from the first step and adds two parameters - state and code
  • Client has to verify that value of the state is equal to the value of the state from the first step
  • Makes HTTP x-www-form-urlencoded POST request to the token endpoint and sends it

​

#>curl -d "grant_type=authorization_code&code=<value of code>&redirect_uri=<value from the first step>&client_id=<client_id>&client_secret=<client_secret>" https://login.elixir-czech.org/oidc/token

32 of 37

Own implementation - step 3

  • Token endpoint returns JSON message containing
    • in access_token - value of the access token
    • in expires_in - length of the validity
    • in scope - list of allowed scopes if it differs
    • in id_token - value of the id_token
  • Client makes HTTP request to the userInfo endpoint with HTTP header Authorization

​

#>curl -H "Authorization: Bearer <access_token>" https://login.elixir-czech.org/oidc/userinfo

​

  • Receives back JSON message with user claims

33 of 37

User claims

{

"sub":"fafefcaa0561ad9259adfa9fa3cece1dfadf75a03428@elixir-europe.org",

"name":"Michal Procházka",

"Preferred_username":"michalp",

"given_name":"Michal",

"family_name":"Procházka",

"email":"michalp@ics.muni.cz",

"Phone_number":"+420739xxxxxx",

"address":{}

}

34 of 37

How to move to production

www.elixir-europe.org

35 of 37

Procedure

  • It is just a formal procedure from the SP point of view
    • No technical actions needed

​

  1. Complete the registration form
  2. Select audience (all users vs. selected groups)
  3. Done

​

36 of 37

Formalities

  • Write an email to aai-contact@elixir-europe.org with request to move your service to the production

​

  • You will receive a link to the Google docs form
    • The form is the same as was filled for test environment
    • Now the form must be filled completely
      • Privacy policy
      • Approval from HoN or ELIXIR director

​

  • After the approval from ELIXIR AAI
    • All users with ELIXIR ID can access your service
    • OR you can select which groups will have an access

37 of 37

European Life Sciences Infrastructure for Biological Information

www.elixir-europe.org

European Life Sciences Infrastructure for Biological Information

www.elixir-europe.org