Go in Manager and click on OpenID Connect Service
node.
Set the issuer identifier, which should be the portal URL. For example: http://auth.example.com
Set a blank value to use Portal URL.
Name of different OpenID Connect endpoints. You can keep the default values unless you have a specific need to change them.
Tip
These endpoints are published in JSON metadata.
You can associate here an authentication context to an authentication level.
If Dynamic registration is enabled, you can configure Exported vars and Extra claims options
to define attributes and extra claims released when a new relying party is registered through /oauth2/register
endpoint.
Warning
Dynamic Registration can be a security risk because a new configuration will be created in the backend for each registration request. You can restrict this by protecting the WebServer registration endpoint with an authentication module, and give credentials to clients.
kid
(Key ID) is automatically derived when new keys are generated.
You have to choose the key type: RSA
or EC
. The list of
supported algorithms in OIDC metadata will be automatically updated.openid
profile
email
address
phone
)Changed in version 2.0.16: In order to increase compatibility with some applications, LemonLDAP::NG encapsulates the OIDC signing key in a certificate.
If you generated your OIDC keys on an older version of LemonLDAP::NG, and some application complains that the JWKS document is missing a x5c key, you can upgrade your OIDC signing key in the following manner
# Extract the OIDC signing key
lemonldap-ng-cli get oidcServicePrivateKeySig | sed 's/^oidcServicePrivateKeySig = //' > oidc.key
# Generate a certificate
openssl req -x509 -key oidc.key -out oidc.pem -sha256 -days 7000 -subj="/CN=$(hostname -f)"
# Import the new certificate
lemonldap-ng-cli set oidcServicePublicKeySig "$(cat oidc.pem)"
# Remove temporary files
rm oidc.key oidc.pem
offline_access
scope. Default value is one month.Best pratice is to use a separate sessions storage for OpenID Connect sessions, else they will be stored in main sessions storage.
OpenID Connect specifications allow to rotate keys to improve security. LL::NG provides a script to do this, that should be used in a cronjob.
The script is /usr/share/lemonldap-ng/bin/rotateOidcKeys
. It can be
run for example each week:
5 5 * * 6 www-data /usr/share/lemonldap-ng/bin/rotateOidcKeys
Tip
Set the correct WebServer user, else generated configuration will not be readable by LL::NG.
LL::NG implements the OpenID Connect Change Notification specification
A changed
state will be sent if the user is disconnected from LL::NG
portal (or has removed its SSO cookie). Else the unchanged
state
will be returned.
Tip
This feature requires that the LL::NG cookie is exposed to
javascript (httpOnly
option must be set to 0
).