このコンテンツは選択した言語では利用できません。

Chapter 1. OpenID Connect configuration in JBoss EAP

When you secure your applications using an OpenID provider, you do not need to configure any security domain resources locally. The elytron-oidc-client subsystem provides a native OpenID Connect (OIDC) client in JBoss EAP to connect with OpenID providers. JBoss EAP automatically creates a virtual security domain for your application, based on your OpenID provider configurations.

Important

It is recommended to use the OIDC client with Red Hat Single Sign-On. You can use other OpenID providers if they can be configured to use access tokens that are JSON Web Tokens (JWTs) and can be configured to use the RS256, RS384, RS512, ES256, ES384, or ES512 signature algorithm.

To enable the use of OIDC, you can configure either the elytron-oidc-client subsystem or an application itself. JBoss EAP activates the OIDC authentication as follows:

When you deploy an application to JBoss EAP, the elytron-oidc-client subsystem scans the deployment to detect if the OIDC authentication mechanism is required.
If the subsystem detects OIDC configuration for the deployment in either the elytron-oidc-client subsystem or the application deployment descriptor, JBoss EAP enables the OIDC authentication mechanism for the application.
If the subsystem detects OIDC configuration in both places, the configuration in the elytron-oidc-client subsystem secure-deployment attribute takes precedence over the configuration in the application deployment descriptor.

Deployment configuration

To secure an application with OIDC by using a deployment descriptor, update the application’s deployment configuration as follows:

Create a file called oidc.json in the WEB-INF directory with the OIDC configuration information.
Example oidc.json contents
```
{
  "client-id" : "customer-portal", 
```
1
```
  "provider-url" : "http://localhost:8180/auth/realms/demo", 
```
2
```
  "ssl-required" : "external", 
```
3
```
   "credentials" : {
      "secret" : "234234-234234-234234" 
```
4
```
   }
}
```
1
The name to identify the OIDC client with the OpenID provider.
2
The OpenID provider URL.
3
Require HTTPS for external requests.
4
The client secret that was registered with the OpenID provider.
Set the auth-method property to OIDC in the application deployment descriptor web.xml file.

Example deployment descriptor update

<login-config>
    <auth-method>OIDC</auth-method>
</login-config>

Subsystem configuration

You can secure applications with OIDC by configuring the elytron-oidc-client subsystem in the following ways:

Create a single configuration for multiple deployments if you use the same OpenID provider for each application.
Create a different configuration for each deployment if you use different OpenID providers for different applications.

Example XML configuration for a single deployment:

<subsystem xmlns="urn:wildfly:elytron-oidc-client:1.0">
    <secure-deployment name="DEPLOYMENT_RUNTIME_NAME.war">


        <client-id>customer-portal</client-id>


        <provider-url>http://localhost:8180/auth/realms/demo</provider-url>


        <ssl-required>external</ssl-required>


        <credential name="secret" secret="0aa31d98-e0aa-404c-b6e0-e771dba1e798" />


    </secure-deployment
</subsystem>

1: The deployment runtime name.
2: The name to identify the OIDC client with the OpenID provider.
3: The OpenID provider URL.
4: Require HTTPS for external requests.
5: The client secret that was registered with the OpenID provider.

To secure multiple applications using the same OpenID provider, configure the provider separately, as shown in the example:

<subsystem xmlns="urn:wildfly:elytron-oidc-client:1.0">
    <provider name="${OpenID_provider_name}">
        <provider-url>http://localhost:8080/auth/realms/demo</provider-url>
        <ssl-required>external</ssl-required>
    </provider>
    <secure-deployment name="customer-portal.war">


        <provider>${OpenID_provider_name}</provider>
        <client-id>customer-portal</client-id>
        <credential name="secret" secret="0aa31d98-e0aa-404c-b6e0-e771dba1e798" />
    </secure-deployment>
    <secure-deployment name="product-portal.war">


        <provider>${OpenID_provider_name}</provider>
        <client-id>product-portal</client-id>
        <credential name="secret" secret="0aa31d98-e0aa-404c-b6e0-e771dba1e798" />
    </secure-deployment>
</subsystem>

1: A deployment: customer-portal.war
2: Another deployment: product-portal.war

このコンテンツは選択した言語では利用できません。

Chapter 1. OpenID Connect configuration in JBoss EAP

Deployment configuration

Subsystem configuration

詳細情報

試用、購入および販売

コミュニティー

会社概要

多様性を受け入れるオープンソースの強化

Red Hat ドキュメントについて

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links