Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

6689-Add section for Private Key JWT client authentication in OIDC cl… #6700

Merged
merged 1 commit into from
Jun 9, 2023
Merged

6689-Add section for Private Key JWT client authentication in OIDC cl… #6700

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions modules/reference/pages/feature/openidConnectClient/examples.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -287,16 +287,18 @@ For more information, see xref:ROOT:authentication-filters.adoc[Authentication f
[#privatekey]
=== Use Private Key JWT for client authentication

OpenID Connect clients in Open Liberty support the `private_key_jwt` client authentication method with OpenID Connect token endpoints. OpenID Connect clients need to provide authentication data to the OpenID Connect provider for accessing the provider's token endpoint. Clients can authenticate by using several different methods, but most of those methods require a client secret. The `private_key_jwt` authentication method allows clients to use asymmetric keys to create signed JSON Web Tokens (JWTs) to authenticate instead of client secrets. OpenID Connect clients in Open Liberty by using this authentication method are no longer need to have a client secret.
OpenID Connect clients in Open Liberty support the `private_key_jwt` client authentication method with OpenID Connect token endpoints. OpenID Connect clients need to provide authentication data to the OpenID Connect provider for accessing the provider's token endpoint. Clients can authenticate by using several different methods, but most of those methods require a client secret. The `private_key_jwt` authentication method allows clients to use asymmetric keys to create signed JSON Web Tokens (JWTs) to authenticate instead of client secrets. By using this authentication method, OpenID Connect clients in Open Liberty no longer need to have a client secret.

Server administrators can enable this function by using the `private_key_jwt` option for the `tokenEndpointAuthMethod` attribute, and the new `tokenEndpointAuthSigningAlgorithm` and `keyAliasName` attributes in the `<openidConnectClient>` element:

[source,xml]
----
<openidConnectClient tokenEndpointAuthMethod="private_key_jwt"
tokenEndpointAuthSigningAlgorithm="E512"
keyAliasName="privatekeyaliasES512"
... />
<openidConnectClient id="myOidcClientUsingPrivateKeyJwt"
tokenEndpointAuthMethod="private_key_jwt"
tokenEndpointAuthSigningAlgorithm="E512"
keyAliasName="privatekeyaliasES512"
...
/>
----

The `tokenEndpointAuthSigningAlgorithm` attribute specifies the signing algorithm to use to sign the JWT used for client authentication. The `keyAliasName` attribute points to the private key to use to sign the JWT. The private key must be present in the keystore that is specified by the `sslRef` attribute in the OpenID Connect client configuration. OpenID Connect providers that support Private Key JWT client authentication typically provide an interface for administrators to upload their corresponding public key.
Expand Down
2 changes: 1 addition & 1 deletion modules/reference/pages/feature/socialLogin/examples.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,7 +129,7 @@ The following example configures Instagram as the social media provider:

=== Use Private Key JWT for client authentication

OpenID Connect clients that are configured by using the `<oidcLogin>` element in the Social Media Login feature supports the `private_key_jwt` client authentication method with OpenID Connect token endpoints. The process for enabling this support is identical to the https://github.com/OpenLiberty/docs/issues/6689#link-to-new-section-described-above[OpenID Connect Client 1.0] feature.
OpenID Connect clients that are configured by using the `<oidcLogin>` element in the Social Media Login feature support the `private_key_jwt` client authentication method with OpenID Connect token endpoints. The process for enabling this support is identical to the https://github.com/OpenLiberty/docs/issues/6689#link-to-new-section-described-above[OpenID Connect Client 1.0] feature.

The following example shows how to use a private key JWT for client authentication:

Expand Down