Using the OAuth 2.0 Context to Log in to the Sample Application

Set up AM:

1. Set up AM as described in "Validating Access_Tokens Through the Introspection Endpoint".

2. Select  Identities, and change the email address of George to george.

3. Select  Scripts > OAuth2 Access Token Modification Script, and replace the default script as follows:

   import org.forgerock.http.protocol.Request
   import org.forgerock.http.protocol.Response
   import com.iplanet.sso.SSOException
   import groovy.json.JsonSlurper
   
   def attributes = identity.getAttributes(["mail"].toSet())
   accessToken.setField("mail", attributes["mail"][0])
   accessToken.setField("password", "C0stanza")

   The AM script adds user profile information to the access_token, and adds a password field with the value C0stanza.

   Do not use this example in production! If the token is stateless and unencrypted, the password value is easily accessible when you have the token.

Set up IG:

1. Set an environment variable for the IG agent password, and then restart IG:

   $ export AGENT_SECRET_ID='cGFzc3dvcmQ='

   The password is retrieved by a SystemAndEnvSecretStore, and must be base64-encoded.

2. Add the following route to IG:

   $HOME/.openig/config/routes/rs-pwreplay.json

   %appdata%\OpenIG\config\routes\rs-pwreplay.json

   {
     "name" : "rs-pwreplay",
     "baseURI" : "http://app.example.com:8081",
     "condition" : "${matches(request.uri.path, '^/rs-pwreplay')}",
     "heap": [
       {
         "name": "SystemAndEnvSecretStore-1",
         "type": "SystemAndEnvSecretStore"
       },
       {
         "name": "AmService-1",
         "type": "AmService",
         "config": {
           "agent": {
             "username": "ig_agent",
             "passwordSecretId": "agent.secret.id"
           },
           "secretsProvider": "SystemAndEnvSecretStore-1",
           "url": "http://openam.example.com:8088/openam/",
           "version": "7"
         }
       }
     ],
     "handler" : {
       "type" : "Chain",
       "config" : {
         "filters" : [
           {
             "name" : "OAuth2ResourceServerFilter-1",
             "type" : "OAuth2ResourceServerFilter",
             "config" : {
               "scopes" : [ "mail", "employeenumber" ],
               "requireHttps" : false,
               "realm" : "OpenIG",
               "accessTokenResolver": {
                 "name": "TokenIntrospectionAccessTokenResolver-1",
                 "type": "TokenIntrospectionAccessTokenResolver",
                 "config": {
                   "amService": "AmService-1",
                   "providerHandler": {
                     "type": "Chain",
                     "config": {
                       "filters": [
                         {
                           "type": "HttpBasicAuthenticationClientFilter",
                           "config": {
                             "username": "ig_agent",
                             "passwordSecretId": "agent.secret.id",
                             "secretsProvider": "SystemAndEnvSecretStore-1"
                           }
                         }
                       ],
                       "handler": "ForgeRockClientHandler"
                     }
                   }
                 }
               }
             }
           },
           {
             "type": "AssignmentFilter",
             "config": {
               "onRequest": [{
                 "target": "${session.username}",
                 "value": "${contexts.oauth2.accessToken.info.mail}"
               },
                 {
                   "target": "${session.password}",
                   "value": "${contexts.oauth2.accessToken.info.password}"
                 }
               ]
             }
           },
           {
             "type": "StaticRequestFilter",
             "config": {
               "method": "POST",
               "uri": "http://app.example.com:8081/login",
               "form": {
                 "username": [
                   "${session.username}"
                 ],
                 "password": [
                   "${session.password}"
                 ]
               }
             }
           }
         ],
         "handler": "ReverseProxyHandler"
       }
     }
   }

   Notice the following features of the route compared to rs-introspect.json:

   • The route matches requests to /rs-pwreplay.

   • The AssignmentFilter accesses the context, and injects the username and password into the SessionContext, ${session}.

   • The StaticRequestFilter retrieves the username and password from session, and replaces the original HTTP GET request with an HTTP POST login request that contains the credentials to authenticate.

Test the setup:

1. In a terminal window, use a curl command similar to the following to retrieve an access_token:

   $ mytoken=$(curl -s \
   --user "client-application:password" \
   --data "grant_type=password&username=george&password=C0stanza&scope=mail%20employeenumber" \
   http://openam.example.com:8088/openam/oauth2/access_token | jq -r ".access_token")

2. Validate the access_token returned in the previous step:

   $ curl -v http://openig.example.com:8080/rs-pwreplay --header "Authorization: Bearer ${mytoken}"

   HTML for the sample application is displayed.