Cross-Domain Single Sign-On With the ForgeRock Identity Cloud

Set up Identity Cloud:

1. Log in to the ForgeRock Identity Cloud as an administrator.

2. In the platform console, go to Identities > Manage > Alpha realm - Users, and add a new user with the following values:

   • Username: demo

   • First name: demo

   • Last name: user

   • Email Address: demo@example.com

   • Password: Ch4ng3!t

3. Make sure that you are managing the alpha realm. If not, click the current realm at the top of the screen, and switch realm.

4. Add an Identity Gateway agent:

   1. Click Gateways & Agents, and add an agent profile with the following values:

      • ID: ig_agent_cdsso

      • Password: password

      • Redirect URLs: http://openig.ext.com:8080/home/cdsso/redirect

      By default, the agent can introspect OAuth 2.0 tokens issued to any client, in the realm and subrealm where it is created. To change the introspection, click Native Consoles > Access Management, and update the agent in the AM console.

Set up Identity Gateway:

1. Set an environment variable for the IG agent password, and then restart IG:

   $ export AGENT_SECRET_ID='cGFzc3dvcmQ='

   The password is retrieved by a SystemAndEnvSecretStore, and must be base64-encoded.

2. Add the following route to IG, to serve .css and other static resources for the sample application:

   $HOME/.openig/config/routes/static-resources.json

   %appdata%\OpenIG\config\routes\static-resources.json

   {
     "name" : "sampleapp_resources",
     "baseURI" : "http://app.example.com:8081",
     "condition": "${matches(request.uri.path,'^/css')}",
     "handler": "ReverseProxyHandler"
   }

3. Add the following route to Identity Gateway, replacing the value for the property amInstanceUrl:

   $HOME/.openig/config/routes/cdsso-idc.json

   %appdata%\OpenIG\config\routes\cdsso-idc.json

   {
     "name": "cdsso-idc",
     "baseURI": "http://app.example.com:8081",
     "condition": "${matches(request.uri.path, '^/home/cdsso')}",
     "properties": {
       "amInstanceUrl": "<myIdentityCloudUrl/am>"
     },
     "heap": [
       {
         "name": "SystemAndEnvSecretStore-1",
         "type": "SystemAndEnvSecretStore"
       },
       {
         "name": "AmService-1",
         "type": "AmService",
         "config": {
           "url": "&{amInstanceUrl}",
           "realm": "/alpha",
           "version": "7",
           "agent": {
             "username": "ig_agent_cdsso",
             "passwordSecretId": "agent.secret.id"
           },
           "secretsProvider": "SystemAndEnvSecretStore-1",
           "sessionCache": {
             "enabled": false
           }
         }
       }
     ],
     "handler": {
       "type": "Chain",
       "config": {
         "filters": [
           {
             "name": "CrossDomainSingleSignOnFilter-1",
             "type": "CrossDomainSingleSignOnFilter",
             "config": {
               "redirectEndpoint": "/home/cdsso/redirect",
               "authCookie": {
                 "path": "/home",
                 "name": "ig-token-cookie"
               },
               "amService": "AmService-1",
               "verificationSecretId": "verify",
               "secretsProvider": {
                 "type": "JwkSetSecretStore",
                 "config": {
                   "jwkUrl": "&{amInstanceUrl}/oauth2/realms/alpha/connect/jwk_uri"
                 }
               }
             }
           }
         ],
         "handler": "ReverseProxyHandler"
       }
     }
   }

   Notice the following features of the route compared to cdsso.json in "Set Up CDSSO", where Access Management is running locally:

   • The AmService URL points to Access Management in the Identity Cloud.

   • The AmService realm points to the realm where you configure your IG agent.

Test the setup:

1. Go to http://openig.ext.com:8080/home/cdsso. The Identity Cloud login page is displayed.

2. Log in to Identity Cloud as user demo, password Ch4ng3!t.

   Access Management calls /home/cdsso/redirect, and includes the CDSSO token. The CrossDomainSingleSignOnFilter passes the request to sample app.