Issuer
Describes an OAuth 2.0 Authorization Server or an OpenID Provider that IG can use as a OAuth 2.0 client or OpenID Connect relying party.
An Issuer is generally referenced from a ClientRegistration, described in "ClientRegistration".
Usage
{
"name": string,
"type": "Issuer",
"config": {
"wellKnownEndpoint": URL string,
"authorizeEndpoint": URI expression,
"registrationEndpoint": URI expression,
"tokenEndpoint": URI expression,
"userInfoEndpoint": URI expression,
"issuerHandler": Handler reference,
"issuerRepository": Issuer repository reference,
"supportedDomains": [ domain pattern, ... ]
}
}Properties
If the provider has a well-known configuration URL as defined for OpenID Connect 1.0 Discovery that returns JSON with at least authorization and token endpoint URLs, then you can specify that URL in the provider configuration. Otherwise, you must specify at least the provider authorization and token endpoint URLs, and optionally the registration endpoint and user info endpoint URLs.
The provider configuration object properties are as follows:
"name": string, requiredA name for the provider configuration.
"wellKnownEndpoint": URL string, required unless authorizeEndpoint and tokenEndpoint are specifiedThe URL to the well-known configuration resource as described in OpenID Connect 1.0 Discovery.
"authorizeEndpoint": expression, required unless obtained through wellKnownEndpointThe URL to the provider's OAuth 2.0 authorization endpoint.
See also "Expressions".
"registrationEndpoint": expression, optionalThe URL to the provider's OpenID Connect dynamic registration endpoint.
See also "Expressions".
"tokenEndpoint": expression, required unless obtained through wellKnownEndpointThe URL to the provider's OAuth 2.0 token endpoint.
See also "Expressions".
"userInfoEndpoint": expression, optionalThe URL to the provider's OpenID Connect UserInfo endpoint.
Default: no UserInfo is obtained from the provider.
See also "Expressions".
"issuerHandler": Handler reference, optionalInvoke this HTTP client handler to communicate with the authorization server.
Provide either the name of a Handler object defined in the heap, or an inline Handler configuration object.
Usually set this to the name of a ClientHandler configured in the heap, or a chain that ends in a ClientHandler.
Default: IG uses the default ClientHandler.
See also Handlers, "ClientHandler".
"issuerRepository": Issuer repository reference, optionalA repository of OAuth 2.0 issuers, built from discovered issuers and the IG configuration.
Provide the name of an IssuerRepository object defined in the heap.
Default: Look up an issuer repository named
IssuerRepositoryin the heap. If none is explicitly defined, then a default one namedIssuerRepositoryis created in the current route.See also "IssuerRepository".
"supportedDomains": array of patterns, optionalList of patterns matching domain names handled by this issuer, used as a shortcut for OpenID Connect discovery before performing OpenID Connect dynamic registration.
In summary when the OpenID Provider is not known in advance, it might be possible to discover the OpenID Provider Issuer based on information provided by the user, such as an email address. The OpenID Connect discovery specification explains how to use WebFinger to discover the issuer. IG can discover the issuer in this way. As a shortcut IG can also use supported domains lists to find issuers already described in the IG configuration.
To use this shortcut, IG extracts the domain from the user input, and looks for an issuer whose supported domains list contains a match.
Supported domains patterns match host names with optional port numbers. Do not specify a URI scheme such as HTTP. IG adds the scheme. For instance,
*.example.commatches any host in theexample.comdomain. You can specify the port number as well as inhost.example.com:8443. Patterns must be valid regular expression patterns according to the rules for the Java Pattern class.
Examples
The following example shows an AM issuer configuration for AM. AM exposes a well-known endpoint for the provider configuration, but this example demonstrates use of the other fields:
{
"name": "openam",
"type": "Issuer",
"config": {
"authorizeEndpoint":
"https://openam.example.com:8443/openam/oauth2/authorize",
"registration_endpoint":
"https://openam.example.com:8443/openam/oauth2/connect/register",
"tokenEndpoint":
"https://openam.example.com:8443/openam/oauth2/access_token",
"userInfoEndpoint":
"https://openam.example.com:8443/openam/oauth2/userinfo",
"supportedDomains": [ "mail.example.*", "docs.example.com:8443" ]
}
}The following example shows an issuer configuration for Google:
{
"name": "google",
"type": "Issuer",
"config": {
"wellKnownEndpoint":
"https://accounts.google.com/.well-known/openid-configuration",
"supportedDomains": [ "gmail.*", "googlemail.com:8052" ]
}
}