TokenTransformationFilter
Transforms a token issued by AM to another token type.
The TokenTransformationFilter makes the result of the token transformation available to downstream handlers in the sts context. For information, see "StsContext".
The current implementation uses REST Security Token Service (STS) APIs to transform an OpenID Connect ID Token (id_token) into a SAML 2.0 assertion. The subject confirmation method is Bearer, as described in Profiles for the OASIS Security Assertion Markup Language (SAML) V2.0 .
The TokenTransformationFilter makes the result of the token transformation available to downstream handlers in the issuedToken property of the ${contexts.sts} context.
The TokenTransformationFilter configuration references a REST STS instance that must be set up in AM before the TokenTransformationFilter can be used. The REST STS instance exposes a preconfigured transformation under a specific REST endpoint. For information about setting up a REST STS instance, see the AM documentation.
Errors that occur during the token transformation cause a error response to be returned to the client and an error message to be logged for the IG administrator.
Supported with OpenAM 13.5, and AM 5 and later versions.
Usage
{
"name": "string",
"type": "TokenTransformationFilter",
"config": {
"amService": AmService reference,
"idToken": runtime expression<string>,
"instance": "expression"
}
}Properties
"amService": AmService reference, requiredThe AmService heap object to use for the following properties:
agent, the credentials of the IG agent in AM, to authenticate IG as an AM REST STS client, and to communicate WebSocket notifications from AM to IG. This credentials are evaluated when the route is initializedurl, the URL of an AM service to use for session token validation and authentication. Authentication and REST STS requests are made to this service.realm, the AM realm containing the following information:The AM application that can make the REST STS request and whose credentials are the username and password.
The STS instance described by the instance field.
ssoTokenHeader, the name of the HTTP header that provides the SSO token for the REST STS client subject.amHandler, the handler to use for authentication and STS requests to AM.
See also, "AmService".
"idToken": runtime expression<string>, requiredThe value of the OpenID Connect ID token. The expected value is a string that is the JWT encoded
id_token.See also "Expressions".
"instance": expression, requiredAn expression evaluating to the name of the REST STS instance.
This expression is evaluated when the route is initialized, so the expression cannot refer to
requestorcontexts.See also "Expressions".
Example
The following example shows a configuration for a TokenTransformationFilter:
{
"type": "TokenTransformationFilter",
"config": {
"amService": "MyAmService",
"idToken": "${attributes.openid.id_token}",
"instance": "openig"
}
}
For an example of how to set up and test the TokenTransformationFilter, see Transforming OpenID Connect ID Tokens Into SAML Assertions.