Token Transformation in Structured Editor

This section describes how to set up token transformation in the structured editor of Studio. For more information about setting up token transformation, see Transforming OpenID Connect ID Tokens Into SAML Assertions.

Set Up Token Transformation

In IG Studio, create a route:
1. Go to http://openig.example.com:8080/openig/studio, and select  Create a route.
2. Select  Structured to use the structured editor.
Select Advanced options on the right, and create a route with the following options:
- Base URI: http://app.example.com:8081
- Condition: Path: /home/id_token
- Name: 50-idtoken
Configure authentication:
1. Select  Authentication.
2. Select OpenID Connect, and enter the following information:
  - Client Filter:
    Client Endpoint: /home/id_token
    Require HTTPS: Deselect this option
  - Client Registration:
    Client ID: oidc_client
    Client secret: password
    Scopes: openid, profile, and email
    Basic authentication: Select this option
  - Issuer:
    Well-known endpoint: http://openam.example.com:8088/openam/oauth2/.well-known/openid-configuration
  Leave all other values as default, and save your settings.
Set up token transformation:
1. Select and enable  Token transformation.
2. Enter the following information:
  - AM service: Configure an AM service to use for authentication and REST STS requests.
    URI: http://openam.example.com:8088/openam
    Agent: The credentials of the agent you created in AM.
    Username: ig_agent
    Password: password
  - Username: oidc_client
  - Password: password
  - id_token: ${attributes.openid.id_token}
  - Instance: openig
Add a StaticResponseHandler:
1. On the top-right of the screen, select  and  Editor mode to switch into editor mode.
  Warning
  After switching to Editor mode, you cannot go back. You will be able to use the JSON file editor to manually edit the route, but will no longer be able use the full Studio interface to add or edit filters.
2. Replace the last ReverseProxyHandler in the route with the following StaticResponseHandler, and then save the route:
```
"handler": {
  "type": "StaticResponseHandler",
  "config": {
    "reason": "Found",
    "status": 200,
    "headers": {
      "Content-Type": [ "text/plain" ]
    },
    "entity": "{\"id_token\":\n\"${attributes.openid.id_token}\"} \n\n\n{\"saml_assertions\":\n\"${contexts.sts.issuedToken}\"}"
```

On the top-right of the screen, select  and  Display to review the route.

The following route should be displayed:

{
  "name": "50-idtoken",
  "baseURI": "http://app.example.com:8081",
  "condition": "${matches(request.uri.path, '^/home/id_token')}",
  "heap": [
    {
      "name": "SystemAndEnvSecretStore-1",
      "type": "SystemAndEnvSecretStore"
    },
    {
      "name": "AmService-1",
      "type": "AmService",
      "config": {
        "agent": {
          "username": "ig_agent",
          "passwordSecretId": "agent.secret.id"
        },
        "secretsProvider": "SystemAndEnvSecretStore-1",
        "url": "http://openam.example.com:8088/openam/",
        "version": "7"
      }
    }
  ],
  "handler": {
    "type": "Chain",
    "config": {
      "filters": [
        {
          "name": "OAuth2ClientFilter-1",
          "type": "OAuth2ClientFilter",
          "config": {
            "clientEndpoint": "/home/id_token",
            "failureHandler": {
              "type": "StaticResponseHandler",
              "config": {
                "status": 500,
                "headers": {
                  "Content-Type": [
                    "text/plain"
                  ]
                },
                "entity": "An error occurred during the OAuth2 setup."
              }
            },
            "registrations": [
              {
                "name": "oidc-user-info-client",
                "type": "ClientRegistration",
                "config": {
                  "clientId": "oidc_client",
                  "clientSecretId": "oidc.secret.id",
                  "secretsProvider": "SystemAndEnvSecretStore-1",
                  "issuer": {
                    "name": "Issuer",
                    "type": "Issuer",
                    "config": {
                      "wellKnownEndpoint": "http://openam.example.com:8088/openam/oauth2/.well-known/openid-configuration"
                    }
                  },
                  "scopes": [
                    "openid",
                    "profile",
                    "email"
                  ],
                  "tokenEndpointAuthMethod": "client_secret_basic"
                }
              }
            ],
            "requireHttps": false,
            "cacheExpiration": "disabled"
          }
        },
        {
          "name": "TokenTransformationFilter-1",
          "type": "TokenTransformationFilter",
          "config": {
            "idToken": "${attributes.openid.id_token}",
            "instance": "openig",
            "amService": "AmService-1"
          }
        }
      ],
      "handler": {
        "type": "StaticResponseHandler",
        "config": {
          "reason": "Found",
          "status": 200,
          "headers": {
            "Content-Type": [ "text/plain" ]
          },
          "entity": "{\"id_token\":\n\"${attributes.openid.id_token}\"} \n\n\n{\"saml_assertions\":\n\"${contexts.sts.issuedToken}\"}"
        }
      }
    }
  }
}

Select  Deploy to push the route to the IG configuration.
You can check the $HOME/.openig/config/routes folder to see that the route is there.

Token Transformation in Structured Editor

Warning