Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature] OpenID Connect support in Easegress #827

Closed
jthann opened this issue Oct 13, 2022 · 0 comments
Closed

[Feature] OpenID Connect support in Easegress #827

jthann opened this issue Oct 13, 2022 · 0 comments
Assignees

Comments

@jthann
Copy link
Collaborator

jthann commented Oct 13, 2022

OpenID Connect(OIDC) is an identity layer on top of the OAuth 2.0 protocol. It enables Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server, as well as to obtain basic profile information
about the End-User.

For Easegress it should support OIDC integration as well as maintain compatibility for OAuth2.0 for following reason: First there are some identity platform providers like OKTAAuth0Authing and other corporation platforms like Google,these platforms implement the standard OIDC protocol. But there are also lots of platforms like GitHub which only implement OAuth2.0 protocol.

The first v1 integration support following features:

  1. Standard OIDC protocol: users only need set OIDC discovery by configuring issuer and discovery in addition to app credentials.
  2. OAuth2.0 protocol compatibility: users need configure authorizationEndpoint tokenEndpoint userinfoEndpoint in addition to app credentials.

When enabled, the OIDC filter should first check if there are some authentication states exist like cookie or bearer token. If exists, the OIDC filter does nothing. Otherwise, it will execute OIDC flow coordinating with user authentication action.

Finally, when handled by OIDC filter the OIDC basic profile information can be obtained by other Easegress filter behind OIDC filter or proxied backend service from http header nameX-Userinfo with standard Base64 encoded value.

Also, optionally OIDC id token is carried by X-ID-Token http header for standard oidc protocol and OAuth2.0 access token is carried by X-Access-Token http header for both OIDC and OAuth2.0.

@jthann jthann self-assigned this Oct 13, 2022
@jthann jthann changed the title Add OpenID Connect support in Easegress [Feature] OpenID Connect support in Easegress Oct 13, 2022
@jthann jthann closed this as completed Oct 19, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant