Skip to content

[WIP] docs: access token new endpoints(/login, /userinfo, /v2/logout) #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

shawnhankim
Copy link
Contributor

@shawnhankim shawnhankim commented Nov 17, 2022

Background:

Description:

shawndotkim and others added 3 commits November 17, 2022 14:43
**1. access token**

  - Enhance the NJS Code to capture the `access_token` sent by the IdP.

  - Store the `access_token` in the k/v store as same as we store `id_token` and `refresh_token`

**2. new endpoints**

  - Add `/userinfo` endpoint:
    - Add a map variable of `$oidc_userinfo_endpoint` as same as authz and token endpoints here (`openid_connect_configuration.conf`) .
    - Expose `/userinfo` endpoint here(`openid_connect.server_conf`) in a location block of NGINX Plus to interact with IdP's `userinfo_endpoint` which is defined in the endpoint of`well-known/openid-configuration`.
    - The nginx location block should proxy to the IdP’s `userinfo_endpoint` by adding `access_token` as a bearer token.
      ```
      Authorization : Bearer <access_token>
      ```
    - The response coming from IdP should be returned back to the caller as it is.

  - Expose `/login` endpoint:
    - Expose the `/login` endpoint as a location block here (`openid_connect.server_conf`)
    - Proxy it to the IdP's `authorization_endpoint` configured in the map variable of `$oidc_authz_endpoint` in (`openid_connect_configuration.conf`).
    - This would outsource the login function to IdP as its configured.

  - Expose `/v2/logout` endpoint:
    - Expose the `/v2/logout` endpoint as a location block here (`openid_connect.server_conf`)
    - Add a map variable of `$oidc_end_session_endpoint` as same as authz and token endpoints here (`openid_connect_configuration.conf`) .
    - Proxy it to the IdP's `end_session_endpoint` to finish the session by IdP.

  - Expose `/v2/_logout` endpoint:
    - Expose `/v2/_logout` endpoint which is a callback from IdP as a location block here (`openid_connect.server_conf`) to handle the following sequences.
      - 1. Redirected by IdP when IdP successfully finished the session.
      - 2. NGINX Plus: Clear session cookies.
      - 3. NGINX Plus: Redirect to either the original landing page or the custom logout page by calling
    - Add a map of `$post_logout_return_uri`: After the successful logout from the IdP, NGINX Plus calls this URI to redirect to either the original page or a custom logout page. The default is original page based on the configuration of `$redirect_base`.

**3. add endpoints in `configure.sh`**

  - IdP's userinfo endpoint
  - IdP's end session endpoint
…-endpoints

feat: access token & new endpoints (/login, /userinfo, /v2/logout)
added doctoc for automatic toc creation
broke getting started info out into new doc
@shawnhankim
Copy link
Contributor Author

shawnhankim commented Nov 17, 2022

@route443 :

  • @jputrino is helping us edit the docs for customers' convenience as you know. Thanks @jputrino.
  • This PR will only contain 1 commit, Once the PR of feature is merged into the main branch.
  • In the meantime, you could find this PR if you want to only see the files changed.
  • So I would appreciate it if you could review this doc as well.

@route443
Copy link
Contributor

Closed since all related changes were rejected:
#57
#59
#60

@route443 route443 closed this Aug 22, 2025
Copy link

🎉 Thank you for your contribution! It appears you have not yet signed the F5 Contributor License Agreement (CLA), which is required for your changes to be incorporated into an F5 Open Source Software (OSS) project. Please kindly read the F5 CLA and reply on a new comment with the following text to agree:


I have hereby read the F5 CLA and agree to its terms


1 out of 3 committers have signed the CLA.
✅ (jputrino)[https://github.com/jputrino]
@shawndotkim
@shawnhankim
You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants