jricher
commented
8 years ago What you're describing is probably doable. You just need to set the primary authentication of the MITREid Connect server as an OpenID Connect client from OpenAM. The page you linked is the client configuration, and you need to replace the user configuration in the server with that.
However, MITREid Connect doesn't support the hybrid flow, nor does it support the "idtoken" or "token idtoken" response types. We do support the "token" response type for implicit clients, and will send back an idtoken if you request the "openid" scope, but this is off-label use for OIDC.
mobilars
Hi. We are required to use an OAuth server that is only used for authentication, issuing openid id_tokens. That particular server is OpenAM based, and the owner only allows code flow (not implicit/hybrid flows).
We would like to set up a second oauth server that authorizes applications, but reusing the external oauth authentication server for the authentication itself. We really like MittreID and how it's easy to set up scopes, applications etc, and we are wondering if it's possible to combine with the second server for authentication. I've spent some time looking at the examples, and I have some questions.
1) Is it possible to use MitreID in this configuration? The initial authorization request would come in to the MitreID authorization server, which would redirect the user to the OpenAM AM server for authentication, which would send back an auth-code, which MitreId-server would use to fetch an id-token from the OpenAM token-endpoint. The MitreID server would then show a consent page and issue an access token via code/implicit/hybrid flow as configured. Is this possible? 2) If possible, is there example code? I've seen some examples, but I am confused if this is code for an authorization server or just a web app wanting to use an external server for authorization. 3) If that example is the one, I don't quite understand how to link the beans defining the authorization to the actual login process/web page. Could you give a hint as to how to do it?
Thank you!