Closed ashernave closed 9 years ago
The mailing list (mitreid-connect@mit.edu) is probably a better place for this kind of question, but I'll answer your questions here:
1) You use the access token. You should never send the ID token outside of your application -- it's intended to be consumed by your application directly. If you were to send the ID token to B, B should reject it anyway because (a) the token didn't come from the AS and (b) the token was audience restricted to A.
2) Your application "B" is an OAuth protected resource. This actually has nothing to do with OpenID Connect, since the user will not be present on the call from A to B -- it's A acting on behalf of the user at B. B just needs to know which user is acting, so that's where something like Token Introspection will help, since that will give B a means of calling the AS to find out what the token is good for. I don't know if your server (OpenAM) supports introspection or has another way to get authorization data to a distributed resource server.
3) You're not actually authenticating the user at B, you're getting authorization information related to the token, which includes information of who authorized the token. It's important to realize, though, that the user isn't necessarily still there (authenticated) when A makes the call to B.
4) It's not really SSO as you're describing it but rather simple OAuth, with the difference being that OpenID Connect is being used to authenticate the user to the client application in addition to OAuth authorizing access to multiple resources (like B) in addition to the identity information. This is all pretty straightforward and relatively common OAuth, but approaching it as an SSO problem might have been leading you in the wrong direction.
Hi there,
I have a question regarding mitreid connect client implementation and I wasn’t sure where should I post it. Feel free to direct me to the right place. I am implementing a resource server, rest-api-server, that I want to work with open id connect with its clients. The full scenario is that I have:
All services are spring-java based and it looks like your solution might fit them perfectly.
My questions are:
I’ll appreciate your answers. Thanks,
Asher Nave