Reading OIDC Token within IG

[reeprice]

I am using IG for API endpoint protection. Currently IG and AM are configured to complete OAuth authentication and also pass back an ID_token. I would like for IG to take in the ID_token with an additional call and convert some of the attributes contended in the id_token to headers values. Does anyone have an example of this use case? Do I need to use the token transformation filter? The example I found was using SAML and that will not work for my use case.

[violette]

Hello reeprice,

If you are using an OAuth2ClientFilter, you should be able to access the openid attributes by using ${attributes.openid}.
The IdToken is available in ${attributes.openid.id_token}.
The claims are available in ${attributes.openid.id_token_claims}.
Then, you can use a HeaderFilter to place the values in a header.

You can use the HeaderFilter after the Oauth2ClientFilter, such as:

{
  "type": "HeaderFilter",
  "config": {
    "messageType": "REQUEST",
    "add": {
      "myIdToken": [
        "${attributes.openid.id_token}"
      ]
    }
  }
}

Which type of call/modifications do you need to do on the claims?

Reference:
https://backstage.forgerock.com/docs/ig/6.5/reference/#OAuth2ClientFilter
https://backstage.forgerock.com/docs/ig/6.5/reference/#HeaderFilter

• This reply was modified 2 years, 11 months ago by violette.

[reeprice]

I am using OAuth2ResourceServerFilter to validate my Access token. Can OAuth2ClientFilter do this as well? Do you have an example of this use case. Basically I want to make two calls. The first call I get an Access Token and id_token. On the 2nd call the access token is validated and the id_token values are saved into context to be used by additional filter.

[violette]

Without routes context, I can only said that the OAuth2ResourceServerFilter validates a Request that contains an OAuth 2.0 access token and The OAuth2ClientFilter is responsible for authenticating the end-user using OAuth2/OIDC delegated authorization. This is two different use cases.

In your case, you are using IG as a Relying Party, such as described in https://backstage.forgerock.com/docs/ig/6.5/gateway-guide/#chap-oauth2-rs, for validating the access_token.
If your token is validated, then you can add a ScriptableFilter after the OAuth2ResourceServerFilter to extract id_token value(provided as a header from your AM) and perform some modifications on its claims. Then, once your modifications are done, you can use a HeaderFilter.

Do I need to use the token transformation filter?

> No, except if you want to transform your id_token into SAML assertions.

• This reply was modified 2 years, 11 months ago by violette.

[jimbot]

I’d love to see an example of a ScriptableFilter extracting a claim value from an access_token. For instance if I’ve added mail as a scope on the AM side, and I’ve got an OAuth2ClientFilter functioning, what would the ScriptableFilter look like to pull out mail, so that I can insert it into a header value?
In other words, I want to use OAuth for auth/scope request, and when IG sees the token result, I want to extract the mail (and a roles/isMemberOf array) from the access token and shove it into a header. I can add the token as a whole, (and the id_token too) with ${attributes.openid.access_token} but I can’t seem to get at the claim values. Does the Client filter not do that type of introspection or make the claim values available? Your note stating “perform some modifications on its claims” makes me think this is possible.

–Jim

[Jatinder Singh]

Access Token is essentially a JWT and you can parse it using the below code in your ScriptableFilter

import org.forgerock.json.jose.common.JwtReconstruction
import org.forgerock.json.jose.jws.SignedJwt
import groovy.json.JsonSlurper

SignedJwt jwt = new JwtReconstruction().reconstructJwt(accessToken, SignedJwt)
claimsSet = new JsonSlurper().parseText(jwt.getClaimsSet.toString())
claimsSet.get("mail")

Hope this helps!

• This reply was modified 2 years, 1 month ago by Jatinder Singh.

[kian.ting]

Hi,

I am having some issues configuring IG to be the PEP for AM, I am using AM as the PDP. Set up everything as per the forge rock documentation. https://backstage.forgerock.com/docs/ig/6.5/gateway-guide/#chap-pep

But I am still getting the following error, does anyone have any idea ??

[http-nio-8082-exec-6] ERROR o.f.o.h.r.RoutesCollectionProvider @system - An error occurred while trying to create route 151
org.forgerock.openig.tools.authentication.AuthenticationException: Authentication failed
	at org.forgerock.openig.tools.authentication.chf.DefaultAuthenticationService.lambda$authenticate$0(DefaultAuthenticationService.java:76)
Wrapped by: java.lang.IllegalStateException: Unable to start notification service
	at org.forgerock.openig.tools.am.AmService$Builder.notificationService(AmService.java:662)
Wrapped by: org.forgerock.openig.heap.HeapException: Invalid object declaration
	at org.forgerock.openig.heap.HeapImpl.get(HeapImpl.java:427)
Wrapped by: org.forgerock.openig.handler.router.RouterHandlerException: An error occurred while loading the route with the name '151_CDR_Oauth2_Routes'
	at org.forgerock.openig.handler.router.RouterHandler.load(RouterHandler.java:306)

[violette]

Hello Kian,
The error message you have: Authentication failed means that the credentials are incorrectly set in your AmService object.

Documentation: https://ea.forgerock.com/docs/ig/maintenance-guide/tuning-IG.html#amservice-websocket
https://ea.forgerock.com/docs/ig/reference/AmService.html

[Author]

Posts