Reading OIDC Token within IG

[reeprice]

I am using IG for API endpoint protection. Currently IG and AM are configured to complete OAuth authentication and also pass back an ID_token. I would like for IG to take in the ID_token with an additional call and convert some of the attributes contended in the id_token to headers values. Does anyone have an example of this use case? Do I need to use the token transformation filter? The example I found was using SAML and that will not work for my use case.

[violette]

Hello reeprice,

If you are using an OAuth2ClientFilter, you should be able to access the openid attributes by using ${attributes.openid}.
The IdToken is available in ${attributes.openid.id_token}.
The claims are available in ${attributes.openid.id_token_claims}.
Then, you can use a HeaderFilter to place the values in a header.

You can use the HeaderFilter after the Oauth2ClientFilter, such as:

{
  "type": "HeaderFilter",
  "config": {
    "messageType": "REQUEST",
    "add": {
      "myIdToken": [
        "${attributes.openid.id_token}"
      ]
    }
  }
}

Which type of call/modifications do you need to do on the claims?

Reference:
https://backstage.forgerock.com/docs/ig/6.5/reference/#OAuth2ClientFilter
https://backstage.forgerock.com/docs/ig/6.5/reference/#HeaderFilter

• This reply was modified 8 months, 3 weeks ago by violette.

[reeprice]

I am using OAuth2ResourceServerFilter to validate my Access token. Can OAuth2ClientFilter do this as well? Do you have an example of this use case. Basically I want to make two calls. The first call I get an Access Token and id_token. On the 2nd call the access token is validated and the id_token values are saved into context to be used by additional filter.

[violette]

Without routes context, I can only said that the OAuth2ResourceServerFilter validates a Request that contains an OAuth 2.0 access token and The OAuth2ClientFilter is responsible for authenticating the end-user using OAuth2/OIDC delegated authorization. This is two different use cases.

In your case, you are using IG as a Relying Party, such as described in https://backstage.forgerock.com/docs/ig/6.5/gateway-guide/#chap-oauth2-rs, for validating the access_token.
If your token is validated, then you can add a ScriptableFilter after the OAuth2ResourceServerFilter to extract id_token value(provided as a header from your AM) and perform some modifications on its claims. Then, once your modifications are done, you can use a HeaderFilter.

Do I need to use the token transformation filter?

> No, except if you want to transform your id_token into SAML assertions.

• This reply was modified 8 months, 2 weeks ago by violette.

[Author]

Posts