github/wonderwall
1
0
Fork 0
mirror of https://github.com/nais/wonderwall.git synced 2026-02-14 17:49:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(openid/client): add support for the client_secret_post authentication method

Browse Source
This commit is contained in:
Trong Huu Nguyen
2024-10-04 11:45:53 +02:00
parent 5df7234e1c
commit df5c78b821
8 changed files with 160 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
docs/configuration.md
View File

@@ -23,7 +23,8 @@ The following flags are available:
| `openid.acr-values` | string | Space separated string that configures the default security level (`acr_values`) parameter for authorization requests. | |
| `openid.audiences` | strings | List of additional trusted audiences (other than the client_id) for OpenID Connect id_token validation. | |
| `openid.client-id` | string | Client ID for the OpenID client. | |
| `openid.client-jwk` | string | JWK containing the private key for the OpenID client in string format. | |
| `openid.client-jwk` | string | JWK containing the private key for the OpenID client in string format. If configured, this takes precedence over 'openid.client-secret'. | |
| `openid.client-secret` | string | Client secret for the OpenID client. Overridden by 'openid.client-jwk', if configured. | |
| `openid.post-logout-redirect-uri` | string | URI for redirecting the user after successful logout at the Identity Provider. | |
| `openid.provider` | string | Provider configuration to load and use, either `openid`, `azure`, `idporten`. | `openid` |
| `openid.resource-indicator` | string | OAuth2 resource indicator to include in authorization request for acquiring audience-restricted tokens. | |
@@ -82,7 +83,7 @@ The default configuration of Wonderwall will start in [_standalone mode_](archit
At minimum, the following configuration must be provided when in standalone mode:
- `openid.client-id`
- `openid.client-jwk`
- `openid.client-jwk` or `openid.client-secret`
- `openid.well-known-url`
- `ingress`
@@ -99,7 +100,7 @@ When the `sso.enabled` flag is enabled and the `sso.mode` flag is set to `server
At minimum, the following configuration must be provided when in SSO server mode:
- `openid.client-id`
- `openid.client-jwk`
- `openid.client-jwk` or `openid.client-secret`
- `openid.well-known-url`
- `ingress`
- `redis.address`