First, let's understand:
\nSSO stands for Single Sign-On. It's an authentication process that allows a user to access multiple applications or systems with one set of login credentials (username and password). Instead of requiring users to log in separately to each application, SSO enables them to log in once and gain access to all the connected systems without needing to re-enter their credentials.
\nOpenID Connect (OIDC) is a protocol that builds on OAuth 2.0 to ensure secure user authentication and authorization. It adds an identity layer to OAuth 2.0, allowing applications to confirm a user's identity and gather basic profile information. OIDC utilizes JSON Web Tokens (JWTs) for these functions, aligning with OAuth 2.0's token acquisition methods. This integration enables seamless user authentication across different platforms, supporting features like single sign-on, where users can access multiple applications with one set of credentials managed by an identity provider.
\nLoginRadius is a high-performance, scalable identity and access management platform focused on customer-facing use cases. It offers comprehensive features and capabilities to help you implement user authentication and authorization and manage user data with built-in workflows and security controls.
\nOn these lines, LoginRadius offers built-in support for OIDC and the use of OIDC to implement SSO.
\nFirst, you need to create an OIDC application in LoginRadius to tailor user claim fields effortlessly. You can fine-tune these customizable user claims through LoginRadius' user-friendly interface. Subsequently, you can seamlessly integrate these claims into the token, enabling streamlined extraction and utilization within the application ecosystem.
\nIn essence, LoginRadius facilitates the setup of OIDC applications and offers customization capabilities through its intuitive interface. This ensures efficient management of user claims, ultimately contributing to a more personalized and secure authentication experience.
\nAfter setting up the OIDC app from the LoginRadius dashboard, you'll use the go-oidc library to configure our provider further and configure the oidc connect.
Go to OIDC Application Configuration and click on Add App button
\nAfter clicking the Create button, you'll get the OIDC application configuration page. This page contains details like your application's Client ID and Client Secret, which are necessary for setting up the OIDC provider and configuration when you code in Golang.
\nThis array of configurable options empowers you to fine-tune your OIDC Application according to your specific requirements. To ensure seamless redirection of requests and successful callbacks to your endpoint, add your application's domain to the whitelist. This will authorize the redirection process and prevent failures when calling the callback endpoint. LoginRadius lets you uniquely identify the redirect URLs for individual OIDC applications: When setting up a new provider, you'll need to input the LoginRadius OIDC App URL, typically in this format: To seamlessly integrate this with your Go backend, create two essential APIs for setting up and configuring By establishing these APIs, your Go backend efficiently handles the authentication flow, ensuring a smooth user experience while securely managing user identity and access. Handle the callback hit that exchanged the authorization token for the access token: For both endpoints, let's review a sample backend server with implementation in Gin Golang. For OIDC integration with the Go backend, you'll implement it using the coreos/go-oidc library (feel free to check it out). This library provides comprehensive support for OIDC, allowing to easily verify tokens, extract user claims, and validate ID tokens. Its features ensure secure authentication and seamless integration with various OIDC providers. With the The process described involves several key steps in setting up an OAuth2 flow with OpenID Connect (OIDC) for user authentication. Here's a brief overview of what was done in the code: This process leverages the security and standardization provided by OIDC and OAuth2 to implement a secure authentication flow. By following these steps, the application can authenticate users through LoginRadius OIDC provider, ensuring that user credentials are managed securely and that the application can trust authenticated users' identities. In this tutorial, you have learned how to implement OIDC SSO with LoginRadius as the Identity Provider. You have also built a simple Golang backend with Gin to understand the implementation.\n
\nWhitelisting the Domain of Your Application
\nTo access Web Apps in Deployment, follow these steps:
\n\n
\nNow, to add a new site:
\n\n
\nhttps://localhost:8080\").Whitelisting Domain from OIDC Application Configuration
\n\n
\nSetting Up the Provider Object and the OAuthconfig with the Loginradius OIDC App Credentials
\n
\nprovider, err := oidc.NewProvider(ctx, "`https://api.loginradius.com/{oidcappname}")`\nif err != nil {\n // handle error\n}\n\n// Configure an OpenID Connect aware OAuth2 client.\noauth2Config := oauth2.Config{\n ClientID: your-oidc-clientID,\n ClientSecret: your-oidc-clientSecret\n RedirectURL: redirectURL,\n\n // Discovery returns the OAuth2 endpoints.\n Endpoint: provider.Endpoint(),\n\n // "openid" is a required scope for OpenID Connect flows.\n Scopes: []string{oidc.ScopeOpenID, "profile", "email"},\n}https://{siteUrl}/service/oidc/{OidcAppName}go-oidc:\n
\nHandle the Callback Hit
\n
\nvar verifier = provider.Verifier(&oidc.Config{ClientID: clientID})\n\nfunc handleOAuth2Callback(ctx *gin.context) {\n // Verify state and errors.\n authCode := ctx.query("code")\n\n oauth2Token, err := oauth2Config.Exchange(ctx, authCode)\n if err != nil {\n // handle error\n }\n\n // Extract the ID Token from the OAuth2 token.\n rawIDToken, ok := oauth2Token.Extra("id_token").(string)\n if !ok {\n // handle missing token\n }\n\n // Parse and verify ID Token payload.\n idToken, err := verifier.Verify(ctx, rawIDToken)\n if err != nil {\n // handle error\n }\n\n // Extract custom claims\n var claims struct {\n Email string `json:"email"`\n Verified bool `json:"email_verified"`\n }\n if err := idToken.Claims(&claims); err != nil {\n // handle error\n }\n}Gin Golang Code
\ngo-oidc library, you can efficiently implement OIDC authentication in the Go backend, guaranteeing users a smooth and secure authentication process.
\ngo get github.com/coreos/go-oidc/v3/oidc
\npackage main\n\nimport (\n\t"encoding/json"\n\t"fmt"\n\t"io"\n\t"log"\n\t"net/http"\n\t"os"\n\n\t"github.com/coreos/go-oidc/v3/oidc"\n\t"github.com/gin-gonic/gin"\n\t"golang.org/x/oauth2"\n)\n\n// Define global OAuth2 configuration and OIDC provider.\nvar (\n\toauthConfig = &oauth2.Config{\n\t\tClientID: "your-client-id", // Replace with your LoginRadius Client ID\n\t\tRedirectURL: "http://localhost:8080/api/callback",\n\t\tClientSecret: "your-client-secret", // Replace with your LoginRadius Client Secret\n\t\tScopes: []string{"user"},\n\t}\n\tglobalProvider *oidc.Provider\n\tglobalOuthConfig *oauth2.Config\n)\n\n// Server struct holds interfaces like HTTP server, DBHelper, ServerProvider, MongoDB client, etc.\ntype Server struct {\n\n}\n\n// InitializeOAuthConfig sets up the global OAuth2 configuration and OIDC provider.\nfunc InitializeOAuthConfig() {\n\t// Create a new OIDC provider using the OAuth2 endpoint and OIDC provider URL.\n\tprovider, err := oidc.NewProvider(context.Background(), "https://<siteUrl>/service/oidc/<OidcAppName>") // Replace with your OIDC Provider URL\n\tif err!= nil {\n\t\tlog.Fatalf("Failed to create new provider: %v", err)\n\t}\n\tglobalProvider = provider\n\n\t// Set up the OAuth2 configuration with the client ID, secret, redirect URL, and scopes.\n\toauth2Config := &oauth2.Config{\n\t\tClientID: oauthConfig.ClientID,\n\t\tClientSecret: oauthConfig.ClientSecret,\n\t\tRedirectURL: oauthConfig.RedirectURL,\n\t\tEndpoint: provider.Endpoint(),\n\t\tScopes: []string{oidc.ScopeOpenID, "profile", "email"},\n\t}\n\tglobalOuthConfig = oauth2Config\n}\n\n// StartLoginProcess initiates the login process by redirecting the user to the OIDC provider.\nfunc StartLoginProcess(ctx *gin.Context) {\n\t// Generate the authorization URL for the OIDC provider.\n\tauthURL := globalOuthConfig.AuthCodeURL("state", oidc.Nonce(""))\n\t// Redirect the user to the OIDC provider for authentication.\n\thttp.Redirect(ctx.Writer, ctx.Request, authURL, http.StatusFound)\n}\n\n// HandleCallback processes the callback from the OIDC provider after the user has authenticated.\nfunc HandleCallback(ctx *gin.Context) {\n\t// Retrieve the authorization code from the query parameters.\n\tcode := ctx.Query("code")\n\n\t// Exchange the authorization code for an access token.\n\toauth2Token, err := globalOuthConfig.Exchange(ctx, code)\n\tif err!= nil {\n\t\tlog.Printf("Error exchanging code for token: %v", err)\n\t\treturn\n\t}\n\n\t// Extract the ID token from the OAuth2 token.\n\trawIDToken, ok := oauth2Token.Extra("id_token").(string)\n\tif!ok {\n\t\tlog.Println("Missing ID token")\n\t\treturn\n\t}\n\n\t// Verify the ID token using the OIDC provider.\n\tvar verifier = globalProvider.Verifier(&oidc.Config{ClientID: globalOuthConfig.ClientID, SkipClientIDCheck: true})\n\n\tidToken, err := verifier.Verify(ctx, rawIDToken)\n\tif err!= nil {\n\t\tlog.Printf("Error verifying ID token: %v", err)\n\t\treturn\n\t}\n\n\t// Extract claims from the verified ID token.\n\tvar claims interface{}\n\tif err := idToken.Claims(&claims); err!= nil {\n\t\tlog.Printf("Error extracting claims: %v", err)\n\t\treturn\n\t}\n\n\t// Respond with a success message.\n\tctx.JSON(http.StatusOK, gin.H{"message": "success"})\n}\n\n// InjectRoutes sets up the routes for the application, including login and callback endpoints.\nfunc (srv *Server) InjectRoutes() *gin.Engine {\n\trouter := gin.Default()\n\n\tapi := router.Group("/api")\n\t{\n\t\t// Define the login route that redirects users to the OIDC provider for authentication.\n\t\tapi.GET("/login", StartLoginProcess)\n\t\t// Define the callback route that handles the callback from the OIDC provider.\n\t\tapi.GET("/callback", HandleCallback)\n\t}\n\n\treturn router\n}\n\nfunc main() {\n\t// Initialize the OAuth2 configuration and OIDC provider.\n\tInitializeOAuthConfig()\n\t// Create a new server instance.\n\tserver := &Server{}\n\t// Inject routes into the Gin engine.\n\trouter := server.InjectRoutes()\n\t// Start the HTTP server.\n\tlog.Fatal(http.ListenAndServe(":8080", router))\n}Initialization of OIDC Provider and OAuth2 Configuration
\n\n
\noidc.NewProvider function, which requires the OAuth2 endpoint and the OIDC provider's URL. This step is crucial for establishing a connection with the OIDC provider, enabling the application to authenticate users through the provider.oauthConfig) is set up with essential details such as the client ID, client secret, redirect URL, and scopes. These credentials are specific to the OIDC application registered with the provider (e.g., LoginRadius). The redirect URL is where the provider will send the user after authentication, and the scopes define the permissions requested from the user.Setting Up the Callback Endpoint
\n\n
\n/api/callback. This endpoint handles the callback from the OIDC provider after the user has been authenticated.Verifying the Access Token and Extracting User Claims
\n\n
\nConclusion
\n