First, let's understand:
\nSSO stands for Single Sign-On. It's an authentication process that allows a user to access multiple applications or systems with one set of login credentials (username and password). Instead of requiring users to log in separately to each application, SSO enables them to log in once and gain access to all the connected systems without needing to re-enter their credentials.
\nOpenID Connect (OIDC) is a protocol that builds on OAuth 2.0 to ensure secure user authentication and authorization. It adds an identity layer to OAuth 2.0, allowing applications to confirm a user's identity and gather basic profile information. OIDC utilizes JSON Web Tokens (JWTs) for these functions, aligning with OAuth 2.0's token acquisition methods. This integration enables seamless user authentication across different platforms, supporting features like single sign-on, where users can access multiple applications with one set of credentials managed by an identity provider.
\nLoginRadius is a high-performance, scalable identity and access management platform focused on customer-facing use cases. It offers comprehensive features and capabilities to help you implement user authentication and authorization and manage user data with built-in workflows and security controls.
\nOn these lines, LoginRadius offers built-in support for OIDC and the use of OIDC to implement SSO.
\nFirst, you need to create an OIDC application in LoginRadius to tailor user claim fields effortlessly. You can fine-tune these customizable user claims through LoginRadius' user-friendly interface. Subsequently, you can seamlessly integrate these claims into the token, enabling streamlined extraction and utilization within the application ecosystem.
\nIn essence, LoginRadius facilitates the setup of OIDC applications and offers customization capabilities through its intuitive interface. This ensures efficient management of user claims, ultimately contributing to a more personalized and secure authentication experience.
\nAfter setting up the OIDC app from the LoginRadius dashboard, you'll use the go-oidc library to configure our provider further and configure the oidc connect.
Go to OIDC Application Configuration and click on Add App button
\nAfter clicking the Create button, you'll get the OIDC application configuration page. This page contains details like your application's Client ID and Client Secret, which are necessary for setting up the OIDC provider and configuration when you code in Golang.
\nThis array of configurable options empowers you to fine-tune your OIDC Application according to your specific requirements. To ensure seamless redirection of requests and successful callbacks to your endpoint, add your application's domain to the whitelist. This will authorize the redirection process and prevent failures when calling the callback endpoint. LoginRadius lets you uniquely identify the redirect URLs for individual OIDC applications: When setting up a new provider, you'll need to input the LoginRadius OIDC App URL, typically in this format: To seamlessly integrate this with your Go backend, create two essential APIs for setting up and configuring By establishing these APIs, your Go backend efficiently handles the authentication flow, ensuring a smooth user experience while securely managing user identity and access. Handle the callback hit that exchanged the authorization token for the access token: For both endpoints, let's review a sample backend server with implementation in Gin Golang. For OIDC integration with the Go backend, you'll implement it using the coreos/go-oidc library (feel free to check it out). This library provides comprehensive support for OIDC, allowing to easily verify tokens, extract user claims, and validate ID tokens. Its features ensure secure authentication and seamless integration with various OIDC providers. With the The process described involves several key steps in setting up an OAuth2 flow with OpenID Connect (OIDC) for user authentication. Here's a brief overview of what was done in the code: This process leverages the security and standardization provided by OIDC and OAuth2 to implement a secure authentication flow. By following these steps, the application can authenticate users through LoginRadius OIDC provider, ensuring that user credentials are managed securely and that the application can trust authenticated users' identities. In this tutorial, you have learned how to implement OIDC SSO with LoginRadius as the Identity Provider. You have also built a simple Golang backend with Gin to understand the implementation. In this blog post, I will write a step-by-step tutorial to add Authentication to the Play Framework Application with OIDC and LoginRadius. I will be using pac4j and it's play-pac4j integration in this tutorial. Before jumping into the tutorial, let's learn about few concepts. OIDC is an authentication protocol that allows users to verify their identity when they are trying to access a protected HTTPS endpoint. OIDC is an evolutionary development of ideas implemented earlier in OAuth and OpenID. OpenID Connect allows clients to request and receive information about authenticated sessions and end-users. It allows all types of clients, including You can find out more details about OIDC here Play Framework is an open-source web application framework that follows the model–view–controller architectural pattern. It is written in Scala and usable from other programming languages that are compiled to JVM Bytecode. It makes it easy to build web applications with Java & Scala. Play is based on a lightweight, stateless, web-friendly architecture. Built on Akka, Play provides predictable and minimal resource consumption (CPU, memory, threads) for highly-scalable applications. pac4j is an easy and powerful security engine for Java to authenticate users, get their profiles and manage authorizations in order to secure web applications and web services. It provides a comprehensive set of concepts and components. It is based on Java and available under the Apache 2 license. It is available for most frameworks/tools and supports most authentication/authorization mechanisms. pac4j is supported with most of the Java frameworks like There are multiple options you can get started with the Play framework. For this tutorial, I will be using creating a new play project using You can find Installation steps for Windows and Linux here. For this tutorial, I will be using Create a new java play project using the following command The above command will prompt you to fill in the project Now that the project is created with a base template. You can test it by running the project using the following command from Now visit Add pac4j dependencies, Java 11 as required, and target version to compile the project in Create In After adding the above methods Now we already added methods in Finally, configure the variables mentioned in Login to your LoginRadius account or signup here if you don't have one. Once you log in you can see by default, one application will be created for you. Otherwise, you can create a new application here from the following screen by clicking I will be using the existing application itself for this demo as I am using a free plan. In the free plan, you can create only one application (no need for card details). Upgrade your application subscription to the Now click on Once you configure these Let's run our application using Now click on the On successful login from the above step, you will be redirected to the play-pac4j provides out of the box So to use this LogoutController, we just need to initialize it and define logout route for the same in our On Clicking You can see the full source code for the application developed in this tutorial on GitHub. PKCE is an OAuth 2.0 security extension for public clients on mobile devices intended to avoid a malicious programme creeping into the same computer from intercepting the authorisation code. The RFC 7636 introduction discusses the mechanisms of such an attack. PKCE has a different specification of its own. It allows applications to use the most reliable OAuth 2.0 flows in public or untrusted clients - the Authorization Code flow. In order to efficiently use a dynamically generated password, it achieves this by doing some setup work before the flow and some verification at the end of the flow. This is important because getting a fixed secret in a public client is not safe. In this blog, we will see how PKCE is useful in authorization code flow for OAuth and OIDC and how you can use this with your OAuth and OpenID Connect providers. Proof Key for Code Exchange as known as PKCE, is a key for preventing malicious attacks and securely performing code authorization flow. I would say, PKCE is used to provide one more security layer to the authorization code flow in OAuth and OpenID Connect. PKCE is mainly useful for the client-side application or any web apps that are using the client secret key and used to replace the static secret used in the authorization flow. This flow basically works with two parameters Code Verifier and Code challenge. Let's see what are these parameters, how we use them, and generate them. The code verifier is a cryptographically random string using the characters A-Z, a-z, 0-9, and the punctuation characters -._~ (hyphen, period, underscore, and tilde), between 43 and 128 characters long.\nOnce the client has generated the code verifier, it uses that to create the code challenge. For devices that can perform a SHA256 hash, the code challenge is a BASE64-URL-encoded string of the SHA256 hash of the code verifier. Here you can see the examples to generate the Code verifier and code challenge in different languages. Either you can find Node and Go Packages for this but I would recommend you to not depend on any package for such small things. NodeJs Golang In the OAuth Authorization flow, we need to have the code verifier and code challenge to start with the authentication and obviously an OAuth provider to connect. For the initial request, we need to pass the codechallenge and codechallenge_method to the OAuth or OIDC provider that supports PKCE based flow. The request will look like: The provider should redirect you to the authentication/login page and where you’ll get the code after successful authentication. In the code exchange request, we need to pass the code we have received through the above request and the code verifier that we have generated in our first step. Once the codeverificer hash matches with the codechallenge of the authorization request, You will get the token in the response with status code 200 OK. That's it and you've implemented PKCE flow in your application.\n
\nWhitelisting the Domain of Your Application
\nTo access Web Apps in Deployment, follow these steps:
\n\n
\nNow, to add a new site:
\n\n
\nhttps://localhost:8080\").Whitelisting Domain from OIDC Application Configuration
\n\n
\nSetting Up the Provider Object and the OAuthconfig with the Loginradius OIDC App Credentials
\n
\nprovider, err := oidc.NewProvider(ctx, "`https://api.loginradius.com/{oidcappname}")`\nif err != nil {\n // handle error\n}\n\n// Configure an OpenID Connect aware OAuth2 client.\noauth2Config := oauth2.Config{\n ClientID: your-oidc-clientID,\n ClientSecret: your-oidc-clientSecret\n RedirectURL: redirectURL,\n\n // Discovery returns the OAuth2 endpoints.\n Endpoint: provider.Endpoint(),\n\n // "openid" is a required scope for OpenID Connect flows.\n Scopes: []string{oidc.ScopeOpenID, "profile", "email"},\n}https://{siteUrl}/service/oidc/{OidcAppName}go-oidc:\n
\nHandle the Callback Hit
\n
\nvar verifier = provider.Verifier(&oidc.Config{ClientID: clientID})\n\nfunc handleOAuth2Callback(ctx *gin.context) {\n // Verify state and errors.\n authCode := ctx.query("code")\n\n oauth2Token, err := oauth2Config.Exchange(ctx, authCode)\n if err != nil {\n // handle error\n }\n\n // Extract the ID Token from the OAuth2 token.\n rawIDToken, ok := oauth2Token.Extra("id_token").(string)\n if !ok {\n // handle missing token\n }\n\n // Parse and verify ID Token payload.\n idToken, err := verifier.Verify(ctx, rawIDToken)\n if err != nil {\n // handle error\n }\n\n // Extract custom claims\n var claims struct {\n Email string `json:"email"`\n Verified bool `json:"email_verified"`\n }\n if err := idToken.Claims(&claims); err != nil {\n // handle error\n }\n}Gin Golang Code
\ngo-oidc library, you can efficiently implement OIDC authentication in the Go backend, guaranteeing users a smooth and secure authentication process.
\ngo get github.com/coreos/go-oidc/v3/oidc
\npackage main\n\nimport (\n\t"encoding/json"\n\t"fmt"\n\t"io"\n\t"log"\n\t"net/http"\n\t"os"\n\n\t"github.com/coreos/go-oidc/v3/oidc"\n\t"github.com/gin-gonic/gin"\n\t"golang.org/x/oauth2"\n)\n\n// Define global OAuth2 configuration and OIDC provider.\nvar (\n\toauthConfig = &oauth2.Config{\n\t\tClientID: "your-client-id", // Replace with your LoginRadius Client ID\n\t\tRedirectURL: "http://localhost:8080/api/callback",\n\t\tClientSecret: "your-client-secret", // Replace with your LoginRadius Client Secret\n\t\tScopes: []string{"user"},\n\t}\n\tglobalProvider *oidc.Provider\n\tglobalOuthConfig *oauth2.Config\n)\n\n// Server struct holds interfaces like HTTP server, DBHelper, ServerProvider, MongoDB client, etc.\ntype Server struct {\n\n}\n\n// InitializeOAuthConfig sets up the global OAuth2 configuration and OIDC provider.\nfunc InitializeOAuthConfig() {\n\t// Create a new OIDC provider using the OAuth2 endpoint and OIDC provider URL.\n\tprovider, err := oidc.NewProvider(context.Background(), "https://<siteUrl>/service/oidc/<OidcAppName>") // Replace with your OIDC Provider URL\n\tif err!= nil {\n\t\tlog.Fatalf("Failed to create new provider: %v", err)\n\t}\n\tglobalProvider = provider\n\n\t// Set up the OAuth2 configuration with the client ID, secret, redirect URL, and scopes.\n\toauth2Config := &oauth2.Config{\n\t\tClientID: oauthConfig.ClientID,\n\t\tClientSecret: oauthConfig.ClientSecret,\n\t\tRedirectURL: oauthConfig.RedirectURL,\n\t\tEndpoint: provider.Endpoint(),\n\t\tScopes: []string{oidc.ScopeOpenID, "profile", "email"},\n\t}\n\tglobalOuthConfig = oauth2Config\n}\n\n// StartLoginProcess initiates the login process by redirecting the user to the OIDC provider.\nfunc StartLoginProcess(ctx *gin.Context) {\n\t// Generate the authorization URL for the OIDC provider.\n\tauthURL := globalOuthConfig.AuthCodeURL("state", oidc.Nonce(""))\n\t// Redirect the user to the OIDC provider for authentication.\n\thttp.Redirect(ctx.Writer, ctx.Request, authURL, http.StatusFound)\n}\n\n// HandleCallback processes the callback from the OIDC provider after the user has authenticated.\nfunc HandleCallback(ctx *gin.Context) {\n\t// Retrieve the authorization code from the query parameters.\n\tcode := ctx.Query("code")\n\n\t// Exchange the authorization code for an access token.\n\toauth2Token, err := globalOuthConfig.Exchange(ctx, code)\n\tif err!= nil {\n\t\tlog.Printf("Error exchanging code for token: %v", err)\n\t\treturn\n\t}\n\n\t// Extract the ID token from the OAuth2 token.\n\trawIDToken, ok := oauth2Token.Extra("id_token").(string)\n\tif!ok {\n\t\tlog.Println("Missing ID token")\n\t\treturn\n\t}\n\n\t// Verify the ID token using the OIDC provider.\n\tvar verifier = globalProvider.Verifier(&oidc.Config{ClientID: globalOuthConfig.ClientID, SkipClientIDCheck: true})\n\n\tidToken, err := verifier.Verify(ctx, rawIDToken)\n\tif err!= nil {\n\t\tlog.Printf("Error verifying ID token: %v", err)\n\t\treturn\n\t}\n\n\t// Extract claims from the verified ID token.\n\tvar claims interface{}\n\tif err := idToken.Claims(&claims); err!= nil {\n\t\tlog.Printf("Error extracting claims: %v", err)\n\t\treturn\n\t}\n\n\t// Respond with a success message.\n\tctx.JSON(http.StatusOK, gin.H{"message": "success"})\n}\n\n// InjectRoutes sets up the routes for the application, including login and callback endpoints.\nfunc (srv *Server) InjectRoutes() *gin.Engine {\n\trouter := gin.Default()\n\n\tapi := router.Group("/api")\n\t{\n\t\t// Define the login route that redirects users to the OIDC provider for authentication.\n\t\tapi.GET("/login", StartLoginProcess)\n\t\t// Define the callback route that handles the callback from the OIDC provider.\n\t\tapi.GET("/callback", HandleCallback)\n\t}\n\n\treturn router\n}\n\nfunc main() {\n\t// Initialize the OAuth2 configuration and OIDC provider.\n\tInitializeOAuthConfig()\n\t// Create a new server instance.\n\tserver := &Server{}\n\t// Inject routes into the Gin engine.\n\trouter := server.InjectRoutes()\n\t// Start the HTTP server.\n\tlog.Fatal(http.ListenAndServe(":8080", router))\n}Initialization of OIDC Provider and OAuth2 Configuration
\n\n
\noidc.NewProvider function, which requires the OAuth2 endpoint and the OIDC provider's URL. This step is crucial for establishing a connection with the OIDC provider, enabling the application to authenticate users through the provider.oauthConfig) is set up with essential details such as the client ID, client secret, redirect URL, and scopes. These credentials are specific to the OIDC application registered with the provider (e.g., LoginRadius). The redirect URL is where the provider will send the user after authentication, and the scopes define the permissions requested from the user.Setting Up the Callback Endpoint
\n\n
\n/api/callback. This endpoint handles the callback from the OIDC provider after the user has been authenticated.Verifying the Access Token and Extracting User Claims
\n\n
\nConclusion
\nWhat is OpenID Connect (OIDC) Protocol?
\n\n
\nWhat is Play Framework?
\nWhat is pac4j?
\n\n
\nGetting started
\n\n
\nsbt.sbt.Install sbt on Mac OS
\n
\nbrew install sbtPrerequisites
\n\n
\nCreate New Play Project
\n
\nsbt new playframework/play-java-seed.g8name and project package structure in organization as shown below.
\n[info] welcome to sbt 1.5.3 (Oracle Corporation Java 11.0.2)\n[info] set current project to new (in build file:/private/var/folders/_9/rcqwq2vx1cl_1sc4xdhb5_5c0000gn/T/sbt_661d1bf7/new/)\n\nThis template generates a Play Java project\n\nname [play-java-seed]: loginradius-play-oidc\norganization [com.example]: com.loginradius.developer\n\nTemplate applied in /Users/vishnuchilamakuru/self/longinradius/./loginradius-play-oidcRun Play Project
\nloginradius-play-oidc folder.
\nsbt runhttp://localhost:9000, and it should look like this.Integrate pac4j with Play Project
\n1. Add pac4j dependencies to
\nbuild.sbtbuild.sbt.
\nname := """loginradius-play-oidc"""\norganization := "com.loginradius.developer"\n\nversion := "1.0-SNAPSHOT"\n\nlazy val root = (project in file(".")).enablePlugins(PlayJava)\n\nscalaVersion := "2.13.6"\n\ninitialize := {\n val _ = initialize.value // run the previous initialization\n val required = "11"\n val current = sys.props("java.specification.version")\n assert(current == required, s"Unsupported JDK: java.specification.version $current != $required")\n}\n\nscalacOptions += "-target:jvm-11"\n\njavacOptions ++= Seq("-source", "11", "-target", "11")\n\n\nlibraryDependencies ++= Seq(\n guice,\n ehcache,\n "org.pac4j" %% "play-pac4j" % "11.0.0-PLAY2.8",\n "org.pac4j" % "pac4j-oidc" % "5.1.0",\n "com.typesafe.play" % "play-cache_2.13" % "2.8.8",\n "com.fasterxml.jackson.module" %% "jackson-module-scala" % "2.12.3"\n)2. Create Security Module
\napp/modules/SecurityModule.java. This class configures OIDC, sets up a secure HttpActionAdapter, and registers callback and logout controllers.\n
\n
\npackage modules;\n\nimport com.google.inject.AbstractModule;\n\nimport com.nimbusds.oauth2.sdk.ParseException;\nimport com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;\nimport com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;\nimport com.typesafe.config.Config;\nimport net.minidev.json.JSONObject;\nimport org.pac4j.core.authorization.authorizer.RequireAnyRoleAuthorizer;\nimport org.pac4j.core.client.Clients;\nimport org.pac4j.core.context.session.SessionStore;\nimport org.pac4j.oidc.client.OidcClient;\nimport org.pac4j.oidc.config.OidcConfiguration;\nimport org.pac4j.play.CallbackController;\nimport org.pac4j.play.LogoutController;\nimport org.pac4j.play.http.PlayHttpActionAdapter;\nimport org.pac4j.play.store.PlayCacheSessionStore;\nimport play.Environment;\n\nimport java.util.Optional;\n\npublic class SecurityModule extends AbstractModule {\n\n private final Config configuration;\n\n public SecurityModule(final Environment environment, final Config configuration) {\n this.configuration = configuration;\n }\n\n @Override\n protected void configure() {\n\n bind(SessionStore.class).to(PlayCacheSessionStore.class);\n\n final OidcConfiguration oidcConfiguration = new OidcConfiguration();\n oidcConfiguration.setDiscoveryURI(configuration.getString("oidc.discoveryUri"));\n oidcConfiguration.setClientId(configuration.getString("oidc.clientId"));\n oidcConfiguration.setSecret(configuration.getString("oidc.clientSecret"));\n oidcConfiguration.setClientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC);\n\n addProviderMetadata(oidcConfiguration);\n\n final OidcClient oidcClient = new OidcClient(oidcConfiguration);\n oidcClient.addAuthorizationGenerator((ctx, session, profile) -> {\n profile.addRole("ROLE_ADMIN");\n return Optional.of(profile);\n });\n\n final String baseUrl = configuration.getString("baseUrl");\n final Clients clients = new Clients(baseUrl + "/callback", oidcClient);\n\n final org.pac4j.core.config.Config config = new org.pac4j.core.config.Config(clients);\n config.addAuthorizer("admin", new RequireAnyRoleAuthorizer("ROLE_ADMIN"));\n config.setHttpActionAdapter(PlayHttpActionAdapter.INSTANCE);\n bind(org.pac4j.core.config.Config.class).toInstance(config);\n\n // callback\n final CallbackController callbackController = new CallbackController();\n callbackController.setDefaultUrl("/");\n bind(CallbackController.class).toInstance(callbackController);\n\n // logout\n final LogoutController logoutController = new LogoutController();\n logoutController.setDefaultUrl("/?defaulturlafterlogout");\n bind(LogoutController.class).toInstance(logoutController);\n\n }\n\n private void addProviderMetadata(OidcConfiguration oidcConfiguration) {\n JSONObject jsonObj = new JSONObject();\n jsonObj.appendField("token_endpoint", configuration.getString("oidc.tokenUri"));\n final OIDCProviderMetadata providerMetaData;\n try {\n providerMetaData = OIDCProviderMetadata.parse(jsonObj);\n oidcConfiguration.setProviderMetadata(providerMetaData);\n } catch (ParseException e) {\n e.printStackTrace();\n }\n }\n}3. Create Secured Endpoint in Controller
\napp/controllers/HomeController.java add the following methods\n
\nHomeController.java looks like this.
\npackage controllers;\n\nimport com.google.inject.Inject;\nimport org.pac4j.core.context.session.SessionStore;\nimport org.pac4j.core.profile.ProfileManager;\nimport org.pac4j.core.profile.UserProfile;\nimport org.pac4j.play.context.PlayContextFactory;\nimport org.pac4j.play.java.Secure;\nimport org.pac4j.play.store.PlayCacheSessionStore;\nimport play.mvc.*;\n\nimport java.util.ArrayList;\nimport java.util.List;\n\n/**\n * This controller contains an action to handle HTTP requests\n * to the application's home page.\n */\npublic class HomeController extends Controller {\n\n /**\n * An action that renders an HTML page with a welcome message.\n * The configuration in the <code>routes</code> file means that\n * this method will be called when the application receives a\n * <code>GET</code> request with a path of <code>/</code>.\n */\n public Result index() {\n return ok(views.html.index.render());\n }\n\n @Secure(clients = "OidcClient")\n public Result oidcIndex(Http.Request req) {\n return protectedIndex(req);\n }\n\n public Result protectedIndex(Http.Request req) {\n return ok(views.html.protectedindex.render(getProfiles(req)));\n }\n\n @Inject\n private SessionStore sessionStore;\n\n private List<UserProfile> getProfiles(Http.Request req) {\n final ProfileManager profileManager = new ProfileManager(PlayContextFactory.INSTANCE.newContext(req), sessionStore);\n final List<UserProfile> profiles = new ArrayList<>();\n if (profileManager.getProfile().isPresent()) {\n profiles.add(profileManager.getProfile().get());\n }\n return profiles;\n }\n\n}4. Create Views
\n\n
\napp/views/index.scala.html as follows to add the link protected by OIDC authentication.
\n@()\n\n@main("Welcome to Play") {\n <h1>Welcome to Play!</h1>\n\n <a href="oidc/index.html">Protected URL by OIDC</a>\n}\n
\napp/views/protectedindex.scala.html with the following content below. This page will be shown after Successful Login using OIDC in LoginRadius.
\n@(profileList: java.util.List[org.pac4j.core.profile.UserProfile])\n@import scala.collection.JavaConverters._\n@profiles() = { @profileList.toList }\n<h1>Protected Area</h1>\n<a href="..">Back</a>\n<ul>\n <li><a href="/logout?url=/?forcepostlogouturl">Logout</a></li>\n</ul>\n\n<p>\n profiles: @profiles\n</p>5. Configure Routes
\nHomeController.java and configured callback, logout controllers in SecurityModule.java. Let's configure the routes to map to these methods in conf/routes.\n
\nconf/routes will look like this.
\n# Routes\n# This file defines all application routes (Higher priority routes first)\n# ~~~~\n\n# An example controller showing a sample home page\nGET / controllers.HomeController.index\nGET /oidc/index.html controllers.HomeController.oidcIndex(request: Request)\nGET /protected/index.html controllers.HomeController.protectedIndex(request: Request)\nGET /callback @org.pac4j.play.CallbackController.callback(request: Request)\nPOST /callback @org.pac4j.play.CallbackController.callback(request: Request)\nGET /logout @org.pac4j.play.LogoutController.logout(request: Request)\n\n\n# Map static resources from the /public folder to the /assets URL path\nGET /assets/*file controllers.Assets.versioned(path="/public", file: Asset)6. Add Application Configuration variables
\nSecurityModule.java in conf/application.conf as follows.
\nplay {\n modules {\n enabled += modules.SecurityModule\n }\n}\n\nbaseUrl = "http://localhost:9000"\n\noidc.discoveryUri = "https://cloud-api.loginradius.com/sso/oidc/v2/{loginradius-site-name}/{loginradius-app-name}/.well-known/openid-configuration"\noidc.clientId = "{clientId}"\noidc.clientSecret = "{clientSecret}"\noidc.tokenUri = "https://cloud-api.loginradius.com/sso/oidc/v2/{loginradius-site-name}/token"Create an OIDC app in LoginRadius
\nNew App.Developer Pro Plan to configure OIDC. (Developer Pro Plan is available with 21 days trial).Select & Configure on your application and navigate to the Integration Section and Configure Open ID configuration. You can find step-by-step details to configure OIDC here.conf/application.conf will look something like this.
\n# This is the main configuration file for the application.\n# https://www.playframework.com/documentation/latest/ConfigFile\n\nplay {\n modules {\n enabled += modules.SecurityModule\n }\n}\n\nbaseUrl = "http://localhost:9000"\n\noidc.discoveryUri = "https://cloud-api.loginradius.com/sso/oidc/v2/dev-svv3qlcj2y/pac4j-play-loginradius-demo/.well-known/openid-configuration"\noidc.clientId = "8ce24413-9b7e-4282-9f5b-e0e5ec13a42a"\noidc.clientSecret = "c9c61f6e-325f-40d6-89fd-696d17f970eb"\noidc.tokenUri = "https://cloud-api.loginradius.com/sso/oidc/v2/dev-svv3qlcj2y/token"\n# Site Name - dev-svv3qlcj2y\n# App Name - pac4j-play-loginradius-demoTime to test complete Integration
\nsbt clean run and visit http://localhost:9000. The Home page will look like this.Home Page
\nLoginRadius Auth Page (IDX)
\nprotected url by OIDC link on the home page that will redirect you to the LoginRadius Auth Page (IDX), which you configured.Redirect to Protected Index Page
\nprotectedindex.scala.html page.Logout Action
\nLogoutController which can be used to handle logout flows. It has logout functionality which has the logout logic implementation to clear the session. Below is the sample logout functionality from org.pac4j.play.LogoutController play-pac4j module.
\n public CompletionStage<Result> logout(final Http.Request request) {\n\n final HttpActionAdapter bestAdapter = FindBest.httpActionAdapter(null, config, PlayHttpActionAdapter.INSTANCE);\n final LogoutLogic bestLogic = FindBest.logoutLogic(logoutLogic, config, DefaultLogoutLogic.INSTANCE);\n\n final WebContext context = FindBest.webContextFactory(null, config, PlayContextFactory.INSTANCE).newContext(request);\n\n return CompletableFuture.supplyAsync(() -> (Result) bestLogic.perform(context, sessionStore, config, bestAdapter, this.defaultUrl,\n this.logoutUrlPattern, this.localLogout, this.destroySession, this.centralLogout), ec.current());\n }routes. We already initialized LoginController in SecurityModule.java.a. Initialize LogoutController
\n\n
\nlogout action.
\n // logout\n final LogoutController logoutController = new LogoutController();\n logoutController.setDefaultUrl("/?defaulturlafterlogout");\n bind(LogoutController.class).toInstance(logoutController);b. Define Route for LogoutController
\n\n
\n/logout Route using LogoutController in conf/routes.
\nGET /logout @org.pac4j.play.LogoutController.logout(request: Request)logout in our application, the session will be cleared and you will be redirected to the Home page based on our configuration. Source Code
\nWhat is PKCE
\nPKCE code verifier and challenge
\nGenerate code verifier and code challenge
\n
\nvar crypto = require("crypto")\n\nfunction base64URLEncode(str) {\n return str.toString('base64')\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_')\n .replace(/=/g, '');\n}\nvar verifier = base64URLEncode(crypto.randomBytes(32));\nconsole.log("code_verifier: ", verifier)\n\nif(verifier){\n var challenge = base64URLEncode(sha256(verifier));\n console.log("code_challenge: ",challenge)\n}\n\n\nfunction sha256(buffer) {\n return crypto.createHash('sha256').update(buffer).digest();\n}
\npackage main\n \nimport (\n "crypto/sha256"\n "encoding/base64"\n "fmt"\n "math/rand"\n "strings"\n "time"\n)\n \ntype CodeVerifier struct {\n Value string\n}\n \nconst (\n length = 32\n)\n \nfunc base64URLEncode(str []byte) string {\n encoded := base64.StdEncoding.EncodeToString(str)\n encoded = strings.Replace(encoded, "+", "-", -1)\n encoded = strings.Replace(encoded, "/", "_", -1)\n encoded = strings.Replace(encoded, "=", "", -1)\n return encoded\n}\n \nfunc verifier() (*CodeVerifier, error) {\n r := rand.New(rand.NewSource(time.Now().UnixNano()))\n b := make([]byte, length, length)\n for i := 0; i < length; i++ {\n b[i] = byte(r.Intn(255))\n }\n return CreateCodeVerifierFromBytes(b)\n}\n \nfunc CreateCodeVerifierFromBytes(b []byte) (*CodeVerifier, error) {\n return &CodeVerifier{\n Value: base64URLEncode(b),\n }, nil\n}\n \nfunc (v *CodeVerifier) CodeChallengeS256() string {\n h := sha256.New()\n h.Write([]byte(v.Value))\n return base64URLEncode(h.Sum(nil))\n}\n \nfunc main() {\n verifier, _ := verifier()\n fmt.Println("code_verifier: ", verifier.Value)\n challenge := verifier.CodeChallengeS256()\n fmt.Println("code_challenge :", challenge)\n}\n Implement the OAuth 2.0 Authorization Code with PKCE Flow
\nGet the Authorization code
\n
\nProvider + /oauth/redirect?\nclient_id={client_id}\n&redirect_uri={Callback URL}\n&scope={Scope}\n&response_type=code\n&state={random long string}\n&code_challenge={code challenge}\n&code_challenge_method=SHA256Code Exchange
\n
\nPOST Provider + /oauth/access_token\n\nRequest body:\n{\n client_id:{client_id},\n client_secret:{client_secret},\n redirect_uri:{redirect_uri},\n response_type:token,\n Code:{code} // That we have received in authorization request\n code_verifier: {code verifier // generated in the first step\n}
\n{\n "access_token": "c5a****b-****-4*7f-a********e4a",\n "token_type": "access_token",\n "refresh_token": "5*****82-b***-**82-8c*1-*******7ce",\n "expires_in": 11972\n}