OpenID Connect Support

Since Payara Server 4.1.2.183 and 5.183

The Payara API provides a @OpenIdAuthenticationDefinition annotation that creates an authorization mechanism for OpenID Connect support. This works in the same way as other authorization mechanisms in the Java EE Security API.

Usage

The OpenID Connect authentication mechanism is defined through the @OpenIdAuthenticationDefinition annotation. Specifying this in a valid place as defined by the Java EE Security API will create the mechanism. Often this may mean that any class is a valid position.

Example

Here’s an example that configures a OpenID Connect client:

@OpenIdAuthenticationDefinition(
       providerURI = "https://sample-openid-server.com",
       clientId = "87068hgfg5675htfv6mrucov57bknst.apps.sample.com",
       clientSecret = "{my-secret}",
       redirectURI = "${baseURL}/callback",
       extraParameters = {
            "testKey=testValue",
            "testKey2=testValue2"
       }
)
public class SecurityBean {

}
Once the user is authenticated they will not have any roles defined, regardless of the OpenID Connect scope. Roles should be specified using @DeclareRoles.

See this sample project for a more detailed example.

When defining a OpenID Connect flow within an application deployed on Payara Server, it is possible to retrieve the access token, identity token, user claims and the other authentication information within any bean in the scope of the callback/redirectURI resource used to configure the authentication:

@WebServlet("/callback")
public class CallbackServlet extends HttpServlet {

    @Inject
    OpenIdContext context;

    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        PrintWriter out = response.getWriter();
        //Here's the access token
        out.println(token.getAccessToken());
        //Here's the identity token
        out.println(token.getIdentityToken());
    }
}

Configuration

OpenID Client can be configured with both @OpenIdAuthenticationDefinition annotation attributes and Microprofile Config properties. The annotation and mp config properties has several configuration options.

They are detailed below.

Table 1. Configuration Options
Option MP Config property Required Description Default value Requirements

providerURI

payara.security.openid.providerURI

true

The provider uri to discover the metadata of the OpenID Connect provider.

The endpoint must be HTTPS.

clientId

payara.security.openid.clientId

true

The client identifier issued when the application was registered.

N/A.

clientSecret

payara.security.openid.clientSecret

true

The client secret for the registered application.

N/A.

redirectURI

payara.security.openid.redirectURI

true

The URL to redirect the user to upon successful authentication.

Must be equal to one set in the OpenID Connect provider.

scope

payara.security.openid.scope

false

The scopes requested from the OpenID Connect provider.

{openid, email, profile}

N/A.

responseType

payara.security.openid.responseType

false

Response Type value defines the processing flow to be used.

code

N/A.

responseMode

payara.security.openid.responseMode

false

Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.

N/A.

prompt

payara.security.openid.prompt

false

The prompt value specifies whether the authorization server prompts the user for re-authentication and consent.

N/A.

display

payara.security.openid.display

false

The display value specifying how the authorization server displays the authentication and consent user interface pages.

page

N/A.

useNonce

payara.security.openid.useNonce

false

Enables string value used to mitigate replay attacks.

true

N/A.

useSession

payara.security.openid.useSession

false

If enabled state & nonce value stored in session otherwise in cookies.

true

N/A.

jwksConnectTimeout

payara.security.openid.jwks.connect.timeout

false

Sets the connect timeout(in milliseconds) for Remote JWKS retrieval.

500

Value must not be negative and if value is zero then infinite timeout.

jwksReadTimeout

payara.security.openid.jwks.read.timeout

false

Sets the read timeout(in milliseconds) for Remote JWKS retrieval.

500

Value must not be negative and if value is zero then infinite timeout.

extraParameters

false

An array of extra options to be sent to the OpenID Connect provider.

Must be in the form "key=value".

Note : If both annotation attribute and mp config property defined for same option then Microprofile Config property value always take precedence over @OpenIdAuthenticationDefinition annotation value.

Expression Language Support

Additionally, the @OpenIdAuthenticationDefinition supports the use of expression language (EL) notation for dynamic configuration scenarios. This means that you can use any CDI bean properties to set the OpenID Connect configuration like this:

@OpenIdAuthenticationDefinition(
    providerURI="#{openidConfigBean.tokenEndpointURL}",
    clientId="#{openidConfigBean.clientId}",
    clientSecret="#{openidConfigBean.clientSecret}",
    redirectURI="#{openidConfigBean.redirectURI}"
)
public class SecurityBean {
}

Client Secret Aliasing

The client secret can be input directly, or for added security it can be aliased using any of the following features:

Google and Azure AD integration

The Payara API also provides the in-built support for Google and Azure AD OpenID Provider using the @GoogleAuthenticationDefinition and @AzureAuthenticationDefinition annotations.

Extra Resources

To read more about OpenID Connect itself, visit http://openid.net/specs/openid-connect-core-1_0.html