OidcSupport now sends redirect-uri in token requests.

examples/security/oidc/README.md

@@ -0,0 +1,23 @@
+Security integration with OIDC
+===================
+
+This example demonstrates integration with OIDC (Open ID Connect) providers.
+
+Contents
+--------
+MP example that integrates with an OIDC provider.
+
+To configure this example, you need to replace the following:
+1. src/main/resources/application.yaml - set security.properties.oidc-* to your tenant and application configuration
+
+Running the Example
+-------------------
+
+Run the "OidcMain" class for file configuration based example.
+
+
+Local configuration
+------------------
+The example is already set up to read
+`${user.home}/helidon/conf/examples.yaml` to override defaults configured
+in `application.yaml`.

examples/security/oidc/pom.xml

@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Copyright (c) 2019 Oracle and/or its affiliates. All rights reserved.
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>io.helidon.examples.security</groupId>
+        <artifactId>helidon-examples-security-project</artifactId>
+        <version>1.0.4-SNAPSHOT</version>
+    </parent>
+
+    <artifactId>oidc-login</artifactId>
+    <name>Helidon Security Examples OIDC</name>
+
+    <description>
+        Example of login using (any) OIDC provider.
+    </description>
+
+    <properties>
+        <mainClass>io.helidon.security.examples.oidc.OidcMain</mainClass>
+    </properties>
+
+    <dependencies>
+        <!-- Helidon MicroProfile -->
+        <dependency>
+            <groupId>io.helidon.microprofile.bundles</groupId>
+            <artifactId>helidon-microprofile-1.2</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <!-- Helidon MicroProfile Security -->
+        <dependency>
+            <groupId>io.helidon.microprofile</groupId>
+            <artifactId>helidon-microprofile-security</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>io.helidon.microprofile</groupId>
+            <artifactId>helidon-microprofile-oidc</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+    </dependencies>
+
+</project>

examples/security/oidc/src/main/java/io/helidon/security/examples/oidc/OidcMain.java

@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2019 Oracle and/or its affiliates. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.helidon.security.examples.oidc;
+
+import java.io.IOException;
+import java.util.logging.LogManager;
+
+import io.helidon.config.Config;
+import io.helidon.microprofile.server.Server;
+
+import static io.helidon.config.ConfigSources.classpath;
+import static io.helidon.config.ConfigSources.file;
+
+/**
+ * Main class for MP.
+ */
+public final class OidcMain {
+    private OidcMain() {
+    }
+
+    /**
+     * Start the application.
+     * @param args ignored.
+     * @throws IOException in case the logging configuration fails
+     */
+    public static void main(String[] args) throws IOException {
+        LogManager.getLogManager().readConfiguration(OidcMain.class.getResourceAsStream("/logging.properties"));
+
+        Server server = Server.builder()
+                .config(buildConfig())
+                .build()
+                .start();
+
+        System.out.println("http://localhost:" + server.port() + "/test");
+    }
+
+    private static Config buildConfig() {
+        return Config.builder()
+                .sources(
+                        // you can use this file to override the defaults that are built-in
+                        file(System.getProperty("user.home") + "/helidon/conf/examples.yaml").optional(),
+                        // in jar file (see src/main/resources/application.yaml)
+                        classpath("application.yaml"))
+                .build();
+    }
+}

examples/security/oidc/src/main/java/io/helidon/security/examples/oidc/OidcResource.java

@@ -0,0 +1,43 @@
+/*
+ * Copyright (c) 2019 Oracle and/or its affiliates. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.helidon.security.examples.oidc;
+
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.core.Context;
+
+import io.helidon.security.SecurityContext;
+import io.helidon.security.annotations.Authenticated;
+
+/**
+ * A simple JAX-RS resource with a single GET method.
+ */
+@Path("/test")
+public class OidcResource {
+
+    /**
+     * Hello world using security context.
+     * @param securityContext context as established during login
+     * @return a string with current username
+     */
+    @Authenticated
+    @GET
+    public String getIt(@Context SecurityContext securityContext) {
+        return "Hello " + securityContext.userName();
+    }
+
+}

examples/security/oidc/src/main/java/io/helidon/security/examples/oidc/OidcTestApplication.java

@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2019 Oracle and/or its affiliates. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.helidon.security.examples.oidc;
+
+import java.util.Set;
+
+import javax.enterprise.context.ApplicationScoped;
+import javax.ws.rs.ApplicationPath;
+import javax.ws.rs.core.Application;
+
+import io.helidon.common.CollectionsHelper;
+
+/**
+ * A simple JAX-rs application that just returns the single {@link io.helidon.security.examples.oidc.OidcResource resource}.
+ */
+@ApplicationScoped
+@ApplicationPath("/")
+public class OidcTestApplication extends Application {
+
+    @Override
+    public Set<Class<?>> getClasses() {
+        return CollectionsHelper.setOf(OidcResource.class);
+    }
+}

examples/security/oidc/src/main/java/io/helidon/security/examples/oidc/package-info.java

@@ -0,0 +1,19 @@
+/*
+ * Copyright (c) 2019 Oracle and/or its affiliates. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * An OIDC (Open ID Connect) example.
+ */
+package io.helidon.security.examples.oidc;

examples/security/oidc/src/main/resources/META-INF/beans.xml

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Copyright (c) 2019 Oracle and/or its affiliates. All rights reserved.
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
+       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
+                           http://xmlns.jcp.org/xml/ns/javaee/beans_2_0.xsd"
+       bean-discovery-mode="annotated">
+</beans>

examples/security/oidc/src/main/resources/application.yaml

@@ -0,0 +1,49 @@
+#
+# Copyright (c) 2019 Oracle and/or its affiliates. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+server:
+  port: 7987
+security:
+  config.require-encryption: false
+  properties:
+    # this should be defined by the identity server
+    oidc-identity-uri: "https://tenant.some-server.com/oauth2/default"
+    # when you create a new client in identity server configuration, you should get a client id and a client secret
+    oidc-client-id: "some client id"
+    oidc-client-secret: "some client secret"
+    # issuer of the tokens - identity server specific (maybe even configurable)
+    oidc-issuer: "https://tenant.some-server.com/oauth2/default"
+    # audience of the tokens - identity server specific (usually configurable)
+    oidc-audience: "configured audience"
+    # The frontend URI defines the possible load balancer address
+    # The redirect URI used is ${frontend-uri}${redirect-uri}
+    # Webserver is by default listening on /oidc/redirect - this can be modified by `redirect-uri` option in oidc configuration
+    frontend-uri: "http://localhost:7987"
+  providers:
+    - abac:
+    - oidc:
+        # use a custom name, so it does not clash with other examples
+        cookie-name: "OIDC_EXAMPLE_COOKIE"
+        # support for "Authorization" header with bearer token
+        header-use: true
+        # the default redirect-uri, where the webserver listens on redirects from identity server
+        redirect-uri: "/oidc/redirect"
+        issuer: "${ALIAS=security.properties.oidc-issuer}"
+        audience: "${ALIAS=security.properties.oidc-audience}"
+        client-id: "${ALIAS=security.properties.oidc-client-id}"
+        client-secret: "${ALIAS=security.properties.oidc-client-secret}"
+        identity-uri: "${ALIAS=security.properties.oidc-identity-uri}"
+        frontend-uri: "${ALIAS=security.properties.frontend-uri}"

examples/security/oidc/src/main/resources/logging.properties

@@ -0,0 +1,26 @@
+#
+# Copyright (c) 2019 Oracle and/or its affiliates. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+handlers = java.util.logging.ConsoleHandler
+
+java.util.logging.ConsoleHandler.level = FINEST
+java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
+java.util.logging.SimpleFormatter.format = [%1$tc] %4$s: %2$s - %5$s %6$s%n
+
+.level = INFO
+io.helidon.config.level = WARNING
+# io.helidon.security.providers.oidc.level = FINEST
+AUDIT.level=FINEST

examples/security/pom.xml

@@ -45,6 +45,7 @@
         <module>attribute-based-access-control</module>
         <module>idcs-login</module>
         <module>outbound-override</module>
+        <module>oidc</module>
     </modules>
 
 </project>

security/providers/oidc/src/main/java/io/helidon/security/providers/oidc/OidcSupport.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2019 Oracle and/or its affiliates. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -177,6 +177,7 @@ private void processCode(String code, ServerRequest req, ServerResponse res) {
         MultivaluedHashMap<String, String> formValues = new MultivaluedHashMap<>();
         formValues.putSingle("grant_type", "authorization_code");
         formValues.putSingle("code", code);
+        formValues.putSingle("redirect_uri", oidcConfig.redirectUriWithHost());
 
         Response response = oidcConfig.tokenEndpoint().request()
                 .accept(MediaType.APPLICATION_JSON_TYPE)