OpenID configuration redirects with Tomcat

[Michael Grady]

> On May 14, 2021, at 2:57 PM, Wessel, Keith <kwessel at illinois.edu> wrote:
> 
> Hi, all,
> 
> The new support for (somewhat) dynamically generating OpenID Connect metadata in the IdP is very attractive, and the docs kindly include an example for how to do this in Jetty.
> 
> For those of us running the Trusted Access Platform image without Apache fronting it, though, there's the task of doing a redirect with Tomcat from the root webapp into the IdP to make the dynamic OIDC metadata appear at the well-known location. I thought this would be simple... silly me.
> 
> I've seen solutions that involve deploying a simple jsp page to my root webapp to handle redirection. I also see that Tomcat has implemented a version of Apache mod_rewrite. Both of those seem a bit heavy for what I'm trying to accomplish here. Anyone have experience in a simple way in Tomcat to redirect /.well-known/openid-configuration into the IdP webapp at /idp/profile/oidc/configuration?
> 

Tomcat rewrite is pretty easy to configure, we've used it with multiple clients for CAS endpoints that were not convenient to change in the CAS clients. If you don't come up with another solution.

--
Michael A. Grady
IAM Architect, Unicon, Inc.