OpenID configuration redirects with Tomcat

[Ryan Rumbaugh]

Hi Keith,

We’re not yet using the dynamically generated OIDC metadata, but to add in our openid-configuration file to the .well-known location we just copy a static file to the Tomcat ROOT webapp when we build our container.

You should be able to create a HTML page that performs the HTTP 302 redirect.

This is what is in our Dockerfile --

COPY container_files/opt/shibboleth-idp/static/ /usr/local/tomcat/webapps/ROOT/

The openid-configuration file is in static/.well-known/openid-configuration which keeps the correct directory structure when copying.

--
Ryan Rumbaugh
University of Nebraska


From: users <users-bounces at shibboleth.net> on behalf of Michael Grady <mgrady at unicon.net>
Date: Friday, May 14, 2021 at 3:16 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: OpenID configuration redirects with Tomcat
Non-NU Email



> On May 14, 2021, at 2:57 PM, Wessel, Keith <kwessel at illinois.edu> wrote:
>
> Hi, all,
>
> The new support for (somewhat) dynamically generating OpenID Connect metadata in the IdP is very attractive, and the docs kindly include an example for how to do this in Jetty.
>
> For those of us running the Trusted Access Platform image without Apache fronting it, though, there's the task of doing a redirect with Tomcat from the root webapp into the IdP to make the dynamic OIDC metadata appear at the well-known location. I thought this would be simple... silly me.
>
> I've seen solutions that involve deploying a simple jsp page to my root webapp to handle redirection. I also see that Tomcat has implemented a version of Apache mod_rewrite. Both of those seem a bit heavy for what I'm trying to accomplish here. Anyone have experience in a simple way in Tomcat to redirect /.well-known/openid-configuration into the IdP webapp at /idp/profile/oidc/configuration?
>

Tomcat rewrite is pretty easy to configure, we've used it with multiple clients for CAS endpoints that were not convenient to change in the CAS clients. If you don't come up with another solution.

--
Michael A. Grady
IAM Architect, Unicon, Inc.



--
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=Cu5g146wZdoqVuKpTNsYHeFX_rg6kWhlkLF8Eft-wwo&r=x_uM7qpgXzh_70B3Dgey5pfdCFAWMhq-IedVFyaAIwg&m=oW6N5EV33GvQie48wtHMz2H7qTf0gjAv4VaoB03dO9Q&s=7Wr7t0AE1IncEEdCVBOltSsURoDia1Jxi1nRjaHouZg&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210514/8acb5a13/attachment.htm>