OpenID configuration redirects with Tomcat

[Wessel, Keith]

Thanks, Mike and Ryan. I decided to bite the bullet and check out the Tomcat rewrite valve which was as easy as Mike said. For the sake of the archives, it was as easy as adding this to my <host> block for localhost in my Tomcat's server.xml:

<Valve className="org.apache.catalina.valves.rewrite.RewriteValve" />

That enables it and tells it to look for a file called $CATALINA_HOME/conf/Catalina/localhost/rewrite.config which should contain this rewrite rule:

RewriteRule ^/\.well-known/openid-configuration$ /idp/profile/oidc/configuration
That causes an internal rewrite to the new, somewhat dynamically generated OIDC OP metadata that's saved in $IDP_HOME/static/openid-configuration.json and augmented dynamically by the IdP. Since it's an internal rewrite, the client never sees a 3XX response which, I suspect, could confuse poorly written clients.

If I get brave later, I'll try and add this config to the wiki page, too.

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Michael Grady
Sent: Friday, May 14, 2021 3:16 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: OpenID configuration redirects with Tomcat



> On May 14, 2021, at 2:57 PM, Wessel, Keith <kwessel at illinois.edu> wrote:
> 
> Hi, all,
> 
> The new support for (somewhat) dynamically generating OpenID Connect metadata in the IdP is very attractive, and the docs kindly include an example for how to do this in Jetty.
> 
> For those of us running the Trusted Access Platform image without Apache fronting it, though, there's the task of doing a redirect with Tomcat from the root webapp into the IdP to make the dynamic OIDC metadata appear at the well-known location. I thought this would be simple... silly me.
> 
> I've seen solutions that involve deploying a simple jsp page to my root webapp to handle redirection. I also see that Tomcat has implemented a version of Apache mod_rewrite. Both of those seem a bit heavy for what I'm trying to accomplish here. Anyone have experience in a simple way in Tomcat to redirect /.well-known/openid-configuration into the IdP webapp at /idp/profile/oidc/configuration?
> 

Tomcat rewrite is pretty easy to configure, we've used it with multiple clients for CAS endpoints that were not convenient to change in the CAS clients. If you don't come up with another solution.

--
Michael A. Grady
IAM Architect, Unicon, Inc.



-- 
For Consortium Member technical support, see https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/x/coFAAg__;!!DZ3fjg!vUOiPgN-1q7KQbW0YQHgX5AAD-UNw_5baLRSkn5WCKlaoe4E5btlUYjbABqTcAVi4g$ 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net