FW: GraphDB OIDC
Mathew, Sunil
smathew at hbs.edu
Sat Apr 4 17:03:09 UTC 2026
Hi,
I am enabling OIDC in our Shibboleth IdP 5.1.4. Claude gave me these as the steps. Can you please confirm this looks correct?
Appreciate your help.
Regards,
Sunil
Part 1: Shibboleth IdP Side
1. Install the OIDC OP Plugin
The OIDC OP plugin is an officially supported plugin for Shibboleth IdP v4.1 and above. It must be installed using the plugin command: Atlassian<https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
bash
/opt/shibboleth-idp/bin/plugin.sh -I net.shibboleth.idp.plugin.oidc.op
This plugin depends on the Shibboleth OIDC Common plugin (OIDCCommon) and OIDCConfig (since v3.4.0), which must be installed first. Atlassian<https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
________________________________
2. Enable the OIDC Module
Once the plugin has been installed, verify or enable the module: Atlassian<https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
bash
/opt/shibboleth-idp/bin/module.sh -e idp.oidc.OP
________________________________
3. Initial Configuration Files (conf/credentials.xml)
Add an import for OIDC credentials into conf/credentials.xml: Atlassian<https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
xml
<!-- OIDC extension default credential definitions -->
<import resource="oidc-credentials.xml" />
Also enable auto-loading of properties by setting in idp.properties:
properties
idp.searchForProperties=true
________________________________
4. Generate Signing & Encryption Keys
The default configuration expects two RSA keys (one for signing, one for decryption) and one EC key. Generate them using the provided jwtgen utility: Atlassian<https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
bash
cd /opt/shibboleth-idp
bin/jwtgen.sh -t RSA -s 2048 -u sig -i defaultRSASign | tail -n +2 > credentials/idp-signing-rs.jwk
bin/jwtgen.sh -t EC -c P-256 -u sig -i defaultECSign | tail -n +2 > credentials/idp-signing-es.jwk
bin/jwtgen.sh -t RSA -s 2048 -u enc -i defaultRSAEnc | tail -n +2 > credentials/idp-encryption-rsa.jwk
________________________________
5. Set the OIDC Issuer (conf/oidc.properties)
The issuer must be a URL using the https scheme containing a host and optionally port/path, with no query or fragment components: Atlassian<https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
properties
idp.oidc.issuer = https://your-idp.example.org
________________________________
6. Expose the OpenID Discovery Document
Clients (like GraphDB) use the /.well-known/openid-configuration endpoint to auto-configure themselves. You must either publish the static file at the standard path or route https://your-idp.example.org/.well-known/openid-configuration to /idp/profile/oidc/configuration. Atlassian<https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
Update the template at static/openid-configuration.json by replacing {{ service_name }} with the host portion of your issuer.
________________________________
7. Enable OIDC Profiles in conf/relying-party.xml
The keyset profile must be openly accessible, and the functional profiles (SSO, UserInfo, Token, etc.) should be enabled under the default relying party: Atlassian<https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
xml
<bean id="shibboleth.UnverifiedRelyingParty" parent="RelyingParty">
<property name="profileConfigurations">
<list>
<ref bean="OIDC.Keyset" />
</list>
</property>
</bean>
<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
<property name="profileConfigurations">
<list>
<ref bean="OIDC.SSO" />
<ref bean="OIDC.UserInfo"/>
<ref bean="OAUTH2.Token"/>
<ref bean="OAUTH2.Revocation"/>
<ref bean="OAUTH2.Introspection" />
</list>
</property>
</bean>
________________________________
8. Register GraphDB as an OIDC Client (metadata/oidc-client.json)
For static client registration, create or edit metadata/oidc-client.json to register GraphDB as a relying party: Atlassian<https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
json
[
{
"scope": "openid email",
"redirect_uris": ["https://graphdb.example.org:7200/"],
"client_id": "graphdb-client",
"client_secret": "your-secret-here",
"response_types": ["code"],
"grant_types": ["authorization_code"]
}
]
Note: The GraphDB Workbench uses its own root browser URL (e.g., https://graphdb.example.com:7200/ with a trailing slash) as the redirect_uri when redirecting to the authorization endpoint. This value must be registered with the OpenID provider. ontotext<https://graphdb.ontotext.com/documentation/11.3/access-control.html#access-control-openid-authentication>
Enable the file resolver in conf/oidc-clientinfo-resolvers.xml by uncommenting the ExampleFileResolver bean. Atlassian<https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
________________________________
9. Configure Claim/Attribute Release
You can add the default OIDC claim mapping rules to conf/attributes/default-rules.xml to simplify attribute-to-claim mapping: Atlassian<https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
xml
<import resource="oidc-claim-rules.xml" />
GraphDB requires a claim to use as the username (e.g., email or sub). Ensure the attribute filter releases this claim to GraphDB's client_id. You will also need to configure the sub claim, as it is required by the OIDC specification.
If using OAuth authorization (roles from JWT), also configure a roles claim in your attribute resolver and filter to release GraphDB roles (e.g., ROLE_USER, ROLE_ADMIN, READ_REPO_*, WRITE_REPO_*) to the access token.
________________________________
Part 2: GraphDB Side (graphdb.properties)
On the GraphDB side, enable OpenID authentication and point it at the Shibboleth IdP. The issuer URL is used to derive keys, endpoints, and token validation: ontotext<https://graphdb.ontotext.com/documentation/11.3/access-control.html#access-control-openid-authentication>
properties
# Enable OpenID authentication
graphdb.auth.methods = openid
# Shibboleth IdP issuer URL
graphdb.auth.openid.issuer = https://your-idp.example.org
# Client ID registered with Shibboleth
graphdb.auth.openid.client_id = graphdb-client
# Use 'email' or whatever claim Shibboleth releases as the username
graphdb.auth.openid.username_claim = email
# Use authorization code flow with PKCE (recommended)
graphdb.auth.openid.auth_flow = code
# Use 'access' if the access token is a JWT, otherwise 'id'
graphdb.auth.openid.token_type = access
If using OAuth (roles from JWT claims):
properties
graphdb.auth.database = oauth
graphdb.auth.oauth.roles_claim = roles
graphdb.auth.oauth.default_roles = ROLE_USER
The graphdb.auth.openid.token_type should be set to access if the access token is a JWT, otherwise use id. For Shibboleth with the OIDC OP plugin, the access token is typically a JWT (per RFC 9068 support), so access is usually the right choice. ontotext<https://graphdb.ontotext.com/documentation/11.3/access-control.html#access-control-openid-authentication>
________________________________
Summary Checklist
Step
Where
Action
Install OIDC OP plugin
Shibboleth
plugin.sh -I net.shibboleth.idp.plugin.oidc.op
Import oidc-credentials.xml
conf/credentials.xml
Add import statement
Generate JWK keys
credentials/
Run jwtgen.sh
Set issuer URL
conf/oidc.properties
idp.oidc.issuer
Expose discovery endpoint
Web server / IdP
Route /.well-known/openid-configuration
Enable OIDC profiles
conf/relying-party.xml
Add OIDC.SSO, OIDC.UserInfo, etc.
Register GraphDB client
metadata/oidc-client.json
client_id, redirect_uri, scopes
Release username + roles claims
Attribute filter
Target GraphDB's client_id
Configure GraphDB
graphdb.properties
Set issuer, client_id, auth_flow, token_type
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260404/9ddff6f9/attachment.htm>
More information about the users
mailing list