FW: GraphDB OIDC

Sun Apr 5 01:18:20 UTC 2026

Sunil -

  I have not reviewed what Claude has (or has not) done with the
instructions, but the official installation instructions can be found at
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP

  The official project documentation is probably a better source than an AI
summary (or echo).

    I will also note that IDP 5.1.4 is not the current release, you should
consider upgrading to 5.2.1.

Steve.

On Sat, Apr 4, 2026 at 1:03 PM Mathew, Sunil via users <users at shibboleth.net>
wrote:

> Hi,
>
> I am enabling OIDC in our Shibboleth IdP 5.1.4. Claude gave me these as
> the steps. Can you please confirm this looks correct?
>
>
> Appreciate your help.
>
>
> Regards,
> Sunil
>
>
> Part 1: Shibboleth IdP Side 1. Install the OIDC OP Plugin
>
> The OIDC OP plugin is an officially supported plugin for Shibboleth IdP
> v4.1 and above. It must be installed using the plugin command: Atlassian
> <https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
> bash
>
> /opt/shibboleth-idp/bin/plugin.sh -I net.shibboleth.idp.plugin.oidc.op
>
> This plugin depends on the Shibboleth OIDC Common plugin (OIDCCommon) and
> OIDCConfig (since v3.4.0), which must be installed first. Atlassian
> <https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
> ------------------------------
> 2. Enable the OIDC Module
>
> Once the plugin has been installed, verify or enable the module: Atlassian
> <https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
> bash
>
> /opt/shibboleth-idp/bin/module.sh -e idp.oidc.OP
>
> ------------------------------
> 3. Initial Configuration Files (conf/credentials.xml)
>
> Add an import for OIDC credentials into conf/credentials.xml: Atlassian
> <https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
> xml
>
> <!-- OIDC extension default credential definitions --><import resource="oidc-credentials.xml" />
>
> Also enable auto-loading of properties by setting in idp.properties:
> properties
>
> idp.searchForProperties=true
>
> ------------------------------
> 4. Generate Signing & Encryption Keys
>
> The default configuration expects two RSA keys (one for signing, one for
> decryption) and one EC key. Generate them using the provided jwtgen utility:
> Atlassian
> <https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
> bash
>
> cd /opt/shibboleth-idp
> bin/jwtgen.sh -t RSA -s 2048 -u sig -i defaultRSASign | tail -n +2 > credentials/idp-signing-rs.jwk
> bin/jwtgen.sh -t EC -c P-256 -u sig -i defaultECSign | tail -n +2 > credentials/idp-signing-es.jwk
> bin/jwtgen.sh -t RSA -s 2048 -u enc -i defaultRSAEnc | tail -n +2 > credentials/idp-encryption-rsa.jwk
>
> ------------------------------
> 5. Set the OIDC Issuer (conf/oidc.properties)
>
> The issuer must be a URL using the https scheme containing a host and
> optionally port/path, with no query or fragment components: Atlassian
> <https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
> properties
>
> idp.oidc.issuer = https://your-idp.example.org
>
> ------------------------------
> 6. Expose the OpenID Discovery Document
>
> Clients (like GraphDB) use the /.well-known/openid-configuration endpoint
> to auto-configure themselves. You must either publish the static file at
> the standard path or route
> https://your-idp.example.org/.well-known/openid-configuration to
> /idp/profile/oidc/configuration. Atlassian
> <https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
>
> Update the template at static/openid-configuration.json by replacing {{
> service_name }} with the host portion of your issuer.
> ------------------------------
> 7. Enable OIDC Profiles in conf/relying-party.xml
>
> The keyset profile must be openly accessible, and the functional profiles
> (SSO, UserInfo, Token, etc.) should be enabled under the default relying
> party: Atlassian
> <https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
> xml
>
> <bean id="shibboleth.UnverifiedRelyingParty" parent="RelyingParty">
>   <property name="profileConfigurations">
>     <list>
>       <ref bean="OIDC.Keyset" />
>     </list>
>   </property></bean>
> <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
>   <property name="profileConfigurations">
>     <list>
>       <ref bean="OIDC.SSO" />
>       <ref bean="OIDC.UserInfo"/>
>       <ref bean="OAUTH2.Token"/>
>       <ref bean="OAUTH2.Revocation"/>
>       <ref bean="OAUTH2.Introspection" />
>     </list>
>   </property></bean>
>
> ------------------------------
> 8. Register GraphDB as an OIDC Client (metadata/oidc-client.json)
>
> For static client registration, create or edit metadata/oidc-client.json to
> register GraphDB as a relying party: Atlassian
> <https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
> json
>
> [
>   {
>     "scope": "openid email",
>     "redirect_uris": ["https://graphdb.example.org:7200/"],
>     "client_id": "graphdb-client",
>     "client_secret": "your-secret-here",
>     "response_types": ["code"],
>     "grant_types": ["authorization_code"]
>   }]
>
> *Note:* The GraphDB Workbench uses its own root browser URL (e.g.,
> https://graphdb.example.com:7200/ with a trailing slash) as the
> redirect_uri when redirecting to the authorization endpoint. This value
> must be registered with the OpenID provider. ontotext
> <https://graphdb.ontotext.com/documentation/11.3/access-control.html#access-control-openid-authentication>
>
> Enable the file resolver in conf/oidc-clientinfo-resolvers.xml by
> uncommenting the ExampleFileResolver bean. Atlassian
> <https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
> ------------------------------
> 9. Configure Claim/Attribute Release
>
> You can add the default OIDC claim mapping rules to
> conf/attributes/default-rules.xml to simplify attribute-to-claim mapping:
> Atlassian
> <https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP>
> xml
>
> <import resource="oidc-claim-rules.xml" />
>
> GraphDB requires a claim to use as the username (e.g., email or sub).
> Ensure the attribute filter releases this claim to GraphDB's client_id.
> You will also need to configure the sub claim, as it is required by the
> OIDC specification.
>
> If using *OAuth authorization* (roles from JWT), also configure a roles claim
> in your attribute resolver and filter to release GraphDB roles (e.g.,
> ROLE_USER, ROLE_ADMIN, READ_REPO_*, WRITE_REPO_*) to the access token.
> ------------------------------
> Part 2: GraphDB Side (graphdb.properties)
>
> On the GraphDB side, enable OpenID authentication and point it at the
> Shibboleth IdP. The issuer URL is used to derive keys, endpoints, and token
> validation: ontotext
> <https://graphdb.ontotext.com/documentation/11.3/access-control.html#access-control-openid-authentication>
> properties
>
> # Enable OpenID authenticationgraphdb.auth.methods = openid
> # Shibboleth IdP issuer URLgraphdb.auth.openid.issuer = https://your-idp.example.org
> # Client ID registered with Shibbolethgraphdb.auth.openid.client_id = graphdb-client
> # Use 'email' or whatever claim Shibboleth releases as the usernamegraphdb.auth.openid.username_claim = email
> # Use authorization code flow with PKCE (recommended)graphdb.auth.openid.auth_flow = code
> # Use 'access' if the access token is a JWT, otherwise 'id'graphdb.auth.openid.token_type = access
>
> If using OAuth (roles from JWT claims):
> properties
>
> graphdb.auth.database = oauthgraphdb.auth.oauth.roles_claim = rolesgraphdb.auth.oauth.default_roles = ROLE_USER
>
> The graphdb.auth.openid.token_type should be set to access if the access
> token is a JWT, otherwise use id. For Shibboleth with the OIDC OP plugin,
> the access token is typically a JWT (per RFC 9068 support), so access is
> usually the right choice. ontotext
> <https://graphdb.ontotext.com/documentation/11.3/access-control.html#access-control-openid-authentication>
> ------------------------------
> Summary Checklist
>
> Step
> Where
> Action
> Install OIDC OP plugin
> Shibboleth
> plugin.sh -I net.shibboleth.idp.plugin.oidc.op
> Import oidc-credentials.xml
> conf/credentials.xml
> Add import statement
> Generate JWK keys
> credentials/
> Run jwtgen.sh
> Set issuer URL
> conf/oidc.properties
> idp.oidc.issuer
> Expose discovery endpoint
> Web server / IdP
> Route /.well-known/openid-configuration
> Enable OIDC profiles
> conf/relying-party.xml
> Add OIDC.SSO, OIDC.UserInfo, etc.
> Register GraphDB client
> metadata/oidc-client.json
> client_id, redirect_uri, scopes
> Release username + roles claims
> Attribute filter
> Target GraphDB's client_id
> Configure GraphDB
> graphdb.properties
> Set issuer, client_id, auth_flow, token_type
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260404/5405bc01/attachment.htm>