<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi Keith,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We’re not yet using the dynamically generated OIDC metadata, but to add in our openid-configuration file to the .well-known location we just copy a static file to the Tomcat ROOT webapp when we build our container.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">You should be able to create a HTML page that performs the HTTP 302 redirect.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is what is in our Dockerfile --<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">COPY container_files/opt/shibboleth-idp/static/ /usr/local/tomcat/webapps/ROOT/<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The openid-configuration file is in static/.well-known/openid-configuration which keeps the correct directory structure when copying.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">--<o:p></o:p></p>
<p class="MsoNormal">Ryan Rumbaugh<o:p></o:p></p>
<p class="MsoNormal">University of Nebraska <o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Michael Grady <mgrady@unicon.net><br>
<b>Date: </b>Friday, May 14, 2021 at 3:16 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>Re: OpenID configuration redirects with Tomcat<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal">Non-NU Email<br>
<br>
<br>
<br>
> On May 14, 2021, at 2:57 PM, Wessel, Keith <kwessel@illinois.edu> wrote:<br>
> <br>
> Hi, all,<br>
> <br>
> The new support for (somewhat) dynamically generating OpenID Connect metadata in the IdP is very attractive, and the docs kindly include an example for how to do this in Jetty.<br>
> <br>
> For those of us running the Trusted Access Platform image without Apache fronting it, though, there's the task of doing a redirect with Tomcat from the root webapp into the IdP to make the dynamic OIDC metadata appear at the well-known location. I thought
this would be simple... silly me.<br>
> <br>
> I've seen solutions that involve deploying a simple jsp page to my root webapp to handle redirection. I also see that Tomcat has implemented a version of Apache mod_rewrite. Both of those seem a bit heavy for what I'm trying to accomplish here. Anyone have
experience in a simple way in Tomcat to redirect /.well-known/openid-configuration into the IdP webapp at /idp/profile/oidc/configuration?<br>
> <br>
<br>
Tomcat rewrite is pretty easy to configure, we've used it with multiple clients for CAS endpoints that were not convenient to change in the CAS clients. If you don't come up with another solution.<br>
<br>
--<br>
Michael A. Grady<br>
IAM Architect, Unicon, Inc.<br>
<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=Cu5g146wZdoqVuKpTNsYHeFX_rg6kWhlkLF8Eft-wwo&r=x_uM7qpgXzh_70B3Dgey5pfdCFAWMhq-IedVFyaAIwg&m=oW6N5EV33GvQie48wtHMz2H7qTf0gjAv4VaoB03dO9Q&s=7Wr7t0AE1IncEEdCVBOltSsURoDia1Jxi1nRjaHouZg&e=">
https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=Cu5g146wZdoqVuKpTNsYHeFX_rg6kWhlkLF8Eft-wwo&r=x_uM7qpgXzh_70B3Dgey5pfdCFAWMhq-IedVFyaAIwg&m=oW6N5EV33GvQie48wtHMz2H7qTf0gjAv4VaoB03dO9Q&s=7Wr7t0AE1IncEEdCVBOltSsURoDia1Jxi1nRjaHouZg&e=</a>
<br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<o:p></o:p></p>
</div>
</div>
</body>
</html>