<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div style="direction: ltr; font-family: Aptos; font-size: 12pt; color: black;">Hi,</div>
<div style="direction: ltr; font-family: Aptos; font-size: 12pt; color: black;"><br>
</div>
<div style="direction: ltr; font-family: Aptos; font-size: 12pt; color: black;">I am enabling OIDC in our Shibboleth IdP 5.1.4. Claude gave me these as the steps. Can you please confirm this looks correct?</div>
<div style="direction: ltr; font-family: Aptos; font-size: 12pt; color: black;"><br>
</div>
<div style="direction: ltr; font-family: Aptos; font-size: 12pt; color: black;"><br>
Appreciate your help.</div>
<div style="direction: ltr; font-family: Aptos; font-size: 12pt; color: black;"><br>
</div>
<div style="direction: ltr; font-family: Aptos; font-size: 12pt; color: black;"><br>
</div>
<div style="direction: ltr; font-family: Aptos; font-size: 12pt; color: black;">Regards,</div>
<div style="direction: ltr; font-family: Aptos; font-size: 12pt; color: black;">Sunil</div>
<div style="direction: ltr; font-family: Aptos; font-size: 12pt; color: black;"><br>
</div>
<div style="direction: ltr; font-family: Aptos; font-size: 12pt; color: black;"><br>
</div>
<div id="mail-editor-reference-message-container">
<h3 class="text-text-100 mt-2 -mb-1 text-base font-bold" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none; color: rgb(0, 0, 0);">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif;">Part 1: Shibboleth IdP Side</span></h3>
<h4 class="text-text-100 mt-2 -mb-1 text-base font-bold" style="text-align: left; text-indent: 0px; text-transform: none; color: rgb(0, 0, 0);">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">1. Install the OIDC OP Plugin</span></h4>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">The OIDC OP plugin is an officially supported plugin for Shibboleth IdP v4.1 and above. It must be installed using the
<code>plugin</code> command: <a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" target="_blank" class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer" originalsrc="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" data-outlook-id="3723455e-a43b-48c8-831d-a0a04727b7ee" style="margin-top: 0px; margin-bottom: 0px;">
Atlassian</a></span></p>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<button class="inline-flex
items-center
justify-center
relative
isolate
shrink-0
can-focus
select-none
disabled:pointer-events-none
disabled:opacity-50
disabled:shadow-none
disabled:drop-shadow-none border-transparent
transition
font-base
duration-300
ease-[cubic-bezier(0.165,0.85,0.45,1)] h-8 w-8 rounded-md backdrop-blur-md _fill_56vq7_9 _ghost_56vq7_96" type="button" data-state="closed">
<div class="relative" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute inset-0 flex items-center justify-center" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
</button></div>
<div class="text-text-500 font-small p-3.5 pb-0" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
bash</div>
<pre><div class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5" style="text-align: left; text-indent: 0px; text-transform: none; font-size: 12pt; color: rgb(20, 24, 31);"><code>/opt/shibboleth-idp/bin/plugin.sh -I net.shibboleth.idp.plugin.oidc.op</code></div></pre>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">This plugin depends on the Shibboleth OIDC Common plugin (<code>OIDCCommon</code>) and
<code>OIDCConfig</code> (since v3.4.0), which must be installed first. <a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" target="_blank" class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer" originalsrc="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" data-outlook-id="26b9cb75-fb0b-4369-9993-5b4aed25b0d2" style="margin-top: 0px; margin-bottom: 0px;">
Atlassian</a></span></p>
<hr style="text-align: left; text-indent: 0px;">
<h4 class="text-text-100 mt-2 -mb-1 text-base font-bold" style="text-align: left; text-indent: 0px; text-transform: none; color: rgb(0, 0, 0);">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">2. Enable the OIDC Module</span></h4>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Once the plugin has been installed, verify or enable the module:
<a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" target="_blank" class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer" originalsrc="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" data-outlook-id="032af90d-db50-46af-a0bf-99829bef9b3b" style="margin-top: 0px; margin-bottom: 0px;">
Atlassian</a></span></p>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<button class="inline-flex
items-center
justify-center
relative
isolate
shrink-0
can-focus
select-none
disabled:pointer-events-none
disabled:opacity-50
disabled:shadow-none
disabled:drop-shadow-none border-transparent
transition
font-base
duration-300
ease-[cubic-bezier(0.165,0.85,0.45,1)] h-8 w-8 rounded-md backdrop-blur-md _fill_56vq7_9 _ghost_56vq7_96" type="button" data-state="closed">
<div class="relative" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute inset-0 flex items-center justify-center" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
</button></div>
<div class="text-text-500 font-small p-3.5 pb-0" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
bash</div>
<pre><div class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5" style="text-align: left; text-indent: 0px; text-transform: none; font-size: 12pt; color: rgb(20, 24, 31);"><code>/opt/shibboleth-idp/bin/module.sh -e idp.oidc.OP</code></div></pre>
<hr style="text-align: left; text-indent: 0px;">
<h4 class="text-text-100 mt-2 -mb-1 text-base font-bold" style="text-align: left; text-indent: 0px; text-transform: none; color: rgb(0, 0, 0);">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">3. Initial Configuration Files (<code>conf/credentials.xml</code>)</span></h4>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Add an import for OIDC credentials into
<code>conf/credentials.xml</code>: <a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" target="_blank" class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer" originalsrc="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" data-outlook-id="6a139a1b-fc64-48af-9d89-0679d3047ae7" style="margin-top: 0px; margin-bottom: 0px;">
Atlassian</a></span></p>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<button class="inline-flex
items-center
justify-center
relative
isolate
shrink-0
can-focus
select-none
disabled:pointer-events-none
disabled:opacity-50
disabled:shadow-none
disabled:drop-shadow-none border-transparent
transition
font-base
duration-300
ease-[cubic-bezier(0.165,0.85,0.45,1)] h-8 w-8 rounded-md backdrop-blur-md _fill_56vq7_9 _ghost_56vq7_96" type="button" data-state="closed">
<div class="relative" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute inset-0 flex items-center justify-center" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
</button></div>
<div class="text-text-500 font-small p-3.5 pb-0" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
xml</div>
<pre><div class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5" style="text-align: left; text-indent: 0px; text-transform: none; font-size: 12pt;"><span style="color: rgb(110, 118, 135);"><code><!-- OIDC extension default credential definitions --></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code><</code></span><span style="color: rgb(184, 10, 24);"><code>import </code></span><span style="color: rgb(189, 15, 30);"><code>resource</code></span><span style="color: rgb(43, 48, 59);"><code>="</code></span><span style="color: rgb(0, 128, 0);"><code>oidc-credentials.xml</code></span><span style="color: rgb(43, 48, 59);"><code>"</code></span><span style="color: rgb(184, 10, 24);"><code> </code></span><span style="color: rgb(43, 48, 59);"><code>/></code></span></div></pre>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Also enable auto-loading of properties by setting in
<code>idp.properties</code>:</span></p>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<button class="inline-flex
items-center
justify-center
relative
isolate
shrink-0
can-focus
select-none
disabled:pointer-events-none
disabled:opacity-50
disabled:shadow-none
disabled:drop-shadow-none border-transparent
transition
font-base
duration-300
ease-[cubic-bezier(0.165,0.85,0.45,1)] h-8 w-8 rounded-md backdrop-blur-md _fill_56vq7_9 _ghost_56vq7_96" type="button" data-state="closed">
<div class="relative" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute inset-0 flex items-center justify-center" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
</button></div>
<div class="text-text-500 font-small p-3.5 pb-0" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
properties</div>
<pre><div class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5" style="text-align: left; text-indent: 0px; text-transform: none; font-size: 12pt;"><span style="color: rgb(189, 15, 30);"><code>idp.searchForProperties</code></span><span style="color: rgb(43, 48, 59);"><code>=</code></span><span style="color: rgb(0, 128, 0);"><code>true</code></span></div></pre>
<hr style="text-align: left; text-indent: 0px;">
<h4 class="text-text-100 mt-2 -mb-1 text-base font-bold" style="text-align: left; text-indent: 0px; text-transform: none; color: rgb(0, 0, 0);">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">4. Generate Signing & Encryption Keys</span></h4>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">The default configuration expects two RSA keys (one for signing, one for decryption) and one EC key. Generate them using the provided
<code>jwtgen</code> utility: <a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" target="_blank" class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer" originalsrc="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" data-outlook-id="08663c81-d079-4c66-a995-9014e149a1d0" style="margin-top: 0px; margin-bottom: 0px;">
Atlassian</a></span></p>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<button class="inline-flex
items-center
justify-center
relative
isolate
shrink-0
can-focus
select-none
disabled:pointer-events-none
disabled:opacity-50
disabled:shadow-none
disabled:drop-shadow-none border-transparent
transition
font-base
duration-300
ease-[cubic-bezier(0.165,0.85,0.45,1)] h-8 w-8 rounded-md backdrop-blur-md _fill_56vq7_9 _ghost_56vq7_96" type="button" data-state="closed">
<div class="relative" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute inset-0 flex items-center justify-center" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
</button></div>
<div class="text-text-500 font-small p-3.5 pb-0" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
bash</div>
<pre><div class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5" style="text-align: left; text-indent: 0px; text-transform: none; font-size: 12pt;"><span style="color: rgb(179, 74, 0);"><code>cd</code></span><span style="color: rgb(20, 24, 31);"><code> /opt/shibboleth-idp
bin/jwtgen.sh -t RSA -s </code></span><span style="color: rgb(0, 128, 128);"><code>2048</code></span><span style="color: rgb(20, 24, 31);"><code> -u sig -i defaultRSASign | </code></span><span style="color: rgb(0, 81, 194);"><code>tail</code></span><span style="color: rgb(20, 24, 31);"><code> -n +2 > credentials/idp-signing-rs.jwk
bin/jwtgen.sh -t EC -c P-256 -u sig -i defaultECSign | </code></span><span style="color: rgb(0, 81, 194);"><code>tail</code></span><span style="color: rgb(20, 24, 31);"><code> -n +2 > credentials/idp-signing-es.jwk
bin/jwtgen.sh -t RSA -s </code></span><span style="color: rgb(0, 128, 128);"><code>2048</code></span><span style="color: rgb(20, 24, 31);"><code> -u enc -i defaultRSAEnc | </code></span><span style="color: rgb(0, 81, 194);"><code>tail</code></span><span style="color: rgb(20, 24, 31);"><code> -n +2 > credentials/idp-encryption-rsa.jwk</code></span></div></pre>
<hr style="text-align: left; text-indent: 0px;">
<h4 class="text-text-100 mt-2 -mb-1 text-base font-bold" style="text-align: left; text-indent: 0px; text-transform: none; color: rgb(0, 0, 0);">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">5. Set the OIDC Issuer (<code>conf/oidc.properties</code>)</span></h4>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">The issuer must be a URL using the
<code>https</code> scheme containing a host and optionally port/path, with no query or fragment components:
<a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" target="_blank" class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer" originalsrc="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" data-outlook-id="a1ade1e3-be39-4019-bfd8-023f6be1ab09" style="margin-top: 0px; margin-bottom: 0px;">
Atlassian</a></span></p>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<button class="inline-flex
items-center
justify-center
relative
isolate
shrink-0
can-focus
select-none
disabled:pointer-events-none
disabled:opacity-50
disabled:shadow-none
disabled:drop-shadow-none border-transparent
transition
font-base
duration-300
ease-[cubic-bezier(0.165,0.85,0.45,1)] h-8 w-8 rounded-md backdrop-blur-md _fill_56vq7_9 _ghost_56vq7_96" type="button" data-state="closed">
<div class="relative" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute inset-0 flex items-center justify-center" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
</button></div>
<div class="text-text-500 font-small p-3.5 pb-0" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
properties</div>
<pre><div class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5" style="text-align: left; text-indent: 0px; text-transform: none; font-size: 12pt;"><span style="color: rgb(189, 15, 30);"><code>idp.oidc.issuer</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(43, 48, 59);"><code>=</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(0, 128, 0);"><code>https://your-idp.example.org</code></span></div></pre>
<hr style="text-align: left; text-indent: 0px;">
<h4 class="text-text-100 mt-2 -mb-1 text-base font-bold" style="text-align: left; text-indent: 0px; text-transform: none; color: rgb(0, 0, 0);">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">6. Expose the OpenID Discovery Document</span></h4>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Clients (like GraphDB) use the
<code>/.well-known/openid-configuration</code> endpoint to auto-configure themselves. You must either publish the static file at the standard path or route
<code>https://your-idp.example.org/.well-known/openid-configuration</code> to <code>
/idp/profile/oidc/configuration</code>. <a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" target="_blank" class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer" originalsrc="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" data-outlook-id="96b4de18-5172-4c06-a524-b24b61c9d2c6" style="margin-top: 0px; margin-bottom: 0px;">
Atlassian</a></span></p>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Update the template at
<code>static/openid-configuration.json</code> by replacing <code>{{ service_name }}</code> with the host portion of your issuer.</span></p>
<hr style="text-align: left; text-indent: 0px;">
<h4 class="text-text-100 mt-2 -mb-1 text-base font-bold" style="text-align: left; text-indent: 0px; text-transform: none; color: rgb(0, 0, 0);">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">7. Enable OIDC Profiles in
<code>conf/relying-party.xml</code></span></h4>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">The keyset profile must be openly accessible, and the functional profiles (SSO, UserInfo, Token, etc.) should be enabled under the default relying party:
<a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" target="_blank" class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer" originalsrc="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" data-outlook-id="93de1307-096c-400a-a4f3-497f7223ba47" style="margin-top: 0px; margin-bottom: 0px;">
Atlassian</a></span></p>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<button class="inline-flex
items-center
justify-center
relative
isolate
shrink-0
can-focus
select-none
disabled:pointer-events-none
disabled:opacity-50
disabled:shadow-none
disabled:drop-shadow-none border-transparent
transition
font-base
duration-300
ease-[cubic-bezier(0.165,0.85,0.45,1)] h-8 w-8 rounded-md backdrop-blur-md _fill_56vq7_9 _ghost_56vq7_96" type="button" data-state="closed">
<div class="relative" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute inset-0 flex items-center justify-center" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
</button></div>
<div class="text-text-500 font-small p-3.5 pb-0" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
xml</div>
<pre><div class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5" style="text-align: left; text-indent: 0px; text-transform: none; font-size: 12pt;"><span style="color: rgb(43, 48, 59);"><code><</code></span><span style="color: rgb(184, 10, 24);"><code>bean </code></span><span style="color: rgb(189, 15, 30);"><code>id</code></span><span style="color: rgb(43, 48, 59);"><code>="</code></span><span style="color: rgb(0, 128, 0);"><code>shibboleth.UnverifiedRelyingParty</code></span><span style="color: rgb(43, 48, 59);"><code>"</code></span><span style="color: rgb(184, 10, 24);"><code> </code></span><span style="color: rgb(189, 15, 30);"><code>parent</code></span><span style="color: rgb(43, 48, 59);"><code>="</code></span><span style="color: rgb(0, 128, 0);"><code>RelyingParty</code></span><span style="color: rgb(43, 48, 59);"><code>"></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code><</code></span><span style="color: rgb(184, 10, 24);"><code>property </code></span><span style="color: rgb(189, 15, 30);"><code>name</code></span><span style="color: rgb(43, 48, 59);"><code>="</code></span><span style="color: rgb(0, 128, 0);"><code>profileConfigurations</code></span><span style="color: rgb(43, 48, 59);"><code>"></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code><</code></span><span style="color: rgb(184, 10, 24);"><code>list</code></span><span style="color: rgb(43, 48, 59);"><code>></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code><</code></span><span style="color: rgb(184, 10, 24);"><code>ref </code></span><span style="color: rgb(189, 15, 30);"><code>bean</code></span><span style="color: rgb(43, 48, 59);"><code>="</code></span><span style="color: rgb(0, 128, 0);"><code>OIDC.Keyset</code></span><span style="color: rgb(43, 48, 59);"><code>"</code></span><span style="color: rgb(184, 10, 24);"><code> </code></span><span style="color: rgb(43, 48, 59);"><code>/></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code></</code></span><span style="color: rgb(184, 10, 24);"><code>list</code></span><span style="color: rgb(43, 48, 59);"><code>></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code></</code></span><span style="color: rgb(184, 10, 24);"><code>property</code></span><span style="color: rgb(43, 48, 59);"><code>></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code></</code></span><span style="color: rgb(184, 10, 24);"><code>bean</code></span><span style="color: rgb(43, 48, 59);"><code>></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code><</code></span><span style="color: rgb(184, 10, 24);"><code>bean </code></span><span style="color: rgb(189, 15, 30);"><code>id</code></span><span style="color: rgb(43, 48, 59);"><code>="</code></span><span style="color: rgb(0, 128, 0);"><code>shibboleth.DefaultRelyingParty</code></span><span style="color: rgb(43, 48, 59);"><code>"</code></span><span style="color: rgb(184, 10, 24);"><code> </code></span><span style="color: rgb(189, 15, 30);"><code>parent</code></span><span style="color: rgb(43, 48, 59);"><code>="</code></span><span style="color: rgb(0, 128, 0);"><code>RelyingParty</code></span><span style="color: rgb(43, 48, 59);"><code>"></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code><</code></span><span style="color: rgb(184, 10, 24);"><code>property </code></span><span style="color: rgb(189, 15, 30);"><code>name</code></span><span style="color: rgb(43, 48, 59);"><code>="</code></span><span style="color: rgb(0, 128, 0);"><code>profileConfigurations</code></span><span style="color: rgb(43, 48, 59);"><code>"></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code><</code></span><span style="color: rgb(184, 10, 24);"><code>list</code></span><span style="color: rgb(43, 48, 59);"><code>></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code><</code></span><span style="color: rgb(184, 10, 24);"><code>ref </code></span><span style="color: rgb(189, 15, 30);"><code>bean</code></span><span style="color: rgb(43, 48, 59);"><code>="</code></span><span style="color: rgb(0, 128, 0);"><code>OIDC.SSO</code></span><span style="color: rgb(43, 48, 59);"><code>"</code></span><span style="color: rgb(184, 10, 24);"><code> </code></span><span style="color: rgb(43, 48, 59);"><code>/></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code><</code></span><span style="color: rgb(184, 10, 24);"><code>ref </code></span><span style="color: rgb(189, 15, 30);"><code>bean</code></span><span style="color: rgb(43, 48, 59);"><code>="</code></span><span style="color: rgb(0, 128, 0);"><code>OIDC.UserInfo</code></span><span style="color: rgb(43, 48, 59);"><code>"/></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code><</code></span><span style="color: rgb(184, 10, 24);"><code>ref </code></span><span style="color: rgb(189, 15, 30);"><code>bean</code></span><span style="color: rgb(43, 48, 59);"><code>="</code></span><span style="color: rgb(0, 128, 0);"><code>OAUTH2.Token</code></span><span style="color: rgb(43, 48, 59);"><code>"/></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code><</code></span><span style="color: rgb(184, 10, 24);"><code>ref </code></span><span style="color: rgb(189, 15, 30);"><code>bean</code></span><span style="color: rgb(43, 48, 59);"><code>="</code></span><span style="color: rgb(0, 128, 0);"><code>OAUTH2.Revocation</code></span><span style="color: rgb(43, 48, 59);"><code>"/></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code><</code></span><span style="color: rgb(184, 10, 24);"><code>ref </code></span><span style="color: rgb(189, 15, 30);"><code>bean</code></span><span style="color: rgb(43, 48, 59);"><code>="</code></span><span style="color: rgb(0, 128, 0);"><code>OAUTH2.Introspection</code></span><span style="color: rgb(43, 48, 59);"><code>"</code></span><span style="color: rgb(184, 10, 24);"><code> </code></span><span style="color: rgb(43, 48, 59);"><code>/></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code></</code></span><span style="color: rgb(184, 10, 24);"><code>list</code></span><span style="color: rgb(43, 48, 59);"><code>></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code></</code></span><span style="color: rgb(184, 10, 24);"><code>property</code></span><span style="color: rgb(43, 48, 59);"><code>></code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code></</code></span><span style="color: rgb(184, 10, 24);"><code>bean</code></span><span style="color: rgb(43, 48, 59);"><code>></code></span></div></pre>
<hr style="text-align: left; text-indent: 0px;">
<h4 class="text-text-100 mt-2 -mb-1 text-base font-bold" style="text-align: left; text-indent: 0px; text-transform: none; color: rgb(0, 0, 0);">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">8. Register GraphDB as an OIDC Client (<code>metadata/oidc-client.json</code>)</span></h4>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">For static client registration, create or edit
<code>metadata/oidc-client.json</code> to register GraphDB as a relying party: <a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" target="_blank" class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer" originalsrc="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" data-outlook-id="91b95cd3-f62c-49ca-8a86-255416dcb70e" style="margin-top: 0px; margin-bottom: 0px;">
Atlassian</a></span></p>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<button class="inline-flex
items-center
justify-center
relative
isolate
shrink-0
can-focus
select-none
disabled:pointer-events-none
disabled:opacity-50
disabled:shadow-none
disabled:drop-shadow-none border-transparent
transition
font-base
duration-300
ease-[cubic-bezier(0.165,0.85,0.45,1)] h-8 w-8 rounded-md backdrop-blur-md _fill_56vq7_9 _ghost_56vq7_96" type="button" data-state="closed">
<div class="relative" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute inset-0 flex items-center justify-center" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
</button></div>
<div class="text-text-500 font-small p-3.5 pb-0" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
json</div>
<pre><div class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5" style="text-align: left; text-indent: 0px; text-transform: none; font-size: 12pt;"><span style="color: rgb(43, 48, 59);"><code>[</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code>{</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(184, 10, 24);"><code>"scope"</code></span><span style="color: rgb(20, 24, 31);"><code>: </code></span><span style="color: rgb(0, 128, 0);"><code>"openid email"</code></span><span style="color: rgb(43, 48, 59);"><code>,</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(184, 10, 24);"><code>"redirect_uris"</code></span><span style="color: rgb(20, 24, 31);"><code>: </code></span><span style="color: rgb(43, 48, 59);"><code>[</code></span><span style="color: rgb(0, 128, 0);"><code>"https://graphdb.example.org:7200/"</code></span><span style="color: rgb(43, 48, 59);"><code>],</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(184, 10, 24);"><code>"client_id"</code></span><span style="color: rgb(20, 24, 31);"><code>: </code></span><span style="color: rgb(0, 128, 0);"><code>"graphdb-client"</code></span><span style="color: rgb(43, 48, 59);"><code>,</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(184, 10, 24);"><code>"client_secret"</code></span><span style="color: rgb(20, 24, 31);"><code>: </code></span><span style="color: rgb(0, 128, 0);"><code>"your-secret-here"</code></span><span style="color: rgb(43, 48, 59);"><code>,</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(184, 10, 24);"><code>"response_types"</code></span><span style="color: rgb(20, 24, 31);"><code>: </code></span><span style="color: rgb(43, 48, 59);"><code>[</code></span><span style="color: rgb(0, 128, 0);"><code>"code"</code></span><span style="color: rgb(43, 48, 59);"><code>],</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(184, 10, 24);"><code>"grant_types"</code></span><span style="color: rgb(20, 24, 31);"><code>: </code></span><span style="color: rgb(43, 48, 59);"><code>[</code></span><span style="color: rgb(0, 128, 0);"><code>"authorization_code"</code></span><span style="color: rgb(43, 48, 59);"><code>]</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code>}</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(43, 48, 59);"><code>]</code></span></div></pre>
<blockquote>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><b>Note:</b> The GraphDB Workbench uses its own root browser URL (e.g.,
<code>https://graphdb.example.com:7200/</code> with a trailing slash) as the <code>
redirect_uri</code> when redirecting to the authorization endpoint. This value must be registered with the OpenID provider.
<a href="https://graphdb.ontotext.com/documentation/11.3/access-control.html#access-control-openid-authentication" target="_blank" class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer" originalsrc="https://graphdb.ontotext.com/documentation/11.3/access-control.html#access-control-openid-authentication" data-outlook-id="c824afaf-760a-44c0-86a9-6e75f38f889a" style="margin-top: 0px; margin-bottom: 0px;">
ontotext</a></span></p>
</blockquote>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Enable the file resolver in
<code>conf/oidc-clientinfo-resolvers.xml</code> by uncommenting the <code>ExampleFileResolver</code> bean.
<a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" target="_blank" class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer" originalsrc="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" data-outlook-id="d4e0f9f6-fdff-4637-ba1c-797496ae9434" style="margin-top: 0px; margin-bottom: 0px;">
Atlassian</a></span></p>
<hr style="text-align: left; text-indent: 0px;">
<h4 class="text-text-100 mt-2 -mb-1 text-base font-bold" style="text-align: left; text-indent: 0px; text-transform: none; color: rgb(0, 0, 0);">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt;">9. Configure Claim/Attribute Release</span></h4>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">You can add the default OIDC claim mapping rules to
<code>conf/attributes/default-rules.xml</code> to simplify attribute-to-claim mapping:
<a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" target="_blank" class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer" originalsrc="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" data-outlook-id="37994eb7-d6da-4a7a-88f1-fda5b6083e21" style="margin-top: 0px; margin-bottom: 0px;">
Atlassian</a></span></p>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<button class="inline-flex
items-center
justify-center
relative
isolate
shrink-0
can-focus
select-none
disabled:pointer-events-none
disabled:opacity-50
disabled:shadow-none
disabled:drop-shadow-none border-transparent
transition
font-base
duration-300
ease-[cubic-bezier(0.165,0.85,0.45,1)] h-8 w-8 rounded-md backdrop-blur-md _fill_56vq7_9 _ghost_56vq7_96" type="button" data-state="closed">
<div class="relative" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute inset-0 flex items-center justify-center" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
</button></div>
<div class="text-text-500 font-small p-3.5 pb-0" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
xml</div>
<pre><div class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5" style="text-align: left; text-indent: 0px; text-transform: none; font-size: 12pt;"><span style="color: rgb(43, 48, 59);"><code><</code></span><span style="color: rgb(184, 10, 24);"><code>import </code></span><span style="color: rgb(189, 15, 30);"><code>resource</code></span><span style="color: rgb(43, 48, 59);"><code>="</code></span><span style="color: rgb(0, 128, 0);"><code>oidc-claim-rules.xml</code></span><span style="color: rgb(43, 48, 59);"><code>"</code></span><span style="color: rgb(184, 10, 24);"><code> </code></span><span style="color: rgb(43, 48, 59);"><code>/></code></span></div></pre>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">GraphDB requires a claim to use as the username (e.g.,
<code>email</code> or <code>sub</code>). Ensure the attribute filter releases this claim to GraphDB's
<code>client_id</code>. You will also need to configure the <code>sub</code> claim, as it is required by the OIDC specification.</span></p>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">If using
<b>OAuth authorization</b> (roles from JWT), also configure a <code>roles</code> claim in your attribute resolver and filter to release GraphDB roles (e.g.,
<code>ROLE_USER</code>, <code>ROLE_ADMIN</code>, <code>READ_REPO_*</code>, <code>
WRITE_REPO_*</code>) to the access token.</span></p>
<hr style="text-align: left; text-indent: 0px;">
<h3 class="text-text-100 mt-2 -mb-1 text-base font-bold" style="text-align: left; text-indent: 0px; text-transform: none; color: rgb(0, 0, 0);">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif;">Part 2: GraphDB Side (<code>graphdb.properties</code>)</span></h3>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">On the GraphDB side, enable OpenID authentication and point it at the Shibboleth IdP. The issuer URL is used to derive keys, endpoints, and token validation:
<a href="https://graphdb.ontotext.com/documentation/11.3/access-control.html#access-control-openid-authentication" target="_blank" class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer" originalsrc="https://graphdb.ontotext.com/documentation/11.3/access-control.html#access-control-openid-authentication" data-outlook-id="3d33d8c9-47c0-429b-99a8-9267947ec9dc" style="margin-top: 0px; margin-bottom: 0px;">
ontotext</a></span></p>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<button class="inline-flex
items-center
justify-center
relative
isolate
shrink-0
can-focus
select-none
disabled:pointer-events-none
disabled:opacity-50
disabled:shadow-none
disabled:drop-shadow-none border-transparent
transition
font-base
duration-300
ease-[cubic-bezier(0.165,0.85,0.45,1)] h-8 w-8 rounded-md backdrop-blur-md _fill_56vq7_9 _ghost_56vq7_96" type="button" data-state="closed">
<div class="relative" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute inset-0 flex items-center justify-center" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
</button></div>
<div class="text-text-500 font-small p-3.5 pb-0" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
properties</div>
<pre><div class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5" style="text-align: left; text-indent: 0px; text-transform: none; font-size: 12pt;"><span style="color: rgb(110, 118, 135);"><code># Enable OpenID authentication</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(189, 15, 30);"><code>graphdb.auth.methods</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(43, 48, 59);"><code>=</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(0, 128, 0);"><code>openid</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(110, 118, 135);"><code># Shibboleth IdP issuer URL</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(189, 15, 30);"><code>graphdb.auth.openid.issuer</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(43, 48, 59);"><code>=</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(0, 128, 0);"><code>https://your-idp.example.org</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(110, 118, 135);"><code># Client ID registered with Shibboleth</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(189, 15, 30);"><code>graphdb.auth.openid.client_id</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(43, 48, 59);"><code>=</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(0, 128, 0);"><code>graphdb-client</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(110, 118, 135);"><code># Use 'email' or whatever claim Shibboleth releases as the username</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(189, 15, 30);"><code>graphdb.auth.openid.username_claim</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(43, 48, 59);"><code>=</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(0, 128, 0);"><code>email</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(110, 118, 135);"><code># Use authorization code flow with PKCE (recommended)</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(189, 15, 30);"><code>graphdb.auth.openid.auth_flow</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(43, 48, 59);"><code>=</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(0, 128, 0);"><code>code</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(110, 118, 135);"><code># Use 'access' if the access token is a JWT, otherwise 'id'</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(189, 15, 30);"><code>graphdb.auth.openid.token_type</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(43, 48, 59);"><code>=</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(0, 128, 0);"><code>access</code></span></div></pre>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">If using OAuth (roles from JWT claims):</span></p>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<button class="inline-flex
items-center
justify-center
relative
isolate
shrink-0
can-focus
select-none
disabled:pointer-events-none
disabled:opacity-50
disabled:shadow-none
disabled:drop-shadow-none border-transparent
transition
font-base
duration-300
ease-[cubic-bezier(0.165,0.85,0.45,1)] h-8 w-8 rounded-md backdrop-blur-md _fill_56vq7_9 _ghost_56vq7_96" type="button" data-state="closed">
<div class="relative" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute inset-0 flex items-center justify-center" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
<div class="absolute right-0 h-8 px-2 items-center inline-flex z-10" style="direction: ltr; text-align: left; text-indent: 0px; text-transform: none;">
</div>
</button></div>
<div class="text-text-500 font-small p-3.5 pb-0" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
properties</div>
<pre><div class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5" style="text-align: left; text-indent: 0px; text-transform: none; font-size: 12pt;"><span style="color: rgb(189, 15, 30);"><code>graphdb.auth.database</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(43, 48, 59);"><code>=</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(0, 128, 0);"><code>oauth</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(189, 15, 30);"><code>graphdb.auth.oauth.roles_claim</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(43, 48, 59);"><code>=</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(0, 128, 0);"><code>roles</code></span><span style="color: rgb(20, 24, 31);"><code>
</code></span><span style="color: rgb(189, 15, 30);"><code>graphdb.auth.oauth.default_roles</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(43, 48, 59);"><code>=</code></span><span style="color: rgb(20, 24, 31);"><code> </code></span><span style="color: rgb(0, 128, 0);"><code>ROLE_USER</code></span></div></pre>
<p class="font-claude-response-body break-words whitespace-normal leading-[1.7]" style="text-align: left; text-indent: 0px; text-transform: none;">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">The
<code>graphdb.auth.openid.token_type</code> should be set to <code>access</code> if the access token is a JWT, otherwise use
<code>id</code>. For Shibboleth with the OIDC OP plugin, the access token is typically a JWT (per RFC 9068 support), so
<code>access</code> is usually the right choice. <a href="https://graphdb.ontotext.com/documentation/11.3/access-control.html#access-control-openid-authentication" target="_blank" class="group/tag relative h-[18px] rounded-full inline-flex items-center overflow-hidden -translate-y-px cursor-pointer" originalsrc="https://graphdb.ontotext.com/documentation/11.3/access-control.html#access-control-openid-authentication" data-outlook-id="35a70623-2a32-4e40-86e0-8984ae743fa1" style="margin-top: 0px; margin-bottom: 0px;">
ontotext</a></span></p>
<hr style="text-align: left; text-indent: 0px;">
<h3 class="text-text-100 mt-2 -mb-1 text-base font-bold" style="text-align: left; text-indent: 0px; text-transform: none; color: rgb(0, 0, 0);">
<span style="font-family: Aptos, Arial, Helvetica, sans-serif;">Summary Checklist</span></h3>
<table class="min-w-full border-collapse text-sm leading-[1.7] whitespace-normal" style="text-align: left; text-indent: 0px; text-transform: none;">
<tbody>
<tr>
<th class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Step</div>
</th>
<th class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Where</div>
</th>
<th class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Action</div>
</th>
</tr>
<tr>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Install OIDC OP plugin</div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Shibboleth</div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<code>plugin.sh -I net.shibboleth.idp.plugin.oidc.op</code></div>
</td>
</tr>
<tr>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Import <code>oidc-credentials.xml</code></div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<code>conf/credentials.xml</code></div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Add import statement</div>
</td>
</tr>
<tr>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Generate JWK keys</div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<code>credentials/</code></div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Run <code>jwtgen.sh</code></div>
</td>
</tr>
<tr>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Set issuer URL</div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<code>conf/oidc.properties</code></div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<code>idp.oidc.issuer</code></div>
</td>
</tr>
<tr>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Expose discovery endpoint</div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Web server / IdP</div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Route <code>/.well-known/openid-configuration</code></div>
</td>
</tr>
<tr>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Enable OIDC profiles</div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<code>conf/relying-party.xml</code></div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Add <code>OIDC.SSO</code>, <code>OIDC.UserInfo</code>, etc.</div>
</td>
</tr>
<tr>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Register GraphDB client</div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<code>metadata/oidc-client.json</code></div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<code>client_id</code>, <code>redirect_uri</code>, scopes</div>
</td>
</tr>
<tr>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Release username + roles claims</div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Attribute filter</div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Target GraphDB's <code>client_id</code></div>
</td>
</tr>
<tr>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Configure GraphDB</div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<code>graphdb.properties</code></div>
</td>
<td class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none;">
<div class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top" style="text-align: left; text-indent: 0px; text-transform: none; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Set <code>issuer</code>, <code>client_id</code>, <code>auth_flow</code>, <code>token_type</code></div>
</td>
</tr>
</tbody>
</table>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
</div>
</body>
</html>