Hi Jim, > On Mar 13, 2019, at 3:26 PM, Basney, Jim <[email protected]> wrote: > > Yes, that kc_idp_hint parameter seems to be exactly what we're looking for. > Thanks Thejaka!
Yes, kc_idp_hint is what we use in Airavata (and in the Galaxy integration) to bypass the Keycloak login page and redirect directly to CILogon. > > Also thanks Gowtham for the pointer to the keycloak-user post. > > I wonder if kc_idp_hint supports (or could be easily modified to support) > chained hinting. AARC-G049 has the following example: > > https://example.service.edu/?idphint=urlencode(https://idp-sp-proxy.org/oauth2?idphint=urlencode(https://home-idp.org/idp/shibboleth)) > > <https://example.service.edu/?idphint=urlencode(https://idp-sp-proxy.org/oauth2?idphint=urlencode(https://home-idp.org/idp/shibboleth))> My guess is that kc_idp_hint could be chained, but that would only work with Keycloak, where one Keycloak server is configured to use a second Keycloak server as an identity provider. But in the AARC example, would the idphint really be the Authorization URL to redirect to? > > We might consider the following concrete case, where the University of > Illinois has a Galaxy instance that uses Shibboleth authentication: > > https://galaxy.illinois.edu/ <https://galaxy.illinois.edu/> > -> https://iam.scigap.org/ <https://iam.scigap.org/> (Keycloak > issuer?) > -> https://cilogon.org/ <https://cilogon.org/> > (CILogon's OIDC issuer) > -> urn:mace:incommon:uiuc.edu <http://uiuc.edu/> (Illinois IdP entityID) > > So https://galaxy.illinois.edu/ <https://galaxy.illinois.edu/> would redirect > to: > > https://iam.scigap.org/auth/realms/uiuc/broker/cilogon/endpoint?idphint=urlencode(urn:mace:incommon:uiuc.edu) > > <https://iam.scigap.org/auth/realms/uiuc/broker/cilogon/endpoint?idphint=urlencode(urn:mace:incommon:uiuc.edu)> > or maybe that should instead be > https://iam.scigap.org/auth/realms/uiuc/endpoint?idphint=urlencode(https://cilogon.org/?idphint=urlencode(urn:mace:incommon:uiuc.edu)) > > <https://iam.scigap.org/auth/realms/uiuc/endpoint?idphint=urlencode(https://cilogon.org/?idphint=urlencode(urn:mace:incommon:uiuc.edu))> > and until we support the idphint standard it might instead be > https://iam.scigap.org/auth/realms/uiuc/endpoint?kc_idp_hint=urlencode(https://cilogon.org/?selected_idp=urlencode(urn:mace:incommon:uiuc.edu)) > > <https://iam.scigap.org/auth/realms/uiuc/endpoint?kc_idp_hint=urlencode(https://cilogon.org/?selected_idp=urlencode(urn:mace:incommon:uiuc.edu))> Thanks for the concrete example Jim! This is very helpful! Yes, concretely with the approach I proposed that redirect would look like: https://iam.scigap.org/auth/realms/uiuc/endpoint?kc_idp_hint=urlencode(cilogon)&selected_idp=urlencode(urn:mace:incommon:uiuc.edu) <https://iam.scigap.org/auth/realms/uiuc/endpoint?kc_idp_hint=urlencode(cilogon)&selected_idp=urlencode(urn:mace:incommon:uiuc.edu)> The kc_idp_hint value should match the "alias" of an Identity Provider registered for that Keycloak realm. The alias can be whatever the Keycloak admin specifies when registering the Identity Provider. When adding CILogon as an identity provider we (as in SciGaP) normally specify the alias to be "cilogon", but it could really be anything. Normally what Keycloak would do is lookup the Identity Provider matching the given alias and then redirect to it's Authorization URL: https:// <https://cilogon.org/authorize?scope=openid+email+profile+org.cilogon.userinfo&state=...&response_type=code&client_id=...&redirect_uri=https://iam.scigap.org/auth/realms/uiuc/endpoint>cilogon.org/authorize?scope=urlencode <http://cilogon.org/authorize?scope=urlencode>(openid email profile org.cilogon.userinfo)&state=...&response_type=code&client_id=...&redirect_uri=urlencode( <https://cilogon.org/authorize?scope=openid+email+profile+org.cilogon.userinfo&state=...&response_type=code&client_id=...&redirect_uri=https://iam.scigap.org/auth/realms/uiuc/endpoint>https://iam.scigap.org/auth/realms/uiuc/endpoint <https://iam.scigap.org/auth/realms/uiuc/endpoint>) The Authorization URL could be configured to include an idp hint like selected_idp (we've done that before), but that would be a static configuration. But a custom Authorizer, as I proposed earlier, can control how that redirect URL gets built. The custom Authorizer could be developed such that it looks at the request URL and copies on to the redirect URL specific query parameters (can be configurable). Specifically, it could copy the selected_idp query parameter to the redirect URL: https://cilogon.org/authorize?scope=urlencode(openid email profile org.cilogon.userinfo)&state=...&response_type=code&client_id=...&redirect_uri=urlencode(https://iam.scigap.org/auth/realms/uiuc/endpoint)&selected_idp=urlencode(urn:mace:incommon:uiuc.edu) One complication with this approach would occur when both Keycloak and CILogon are using the standard idphint parameter, because there wouldn't be support for multiple idphints (Keycloak wouldn't know which one to use): https://iam.scigap.org/auth/realms/uiuc/endpoint?idphint=urlencode(cilogon)&idphint=urlencode(urn:mace:incommon:uiuc.edu) <https://iam.scigap.org/auth/realms/uiuc/endpoint?idphint=urlencode(cilogon)&idphint=urlencode(urn:mace:incommon:uiuc.edu)> In that case we could have some sort of mapping for the idp hint parameter to be passed on to CILogon and name it, for example, "cilogon_idphint". https://iam.scigap.org/auth/realms/uiuc/endpoint?idphint=urlencode(cilogon)&cilogon_idphint=urlencode(urn:mace:incommon:uiuc.edu) <https://iam.scigap.org/auth/realms/uiuc/endpoint?idphint=urlencode(cilogon)&cilogon_idphint=urlencode(urn:mace:incommon:uiuc.edu)> The custom Authenticator would then look for the "cilogon_idphint" query parameter but copy it to the Authorization URL named as "idphint". Thanks, Marcus
smime.p7s
Description: S/MIME cryptographic signature
