[
https://issues.apache.org/jira/browse/SYNCOPE-1270?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16461081#comment-16461081
]
ASF GitHub Bot commented on SYNCOPE-1270:
-----------------------------------------
Github user ilgrosso commented on the issue:
https://github.com/apache/syncope/pull/74
Thanks @DimaAy the code looks almost complete, and it's also working.
I would just make some enhancements to the Admin Console management:
1. When adding / editing an OIDC provider, validate all values that are
expected to be URIs *before* saving
1. Move the `Has Discovery Document` flag after `Issuer`
1. When editing an existing ODIC provider, make all the second step's
fields as read-only, and show them all despite the Discovery Document was used
during create
Side note: I see there is no yet support for
[Logout](https://medium.com/@robert.broeckelmann/openid-connect-logout-eccc73df758f),
which is provided at least by
[Azure](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/development/ad-fs-logout-openid-connect),
maybe you can submit a new PR for that after the current ones gets merged.
> OpenID Connect client feature
> -----------------------------
>
> Key: SYNCOPE-1270
> URL: https://issues.apache.org/jira/browse/SYNCOPE-1270
> Project: Syncope
> Issue Type: New Feature
> Components: extensions
> Reporter: Dima Ayash
> Priority: Major
> Fix For: 2.0.9, 2.1.0
>
>
> This feature implements an SSO access to the Enduser UI and Admin Console by
> using [OpenID Connect 1.0|http://openid.net/connect/] which is a simple
> identity layer on top of the OAuth 2.0 protocol. It allows Clients to verify
> the identity of the End-User based on the authentication performed by an
> Authorization Server, as well as to obtain basic profile information about
> the End-User in an interoperable and REST-like manner.
> The flow for this feature will be possibly as follow (using Google as an
> example of OpenID Connect Provider):
> # From Enduser or Admin login UI, the user can choose to be authenticated
> using Google account.
> # Check if the user has a valid session, otherwise prompts the user to login
> by redirecting him to the Google Login UI.
> # After the user login successfully to his Google account, grant him an
> access to Enduser UI or Admin console.
> This will be achieved by following the OpenId Connect required flow,
> leveraging possibly from CXF features.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
