[SYNCOPE-1270] OpenID Connect client feature

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.0.9, 2.1.0
• Component/s: extensions
• Assignee: Francesco Chicchiriccò
• Reporter: Dima Ayash
• Created: 07/Feb/18 10:45
• Updated: 06/Jul/18 13:32
• Resolved: 10/May/18 07:44

Description

This feature implements an SSO access to the Enduser UI and Admin Console by using OpenID Connect 1.0 which is a simple identity layer on top of the OAuth 2.0 protocol. It allows Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server, as well as to obtain basic profile information about the End-User in an interoperable and REST-like manner.
The flow for this feature will be possibly as follow (using Google as an example of OpenID Connect Provider):

1. From Enduser or Admin login UI, the user can choose to be authenticated using Google account.
2. Check if the user has a valid session, otherwise prompts the user to login by redirecting him to the Google Login UI.
3. After the user login successfully to his Google account, grant him an access to Enduser UI or Admin console.

This will be achieved by following the OpenId Connect required flow, leveraging possibly from CXF features.

Issue Links

• is required by: SYNCOPE-1018 Social registration for Enduser UI
• links to: GitHub Pull Request #74
• links to: GitHub Pull Request #75