14.3. Configuring OpenAM For OpenID Connect Discovery

In order to allow clients to discover the provider for an end user, OpenAM supports OpenID Connect Discovery 1.0. In addition to discovering the provider for an end user, the client can also request the OpenID Connect Provider configuration.

OpenAM as OpenID Connect Provider exposes two endpoints for discovery:

/.well-known/webfinger
/.well-known/openid-configuration

A client needs to be able to discover the provider for an end user. In this case you should consider redirecting requests to URIs at the server root, such as http://www.example.com/.well-known/webfinger and http://www.example.com/.well-known/openid-configuration, to these Well-Known URIs in OpenAM's space.

Discovery relies on WebFinger, a protocol to discover information about people and other entities using standard HTTP methods. WebFinger uses Well-Known URIs, which defines the path prefix /.well-known/ for the URLs defined by OpenID Connect Discovery.

Unless you deploy OpenAM in the root context of a container listening on port 80 on the primary host for your domain, clients need to find the right host:port/deployment-uri combination to locate the well-known endpoints. Therefore you must manage the redirection to OpenAM. If you are using WebFinger for something else than OpenID Connect Discovery, then you probably also need proxy logic to route the requests.

To retrieve the provider for an end user, the client needs the following.

host

The server where the client can access the WebFinger service.

Notice that this is a host name rather than a URL to the endpoint, which is why you might need to redirect clients appropriately as described above.

resource

Identifies the end user that is the subject of the request.

The client must percent-encode the resource value when using it in the query string of the request, so when using the "acct" URI scheme and the resource is acct:user@example.com, then the value to use is acct%3Auser%40example.com.

rel

URI identifying the type of service whose location is requested.

In this case http://openid.net/specs/connect/1.0/issuer, which is http%3A%2F%2Fopenid.net%2Fspecs%2Fconnect%2F1.0%2Fissuer.

Ignoring the question of redirection, you can test the endpoint for the demo user account (output lines folded to make them easier to read). 

$ curl "https://openam.example.com:8443/openam/.well-known/webfinger
 ?resource=acct%3Ademo%40example.com
 &rel=http%3A%2F%2Fopenid.net%2Fspecs%2Fconnect%2F1.0%2Fissuer"
{
  "subject": "acct:demo@example.com",
  "links": [
    {
      "rel": "http://openid.net/specs/connect/1.0/issuer",
      "href": "https://openam.example.com:8443/openam"
    }
  ]
}

This shows that the OpenID Connect Provider for the OpenAM demo user is indeed the OpenAM server.

The client can also discover the provider configuration. Ignoring the question of redirection, you can test this (output lines folded to make them easier to read). 

{
    "response_types_supported": [
        "id_token|org.forgerock.restlet.ext.oauth2.flow.responseTypes.IDTokenResponseType",
        "token|org.forgerock.restlet.ext.oauth2.flow.responseTypes.TokenResponseType",
        "code|org.forgerock.restlet.ext.oauth2.flow.responseTypes.CodeResponseType"
    ],
    "registration_endpoint": "https://openam.example.com:8443/openam/oauth2/connect/register",
    "token_endpoint": "https://openam.example.com:8443/openam/oauth2/access_token",
    "end_session_endpoint": "https://openam.example.com:8443/openam/oauth2/connect/endSession",
    "version": "3.0",
    "userinfo_endpoint": "https://openam.example.com:8443/openam/oauth2/userinfo",
    "subject_types_supported": [
        "pairwise",
        "public"
    ],
    "issuer": "https://openam.example.com:8443/openam",
    "jwks_uri": "",
    "id_token_siging_alg_values_supported": [
        "HmacSHA256",
        "HmacSHA512",
        "HmacSHA384"
    ],
    "check_session_iframe": "https://openam.example.com:8443/openam/oauth2/connect/checkSession",
    "claims_supported": [
        "phone",
        "email",
        "address",
        "openid",
        "profile"
    ],
    "authorization_endpoint": "https://openam.example.com:8443/openam/oauth2/authorize"
}