将一个 ISAM 逆向代理配置为一个 OpenID Connect 提供程序的 PEP

“在本文中，我将介绍如何将一个逆向代理配置为一个与 OpenID Connect 提供程序所发放的访问令牌兼容的策略执行点。”

第 1 步. 配置 OP 联合认证协议

通过用户界面配置联合认证协议

通过 REST 配置联合认证协议

POST_DATA='
{
  "name": "acmeProvider",
  "protocol": "OIDC",
  "role": "op",
  "configuration": {
    "providerId": "acmeProvider",
    "issuerIdentifier": "https://acmeProvider.com",
    "signatureAlgorithm": "HS256",
    "authorizationCodeLength": 30,
    "refreshTokenLength": 50,
    "accessTokenLength": 40,
    "authorizationCodeLifetime": 30,
    "accessTokenLifetime": 7200,
    "authorizationGrantLifetime": 604800,
    "idTokenLifetime": 7200,
    "grantTypesSupported": [
      "authorization_code",
      "implicit",
      "refresh_token"
    ],
    "identityMapping": {
      "activeDelegateId": "default-map",
      "properties": {
        "identityMappingRuleReference": "5"
      }
    }
  }
}'

curl -k -vvv --user $USER:$PASSWORD  -H 'Content-Type: application/json' /
-H 'Accept: application/json' https://$HOST/iam/access/v8/federations/ -d "$POST_DATA"

curl -k -vvv --user $USER:$PASSWORD  -H 'Accept: application/json' /
https://$HOST/iam/access/v8/federations/$FED_UUID/partners

curl -k -vvv --user $USER:$PASSWORD  -H 'Accept: application/json' /
https://$HOST/iam/access/v8/federations/$FED_UUID/partners/$PARTNER_UUID

配置 OP 伙伴

POST_DATA='
  {
    "role": "op",
    "templateName": "",
    "configuration": {
      "responseTypes": [
        "code"
      ],
      "clientId":"rpClient",
      "clientSecret":"rpClientSecret",
      "clientName": "Reverse proxy Client",
      "tokenEndpointAuthMethod": "clientSecretBasic",
      "scope": [
        "openid",
      ],
      "allowRefreshGrant": true,
      "redirectUris": [
        "https://unused.com/"
      ],
      "allowIntrospect": true
    },
    "name": "reverseProxyClient",
    "enabled": true
  }
'

curl -k -vvv --user $USER:$PASSWORD  -H 'Content-Type: application/json' /
-H 'Accept: application/json' https://$HOST/iam/access/v8/federations/$UUID/partners -d "$POST_DATA"

第 2 步. 将一个逆向代理配置为 OpenID Connect 的一个联系点。

POST_DATA='
{
  "runtime": {
    "hostname": "localhost",
    "port": "443",
    "username": "easuser",
    "password": "passw0rd"
  },
  "federation_id": "'$FED_UUID'",
  "reuse_certs": true,
  "reuse_acls": true
}
'
curl -k -vvv --user $USER:$PASSWORD -H "Accept: application/json" -H "Content-Type:application/json" /
 https://$HOST/wga/reverseproxy/$REVERSE_PROXY_NAME/fed_config -d "$POST_DATA"

pdadmin -a sec_master -p $PASSWORD user create testuser cn=testuser,dc=iswga testuser testuser testPwd
pdadmin -a sec_master -p $PASSWORD user modify testuser account-valid yes

执行一个测试流

{
  "access_token": "RMOqVQl7WHMNDeQQBwoXlpP41cqQdZqEq5TGSZrM",
  "token_type": "Bearer",
  "expires_in": 7199,
  "scope": "openid profile email",
  "refresh_token": "M62yhoNS7uGYboXGy7hJsHCyx6DhdMaCJFYEEXvtwNf18zY1AP",
  "id_token": "eyJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL2FjbWVQcm92aWRlci5jb20iLCJ
               hdF9oYXNoIjoiVWtwMlo3SnFnSDRna2lPTGJZZnJpQSIsInN1YiI6InRlc3R1c2VyIiw
               iYXVkIjoiOXNwOWhKck1YcExES1BWWTU3TTQiLCJyZWFsbU5hbWUiOiJtZ2EiLCJleHA
               iOjE0NDQ5NzY4NTMsImlhdCI6MTQ0NDk2OTY1M30.ViLy3ixFSkNBfMUFscFiQA6dVWJ
               p4i0QjL7r0_c6e1s"
}

$ JWT="eyJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL2FjbWVQcm92aWRlci5jb20iLCJhdF9oYXN
       oIjoiVWtwMlo3SnFnSDRna2lPTGJZZnJpQSIsInN1YiI6InRlc3R1c2VyIiwiYXVkIjoiOXNwOWh
       Kck1YcExES1BWWTU3TTQiLCJyZWFsbU5hbWUiOiJtZ2EiLCJleHAiOjE0NDQ5NzY4NTMsImlhdCI
       6MTQ0NDk2OTY1M30.ViLy3ixFSkNBfMUFscFiQA6dVWJp4i0QjL7r0_c6e1s"
$ JWT_HEAD=$(echo $JWT | cut -f1 -d".")
$ echo $JWT_HEAD | base64 -d
{"alg":"HS256"}
$ JWT_BODY=$(echo $JWT | cut -f2 -d".")
$ echo $JWT_BODY | base64 -d
{
  "iss": "https://acmeProvider.com",
  "at_hash": "Ukp2Z7JqgH4gkiOLbYfriA",
  "sub": "testuser",
  "aud": "9sp9hJrMXpLDKPVY57M4",
  "realmName": "mga",
  "exp": 1444976853,
  "iat": 1444969653
}

自检一个令牌

#!/bin/bash
REVERSE_PROXY_HOSTNAME=isam-demo
ACCESS_TOKEN=zWmP2T7qITV2ibMKaicNl8gxoQ9oWlWNX6VAExPE
PROVIDER_ID=acmeProvider
CLIENT_ID=9sp9hJrMXpLDKPVY57M4
CLIENT_SECRET=BYjqNcIHWGrP0wseZMNg

curl -k -u $CLIENT_ID:$CLIENT_SECRET /
https://$REVERSE_PROXY_HOSTNAME/isam/oidc/endpoint/amapp-runtime-$PROVIDER_ID/introspect /
-d "token=$ACCESS_TOKEN"

{
  "sub": "testuser",
  "grant_type": "authorization_code",
  "realmName": "mga",
  "scope": "openid profile email",
  "active": true,
  "exp": 1445228044,
  "token_type": "Bearer",
  "iat": 1445220844,
  "client_id": "9sp9hJrMXpLDKPVY57M4"
}

第 3 步. 配置 STS 链

创建链模板

上传映射规则

创建链

测试该链

#!/bin/bash
#For more on invoking the STS via HTTP.
#See Shane Weeden's blog post: https://ibm.biz/BdHHTt

REVERSE_PROXY_HOSTNAME=isam-demo
ISSUER=urn:ibm:ITFIM:oauth20:token:bearer
APPLIES_TO=https://localhost/sps/oidc
ACCESS_TOKEN=39eAcg8X9PUN6CWGoF9Wnti1KDME9IsjeR8y49fh
USER=easuser
PASSWORD=passw0rd

BODY='
<SOAP-ENV:Envelope
          xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
          xmlns:xsd="http://www.w3.org/2001/XMLSchema"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512"
          xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing"
          xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
          xmlns:wst="http://docs.oasis-open.org/ws-sx/ws-trust/200512"
>
  <SOAP-ENV:Body>
    <ns1:RequestSecurityTokenCollection>
      <ns1:RequestSecurityToken>
        <wsp:AppliesTo>
          <wsa:EndpointReference>
            <wsa:Address>https://localhost/sps/oidc</wsa:Address>
          </wsa:EndpointReference>
        </wsp:AppliesTo>
        <wst:Issuer>
          <wsa:Address>urn:ibm:ITFIM:oauth20:token:bearer</wsa:Address>
        </wst:Issuer>
        <wst:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Validate</wst:RequestType>
        <wst:Base>
          <stsuuser:STSUniversalUser xmlns:stsuuser="urn:ibm:names:ITFIM:1.0:stsuuser">
            <stsuuser:Principal/>
            <stsuuser:AttributeList/>
            <stsuuser:RequestSecurityToken>
              <stsuuser:Attribute name="AppliesTo" type="http://schemas.xmlsoap.org/ws/2004/09/policy">
                <stsuuser:Value>https://localhost/sps/oidc</stsuuser:Value>
              </stsuuser:Attribute>
              <stsuuser:Attribute name="Issuer" type="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
                <stsuuser:Value>urn:ibm:ITFIM:oauth20:token:bearer</stsuuser:Value>
              </stsuuser:Attribute>
              <stsuuser:Attribute name="Base" type="urn:ibm:names:ITFIM:1.0:stsuuser">
                <stsuuser:Value>
                  <stsuuser:STSUniversalUser>
                    <stsuuser:ContextAttributes>
                      <stsuuser:Attribute name="access_token" type="urn:ibm:names:ITFIM:oauth:param">
                        <stsuuser:Value>QLW6clF6O6NEXu8KjMZ2r2u9Si4qYtEC67EUMYon</stsuuser:Value>
                      </stsuuser:Attribute>
                    </stsuuser:ContextAttributes>
                  </stsuuser:STSUniversalUser>
                </stsuuser:Value>
              </stsuuser:Attribute>
            </stsuuser:RequestSecurityToken>
            <stsuuser:ContextAttributes>
              <stsuuser:Attribute name="access_token" type="urn:ibm:names:ITFIM:oauth:param">
                <stsuuser:Value>QLW6clF6O6NEXu8KjMZ2r2u9Si4qYtEC67EUMYon</stsuuser:Value>
              </stsuuser:Attribute>
            </stsuuser:ContextAttributes>
            <stsuuser:AdditionalAttributeStatement/>
          </stsuuser:STSUniversalUser>
        </wst:Base>
      </ns1:RequestSecurityToken>
    </ns1:RequestSecurityTokenCollection>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>
'
curl -k -vvv --user $USER:$PASSWORD /
https://$REVERSE_PROXY_HOSTNAME/isam/TrustServerWS/SecurityTokenServiceWST13 -d "$BODY"

第 4 步. 将逆向代理配置为一个执行点

[oauth]
fed-id-param = FederationId
default-fed-id = https://localhost/sps/oidc
user-identity-attribute = username
oauth-auth = both
cluster-name = oauth-cluster

[server]
http-method-disabled-remote = TRACE,CONNECT

[tfim-cluster:oauth-cluster]
basic-auth-user = easuser
basic-auth-passwd = passw0rd
handle-idle-timeout = 240
handle-pool-size = 10
ssl-keyfile = pdsrv.kdb
ssl-keyfile-stash = pdsrv.sth
server = 9,https://127.0.0.1/TrustServerWS/SecurityTokenServiceWST13
ssl-keyfile-label = server
[azn-decision-info]
HTTP_CONTENT_TYPE_HDR = header:content-type
HTTP_HOST_HDR = header:host
HTTP_REQUEST_METHOD = method
HTTP_TRANSFER_ENCODING_HDR = header:transfer-encoding
HTTP_AZN_HDR = header:authorization
HTTP_REQUEST_URI = uri
HTTP_REQUEST_SCHEME = scheme

配置 POP

pop create oidc-pop
pop modify oidc-pop set attribute eas-trigger oauth_pop_trigger

pop attach /WebSEAL/isam-op-default/ oidc-pop
server replicate

测试 PEP

$ curl -v -k -L  https://isam-demo/
> GET / HTTP/1.1
> User-Agent: curl/7.37.0
> Host: isam-demo
> Accept: */*
>
< HTTP/1.1 200 OK
< content-length: 12505
< content-type: text/html
< date: Tue, 20 Oct 2015 01:06:46 GMT
<
...
      &lt;form class="login-container" method="POST"
      action="/pkmslogin.form?token=Unknown"&gt;
... Login form.

$ curl -v -k -L -H "Authorization: Bearer QLW6clF6O6NEXu8KjMZ2r2u9Si4qYtEC67EUMYon" /
https://isam-demo/
> GET / HTTP/1.1
> User-Agent: curl/7.37.0
> Host: isam-demo
> Accept: */*
> Authorization: Bearer QLW6clF6O6NEXu8KjMZ2r2u9Si4qYtEC67EUMYon
>
< HTTP/1.1 200 OK
< content-length: 510
< content-type: text/html
...
   &lt;center&gt;&lt;img src="/pics/iv30.gif" alt=""&gt;&lt;/center&gt;
...Reverse Proxy Landing page

结束语