oidc_idp.conf

# ---------------------------------------------------------------------------- #
#                                                                              #
#                     IDP Configuration for OpenID Connect                     #
#                            (within http block)   |                           #
#                                                  |                           #
#              http {                              |                           #
#                    :                             |                           #
#                  +--------------------------+    |                           #
#                  | include "oidc_idp.conf"; | <--+                           #
#                  +--------------------------+                                #
#                    :                                                         #
#                  server {                                                    #
#                      :                                                       #
#                  }                                                           #
#                    :                                                         #
#              }                                                               #
#                                                                              #
# - This file is to configure IDP related info to handle OIDC workflow.        #
# - Each map block allows multi values so that multiple IdPs can be supported. #
#                                                                              #
# ---------------------------------------------------------------------------- #

# ---------------------------------------------------------------------------- #
#   1. OpenID Provider(IDP) Metadata Configuration via Well-Known Endpoints    #
#      https://[domain]/nidp/oauth/nam/.well-known/openid-configuration
#      https://cognito-idp.[region].amazonaws.com/[userPoolId]/.well-known/openid-configuration
#      https://accounts.google.com/.well-known/openid-configuration
# ---------------------------------------------------------------------------- #

map $x_client_id $oidc_app_identifier {
    # This app identifier name should be unique per each IdP app.
    # It doesn't have to be same as the name of IdP's application.
    # This is to support multiple IdP apps per each host.
    default                     "{{edit-app-identifier}}";
    "my-client-id-24"            my-keycloak-24-app;
    "my-client-id-21"            my-keycloak-21-app;
    "{{edit-cognito-client-id}}" my-cognito-app;
    "{{edit-okta-client-id}}"    my-okta-app;
    "{{edit-google-client-id}}"  my-google-app;
}

map $oidc_app_identifier $idp_region {
    default        "{{edit-idp-region}}";
    my-cognito-app "us-east-2";
}

map $oidc_app_identifier $idp_domain {
    default           "{{edit-IdP-domain}}";
    my-keycloak-24-app host.docker.internal:8443/realms/master/protocol/openid-connect;
    my-keycloak-21-app host.docker.internal:7443/realms/master/protocol/openid-connect;
    my-cognito-app     "{{edit-your-app-name}}.auth.$idp_region.amazoncognito.com";
    my-okta-app        "{{edit-your-cname}}.okta.com";
}

map $oidc_app_identifier $idp_user_pool_id {
    default         "{{edit-user-pool-id}}"; # for Cognito
}

map $oidc_app_identifier $oidc_authz_endpoint {
    default            https://$idp_domain/nidp/oauth/nam/authz;
    my-keycloak-24-app https://$idp_domain/auth;
    my-keycloak-21-app https://$idp_domain/auth;
    my-cognito-app     https://$idp_domain/oauth2/authorize;
    my-okta-app        https://$idp_domain/oauth2/default/v1/authorize;
    my-google-app      https://accounts.google.com/o/oauth2/v2/auth;
}

map $oidc_app_identifier $oidc_jwt_keyfile {
    default            https://$idp_domain/nidp/oauth/nam/keys;
    my-keycloak-24-app https://$idp_domain/certs;
    my-keycloak-21-app https://$idp_domain/certs;
    my-cognito-app     https://cognito-idp.$idp_region.amazonaws.com/$idp_user_pool_id/.well-known/jwks.json;
    my-okta-app        https://$idp_domain/oauth2/default/v1/keys;
    my-google-app      https://www.googleapis.com/oauth2/v3/certs;
}

map $oidc_app_identifier $oidc_logout_endpoint {
    default            https://$idp_domain/nidp/oauth/v1/nam/end_session;
    my-keycloak-24-app https://$idp_domain/logout;
    my-keycloak-21-app https://$idp_domain/logout;
    my-cognito-app     https://$idp_domain/logout;
    my-okta-app        https://$idp_domain/oauth2/default/v1/logout;
}

map $oidc_app_identifier $oidc_token_endpoint {
    default            https://$idp_domain/nidp/oauth/nam/token;
    my-keycloak-24-app https://$idp_domain/token;
    my-keycloak-21-app https://$idp_domain/token;
    my-cognito-app     https://$idp_domain/oauth2/token;
    my-okta-app        https://$idp_domain/oauth2/default/v1/token;
    my-google-app      https://oauth2.googleapis.com/token;
}

map $oidc_app_identifier $oidc_userinfo_endpoint {
    default            https://$idp_domain/nidp/oauth/nam/userinfo;
    my-keycloak-24-app https://$idp_domain/userinfo;
    my-keycloak-21-app https://$idp_domain/userinfo;
    my-cognito-app     https://$idp_domain/oauth2/userInfo;
    my-okta-app        https://$idp_domain/oauth2/default/v1/userinfo;
    my-google-app      https://openidconnect.googleapis.com/v1/userinfo;
}

map $oidc_app_identifier $oidc_scopes {
    default            "openid+profile+email";
    my-keycloak-24-app "openid+profile+email";
    my-keycloak-21-app "openid+profile+email";
    my-cognito-app     "openid+profile+email";
    my-okta-app        "openid+profile+email";
    my-google-app      "openid+profile+email";
}

# ---------------------------------------------------------------------------- #
#   2. Custom Configuration for Well-Known OIDC Endpoints                      #
# ---------------------------------------------------------------------------- #

map $oidc_app_identifier $oidc_authz_path_params_enable {
    default 0;
}

map $oidc_app_identifier $oidc_authz_path_params {
    default "";
}

map $oidc_app_identifier $oidc_authz_query_params_enable {
    default 0;
}

map $oidc_app_identifier $oidc_authz_query_params {
    default "";
}

map $oidc_app_identifier $oidc_logout_path_params_enable {
    default 0;
}

map $oidc_app_identifier $oidc_logout_path_params {
    default "";
}

map $oidc_app_identifier $oidc_logout_query_params_enable {
    default            0; # 0: OIDC RP-initiated logout, 1: custom logout
    my-keycloak-24-app 1;
    my-keycloak-21-app 1;
    my-cognito-app     1;
}

map $oidc_app_identifier $oidc_logout_query_params {
    default "";
    # Keycloak 24:
    # --------------------------------------------------------------------------
    # - id_token_hint is mandatory when post_logout_redirect_uri param is used.
    # - error message: Missing parameters: id_token_hint
    # my-keycloak-24-app '{
    #     "post_logout_redirect_uri": "$redirect_base/_logout"
    # }';
    # - empty query param or `client_id & post_logout_redirect_uri` query params 
    #   should result in a keycloak page asking: "Do you want to logout?"
    # my-keycloak-24-app '{
    #     "client_id": "$oidc_client",
    #     "post_logout_redirect_uri": "$redirect_base/_logout"
    # }';

    # Keycloak 21:
    # --------------------------------------------------------------------------
    # - a single query param: 'post_logout_redirect_uri' should result in a 
    #   keycloak page asking: "Do you want to logout?"
    # my-keycloak-21-app '{
    #     "post_logout_redirect_uri": "$redirect_base/_logout"
    # }';
    # my-keycloak-24-app '{
    #     "id_token_hint": "$id_token",
    #     "post_logout_redirect_uri": "$redirect_base/_logout"
    # }';
    my-keycloak-24-app '{
        "id_token_hint": "$id_token",
        "post_logout_redirect_uri": "$redirect_base/_logout"
    }';
    # my-keycloak-21-app '{
    #     "id_token_hint": "$id_token",
    #     "post_logout_redirect_uri": "$redirect_base/_logout"
    # }';
    my-cognito-app '{
        "client_id"  : "$oidc_client",
        "logout_uri" : "$redirect_base/_logout"
    }';
}

map $oidc_app_identifier $oidc_token_path_params_enable {
    default 0;
}

map $oidc_app_identifier $oidc_token_path_params {
    default "";
}

map $oidc_app_identifier $oidc_token_query_params_enable {
    default 0;
}

map $oidc_app_identifier $oidc_token_query_params {
    default "";
}


# ---------------------------------------------------------------------------- #
#   3. Advanced OIDC Configuration                                             #
# ---------------------------------------------------------------------------- #

map $oidc_app_identifier $oidc_client {
    default            "{{edit-netiq-client-id}}";
    my-keycloak-24-app "my-client-id-24";
    my-keycloak-21-app "my-client-id-21";
    my-cognito-app     "{{edit-cognito-client-id}}";
    my-okta-app        "{{edit-okta-client-id}}";
    my-google-app      "{{edit-google-client-id}}";
}

map $oidc_app_identifier $oidc_pkce_enable {
    default            1;
    my-keycloak-24-app 1;
    my-keycloak-21-app 1;
    my-cognito-app     0;
    my-okta-app        0;
    my-google-app      0;
}

map $oidc_app_identifier $oidc_client_secret {
    default            "{{edit-your-client-secret-unless-pkce-enabled}}";
    my-keycloak-24-app "";
    my-keycloak-21-app "";
    my-cognito-app     "{{edit-your-client-secret-unless-pkce-enabled}}";
    my-okta-app        "{{edit-your-client-secret-unless-pkce-enabled}}";
    my-google-app      "{{edit-your-client-secret-unless-pkce-enabled}}";
}

map $oidc_app_identifier $oidc_logout_redirect {
    default "/_logout"; # This is called by IdP after successful logout.
}

map $oidc_app_identifier $oidc_hmac_key {
    default            "ChangeMe"; # This should be unique for every NGINX instance/cluster
    my-keycloak-24-app "change-me-for-keycloak-24-hmac-key";
    my-keycloak-21-app "change-me-for-keycloak-21-hmac-key";
    my-cognito-app     "change-me-for-cognito-hmac-key";
    my-okta-app        "change-me-for-okta-hmac-key";
    my-google-app      "change-me-for-google-hmac-key";
}

map $oidc_app_identifier $oidc_app_name {
    default "{{optional-edit-your-idp-app-name}}";
}

# vim: syntax=nginx