2:21 p.m.
Liferay Portal has an OpenID Connect plugin, configured by a property file with these
properties
openidconnect.enableOpenIDConnect=true
openidconnect.token-location=https://<my keycloak and
port>/auth/realms/CMFIRST/protocol/openid-connect/token
openidconnect.authorization-location=https://<my keycloak and
port>/auth/realms/CMFIRST/protocol/openid-connect/auth
openidconnect.profile-uri=https://<my keycloak and
port>/auth/realms/CMFIRST/protocol/openid-connect/userinfo
openidconnect.issuer=https://<my keycloak and
port>/auth/realms/CMFIRST/protocol/openid-connect/certs
openidconnect.client-id=Portal
openidconnect.secret=<my secret>
openidconnect.scope=openid profile email
Property docs at end of email
My keycloak Client is an out of the box setup
Here are the realm keys.
AES
OCT
<a uuid>
100
aes-generated<https://mobileportal.cmfirsttech.com:9280/auth/admin/master/console/#/realms/CMFIRST/keys/providers/aes-generated/b00f30ba-49da-4dfb-8f21-c256b069ec5b>
HS256
OCT
<a uuid>
100
hmac-generated<https://mobileportal.cmfirsttech.com:9280/auth/admin/master/console/#/realms/CMFIRST/keys/providers/hmac-generated/c2362731-7a65-416f-918e-1b8c67ac7cb1>
RS256
RSA
<something>
100
rsa-generated<https://mobileportal.cmfirsttech.com:9280/auth/admin/master/console/#/realms/CMFIRST/keys/providers/rsa-generated/e57385c6-e6eb-421c-945e-725a30f189b5>
Public key
Certificate
Liferay does not like the jwt signature
13:09:39,833 WARN [http-bio-8080-exec-10][Liferay62Adapter:46] The token was not valid:
-- JWT --__Raw String:
eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJWTUtfTHpWbDY0T2plZW9NVkppajRTLTFNYTZ3aDU5b1dkWHpycXZ5MDJBIn0.eyJqdGkiOiJmZWY0MzVmMS0wOTI0LTQ5MWUtODk0MS1kMjFhMGRhZWNlY2EiLCJleHAiOjE1NTA1ODIwNzksIm5iZiI6MCwiaWF0IjoxNTUwNTgxNzc5LCJpc3MiOiJodHRwczovL21vYmlsZXBvcnRhbC5jbWZpcnN0dGVjaC5jb206OTI4MC9hdXRoL3JlYWxtcy9DTUZJUlNUIiwiYXVkIjoiUG9ydGFsIiwic3ViIjoiZmYwYmY1MWUtOWFmOS00M2JkLWE0NTQtZGQzZDM5OTM4ZjFhIiwidHlwIjoiSUQiLCJhenAiOiJQb3J0YWwiLCJhdXRoX3RpbWUiOjE1NTA1ODE3NzksInNlc3Npb25fc3RhdGUiOiI1YjE3NzVjZS0xYWZlLTQ3ODItYWM4OC1jOTgwZTg4NTIxOTUiLCJhY3IiOiIxIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJmbXNzdGFmZiJ9.APuz2MZkEbk3ADgPw2F4BxaS5ETkIMDeGerMZqmLPEYI-I04l0f8iOBFyxcVDV4C-dGginNcyqgL7Ep459B8kkm8mDwCWj2QqUo3VQF9QyTCRnz22vpqYEaJqsjmgQ5d7Bby6wCYshXECSuSNIUJ3N9ZMQVa_yq1qUM9JWg00FRs41ed4fJGhV1EWNFZGF5hKrJXfXQoICkdB61AjsjCE6Fi84P22hM_3AgDwvuS140USWweG0JA72EL3mdpQtXKB_5GAvG6XLEHGQu7QUGJPSxvyQ94Vr8Z74TobnPFsBamy7uzgNji5SJRnTxOjNsWlxYFIzp4bYHtUgmYoelxLg__Header:
{"typ": "JWT", "alg": "RS256", "cty":
"null" , "kid":
"VMK_LzVl64OjeeoMVJij4S-1Ma6wh59oWdXzrqvy02A"}__Claims Set: {"iss":
"https://<my kc host and port>/auth/realms/CMFIRST", "sub":
"ff0bf51e-9af9-43bd-a454-dd3d39938f1a", "aud": ["Portal"],
"exp": 1550582079, "nbf": "0", "iat": 1550581779,
"jti": "fef435f1-0924-491e-8941-d21a0daececa", "typ":
"ID" }__Signature:
APuz2MZkEbk3ADgPw2F4BxaS5ETkIMDeGerMZqmLPEYI-I04l0f8iOBFyxcVDV4C-dGginNcyqgL7Ep459B8kkm8mDwCWj2QqUo3VQF9QyTCRnz22vpqYEaJqsjmgQ5d7Bby6wCYshXECSuSNIUJ3N9ZMQVa_yq1qUM9JWg00FRs41ed4fJGhV1EWNFZGF5hKrJXfXQoICkdB61AjsjCE6Fi84P22hM_3AgDwvuS140USWweG0JA72EL3mdpQtXKB_5GAvG6XLEHGQu7QUGJPSxvyQ94Vr8Z74TobnPFsBamy7uzgNji5SJRnTxOjNsWlxYFIzp4bYHtUgmYoelxLg__---------
[Sanitized]
I don't have this problems in my web apps, they use the Tomcat adapter and no issue
with the JWT sig.
Any suggestions?
Property docs
Portal properties
The following portal properties can be set. They are required unless specified as
optional.
openidconnect.enableOpenIDConnect
Whether to enable the plugin (effectively allowing you to disable the plugin without
uninstalling it). Boolean, either 'true' or 'false'. Default is false.
openidconnect.authorization-location
Complete url to the OpenID Connect Provider's authorization location. Example for
Google: https://accounts.google.com/o/oauth2/v2/auth
openidconnect.token-location
Complete url to the OpenID Connect Provider's token location. Example for Google:
https://www.googleapis.com/oauth2/v4/token
openidconnect.profile-uri
Complete URL to the 'user info' endpoint. Example for Google:
https://www.googleapis.com/plus/v1/people/me/openIdConnect
openidconnect.sso-logout-uri (Optional)
openidconnect.sso-logout-param (Optional)
openidconnect.sso-logout-value (Optional)
Complete URL to the 'SSO logout' endpoint. Ignored if empty. After redirection to
the given URL, the OpenID Connect Provider should redirect to the Lifery Portal home page
(or another public after-logout-resource). This target may be included in this URL as a
URL parameter or may be configured for the OpenID Connect Provider.
openidconnect.issuer
The information retrieved from the user info endpoint has to be verified against a
preconfigured string, according to the OpenID Connect spec. This 'issuer' claim is
used for that. Example for Google: https://accounts.google.com
openidconnect.client-id
Register your Liferay portal as a 'client app' with the Google developer console,
and the resulting client id is the openid connect client id. Non-working example for
Google: 7kasuf1-123123adfaafdsflni7me2kr.apps.googleusercontent.com
openidconnect.secret
Secret of the client, after registration of the Liferay portal, just like the client-id.
openidconnect.scope
Scope(s) of the access token (space separated), should be the same (or a subset) of the
scopes allowed by the provider to the client. Default value: openid profile email
openidconnect.provider (Optional)
Type of OpenID Connect provider. Supported values: generic (default), azure. For most
Provider implementations, the generic provider works. For Azure, use the value azure as
this makes slight changes to the fields sent as UserInfo.