~ubuntu-branches/ubuntu/vivid/libapache2-mod-auth-openidc/vivid-proposed

« back to all changes in this revision

Viewing changes to auth_openidc.conf

Committer: Package Import Robot
Author(s): Hans Zandbelt
Date: 2014-10-13 12:23:35 UTC
mfrom: (1.1.3)
Revision ID: package-import@ubuntu.com-20141013122335-31wgnq50ascmubib

Tags: 1.6.0-1

new upstream release; add libssl-dev dependency

Show diffs side-by-side

added added

removed removed

auth_openidc.conf

# (Optional)

# When using multiple OpenID Connect Providers, possibly combined with Dynamic Client

# Registration and account-based OP Discovery.

# Directory that holds metadata files (must be writable for the Apache process/user)

# When not specified, it is assumed that we use a single statically configured provider

# as described under the section "OpenID Connect Provider" below.

# Specifies the directory that holds metadata files (must be writable for the Apache process/user).

# When not specified, it is assumed that we use a single statically configured provider as

# described under the section "OpenID Connect Provider" below, most likely using OIDCProviderMetadataURL.

#OIDCMetadataDir /var/cache/apache2/mod_auth_openidc/metadata

########################################################################################

# OpenID Connect Provider

# When configuration a single static provider and not using OpenID Connect Provider Discovery.

# For configuration of a single static provider not using OpenID Connect Provider Discovery.

100

101

########################################################################################

102

103

# URL where OpenID Connect Provider metadata can be found (e.g. https://accounts.google.com/.well-known/openid-configuration)

104

# The obtained metadata will be cached and refreshed every 24 hours.

105

# If set, individual entries below will not have to be configured but can be used to override

106

# settings obtained from the metadata.

107

# If not set, the entries below will have to be configured for a single static OP configuration

108

# or OIDCMetadataDir will have to be set for configuration of multiple OPs.

109

#OIDCProviderMetadataURL <url>

110

103

111

# OpenID Connect Provider issuer identifier (e.g. https://localhost:9031 or accounts.google.com)

104

112

#OIDCProviderIssuer <issuer>

105

113

121

129

#OIDCProviderTokenEndpointAuth <token_auth_method>

122

130

123

131

# (Optional)

132

# Extra parameters that need to be passed in the POST request to the Token Endpoint.

133

# Parameter names and values need to be provided in URL-encoded form.

134

# When not defined no extra parameters will be passed.

135

#OIDCProviderTokenEndpointParams <urlencoded-name1>=<urlencoded-value1>[&<urlencoded-nameN>=<urlencoded-valueN>]*

136

137

# (Optional)

124

138

# OpenID Connect Provider UserInfo Endpoint URL (e.g. https://localhost:9031/idp/userinfo.openid)

125

139

# When not defined no claims will be resolved from such endpoint.

126

140

#OIDCProviderUserInfoEndpoint <user_info_endpoint>

127

141

142

# (Optional)

143

# OpenID OP Check Session iFrame URL, for Session Management purposes.

144

# When not defined, no Session Management will be applied.

145

#OIDCProviderCheckSessionIFrame <url>

146

147

# (Optional)

148

# OpenID OP End Session Endpoint URL, for Single Logout (Session Management) purposes.

149

# When not defined, no logout to the IDP will be performed.

150

#OIDCProviderEndSessionEndpoint <url>

151

128

152

########################################################################################

129

153

130

154

# (Optional)

230

254

# (Optional)

231

255

# Defines a default URL to be used in case of 3rd-party or OP initiated

232

256

# SSO when no explicit target_link_uri has been provided.

233

# When not default, 3rd-party SSO must be done with a specified \"target_link_uri\" parameter.

257

# When not defined, 3rd-party SSO must be done with a specified \"target_link_uri\" parameter.

234

258

#OIDCDefaultURL <default-url>

235

259

236

260

# (Optional)

261

# Defines a default URL where the user is sent to after logout, which overridden on logout actions.

262

# When not defined and no URL was passed explicitly, a default internal page will be shown.

263

#OIDCDefaultLoggedOutURL <url>

264

265

# (Optional)

237

266

# Extra parameters that will be sent along with the Authorization Request.

238

267

# These must be URL-query-encoded as in: "display=popup&prompt=consent" or

239

268

# specific for Google's implementation: "approval_prompt=force".

246

275

247

276

# (Optional)

248

277

# The fully qualified names of the files that contain the PEM-formatted X.509 certificates

249

# that contain the RSA public keys to be used for JWT (state/id_token) encryption by the OP.

278

# that contain the RSA public keys to be used for JWT (OP state/id_token) encryption by the OP.

250

279

# These keys must correspond to the private keys defined in OIDCPrivateKeyFiles.

251

280

# When not defined no encryption will be requested.

252

281

#OIDCPublicKeyFiles [<filename>+]

253

282

254

283

# (Optional)

255

# The fully qualified names of the files that contain the pem-formatted RSA private

284

# The fully qualified names of the files that contain the PEM-formatted RSA private

256

285

# keys that can be used to decrypt content sent to us by the OP

257

286

# These keys must correspond to the public keys defined in OIDCPublicKeyFiles.

258

287

# When not defined no decryption will be possible.

259

288

#OIDCPrivateKeyFiles [<filename>+]

260

289

261

290

# (Optional)

262

# Define the Client JWKS URL (e.g. https://localhost/protected/?jwks=rsa)")

263

# that will be used during client registration to point to the public keys for this client.

291

# Define the Client JWKs URL (e.g. https://localhost/protected/?jwks=rsa)") that will be

292

# used during client registration to point to the JWK set with public keys for this client.

293

# If not defined the default <redirect_uri>?jwks=rsa will be used, on which a JWK set

294

# is automatically published based on the OIDCPublicKeyFiles setting so normally you don't

295

# need to touch this unless this client is on a (test) host that is not reachable from the internet.

264

296

#OIDCClientJwksUri <url>

265

297

266

298

# (Optional)

Older »