{"action":"created","issue":{"url":"https://api.github.com/repos/cloudfoundry/uaa-release/issues/73","repository_url":"https://api.github.com/repos/cloudfoundry/uaa-release","labels_url":"https://api.github.com/repos/cloudfoundry/uaa-release/issues/73/labels{/name}","comments_url":"https://api.github.com/repos/cloudfoundry/uaa-release/issues/73/comments","events_url":"https://api.github.com/repos/cloudfoundry/uaa-release/issues/73/events","html_url":"https://github.com/cloudfoundry/uaa-release/issues/73","id":269099789,"number":73,"title":"Configuration of UAA as OIDC provider and external SAML authentication","user":{"login":"philippthun","id":618301,"avatar_url":"https://avatars3.githubusercontent.com/u/618301?v=4","gravatar_id":"","url":"https://api.github.com/users/philippthun","html_url":"https://github.com/philippthun","followers_url":"https://api.github.com/users/philippthun/followers","following_url":"https://api.github.com/users/philippthun/following{/other_user}","gists_url":"https://api.github.com/users/philippthun/gists{/gist_id}","starred_url":"https://api.github.com/users/philippthun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philippthun/subscriptions","organizations_url":"https://api.github.com/users/philippthun/orgs","repos_url":"https://api.github.com/users/philippthun/repos","events_url":"https://api.github.com/users/philippthun/events{/privacy}","received_events_url":"https://api.github.com/users/philippthun/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-10-27T13:03:24Z","updated_at":"2017-10-27T13:03:25Z","closed_at":null,"author_association":"NONE","body":"Hi,\r\n\r\nWhen using the default configuration of `uaa-release` with regards to `uaa.issuer` and `login.saml.entity_base_url` (as is done both in `cf-release` and `cf-deployment`), you end up with:\r\n- `uaa.issuer = https://uaa.<system-domain>`\r\n- `login.saml.entity_base_url = login.<system-domain>`\r\n\r\nWe are using UAA as OIDC provider. The OIDC client requests additional information from the token endpoint by appending `/.well-known/openid-configuration` to the URL. In theory one could either use `https://login.<system-domain>/oauth/token` or `https://uaa.<system-domain>/oauth/token` as token endpoint. But as the `openid-configuration` that is returned also contains a field `issuer` and the value of this field is derived from the `uaa.issuer` property (`https://uaa.<system-domain>/oauth/token`) one has to use `https://uaa.<system-domain>/oauth/token` as token endpoint. Otherwise (using `https://login.<system-domain>/oauth/token` as endpoint and getting `\"issuer\":\"https://uaa.<system-domain>/oauth/token\" returned`) OIDC clients have to regard the `openid-configuration` as invalid - URL and `issuer` must match according to the specification.\r\n\r\nSo we used `https://uaa.<system-domain>/oauth/token` as token endpoint - this works fine as long as we do not also use external SAML authentication. When SAML is enabled, the user can click on the appropriate link and then gets redirected to `https://login.<system-domain>...` (derived from the `login.saml.entity_base_url` property) - this breaks the user's session (different host, i.e. a new session cookie is issued). Although the SAML authentication works fine, the user ends up on `https://login.<system-domain>` as the final redirect back to the application was part of the initial session.\r\n\r\nSo we changed `uaa.issuer` to `https://login.<system-domain>` (and used `https://login.<system-domain>/oauth/token` as token endpoint in the OIDC client). Then everything works fine...\r\n\r\nSo our questions now are:\r\n- Is it okay to change `uaa.issuer` to `https://login.<system-domain>` or could there be any side-effects?\r\n- Is the *mismatch* of the default values for `uaa.issuer` and `login.saml.entity_base_url` intended? Should this be documented somewhere (at least that the combination of UAA as OIDC provider and external SAML authentication does not work with these values)?\r\n\r\nThanks,\r\nPhilipp\r\n"},"comment":{"url":"https://api.github.com/repos/cloudfoundry/uaa-release/issues/comments/339965336","html_url":"https://github.com/cloudfoundry/uaa-release/issues/73#issuecomment-339965336","issue_url":"https://api.github.com/repos/cloudfoundry/uaa-release/issues/73","id":339965336,"user":{"login":"cf-gitbot","id":5589368,"avatar_url":"https://avatars3.githubusercontent.com/u/5589368?v=4","gravatar_id":"","url":"https://api.github.com/users/cf-gitbot","html_url":"https://github.com/cf-gitbot","followers_url":"https://api.github.com/users/cf-gitbot/followers","following_url":"https://api.github.com/users/cf-gitbot/following{/other_user}","gists_url":"https://api.github.com/users/cf-gitbot/gists{/gist_id}","starred_url":"https://api.github.com/users/cf-gitbot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cf-gitbot/subscriptions","organizations_url":"https://api.github.com/users/cf-gitbot/orgs","repos_url":"https://api.github.com/users/cf-gitbot/repos","events_url":"https://api.github.com/users/cf-gitbot/events{/privacy}","received_events_url":"https://api.github.com/users/cf-gitbot/received_events","type":"User","site_admin":false},"created_at":"2017-10-27T13:03:25Z","updated_at":"2017-10-27T13:03:25Z","author_association":"COLLABORATOR","body":"We have created an issue in Pivotal Tracker to manage this: \n\nhttps://www.pivotaltracker.com/story/show/152349005 \n\nThe labels on this github issue will be updated when the story is started."}}
{"actor":{"display_login":"cf-gitbot"}}