JS7 JobScheduler

Space shortcuts

Page tree

Versions Compared

Old Version 23

changes.mady.by.user Andreas Püschel

Saved on

compared with

New Version 24

changes.mady.by.user Andreas Püschel

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • The JS7 - Identity Services offer local management of user accounts for authentication and authorization.
  • The OIDC Identity Service integration is available from JOC Cockpit:
    • As a prerequisite JOC Cockpit has to be set up for JS7 - JOC Cockpit HTTPS Connections.
    • OIDC compliant Identity Providers can be used for authentication, for example Microsoft Azure®.
    • JS7 implements a REST client for use with OIDC Identity Providers.  JS7 JS7 does not ship with an OIDC Identity Provider.
  • Display feature availability
    StartingFromRelease2.5.0

    Jira
    serverSOS JIRA
    columnIdsissuekey,summary,issuetype,created,updated,duedate,assignee,reporter,priority,status,resolution
    columnskey,summary,type,created,updated,due,assignee,reporter,priority,status,resolution
    serverId6dc67751-9d67-34cd-985b-194a8cdc9602
    keyJOC-1525

Terminology

The OIDC protocol knows of the following roles involved in authentication:

...

NameValueDescriptionExample
OIDC NameThe name of the OIDC Identity Service.This is the The name of the Identity Service . It is used by JOC Cockpit to show the caption of the assigned login button.Google, Keycloak
OIDC Authentication URLThe URL used by the Client to login to the OIDC Identity Provider.This URL is called by the Client for login and returns the Access Token from the OIDC Identity Provider. It is similarly used when reading settings of the OIDC Identity Provider with the /.well-known/openid-configuration URL and is used as the issuer during token verification.

Keycloak: https://keycloak:8283/auth/realms/JOC

Azure: https://sts.windows.net/<tenant-id>/.well-known/openid-configuration

OIDC Client IDThe Client ID is configured in the OIDC Identity Provider.The Client ID is used for a number of calls to to the OIDC Identity Provider.

joc-cockpit

63853035078-6cm5tv51pp34svj2a6cd9421fjhl1813.apps.googleusercontent.com

OIDC Client Secret

The Client Secret is configured in the OIDC Identity Provider.The Client Secret is used for a number of calls to the OIDC Identity Provider.

iAMNDlDLorpa7pdbGORDe6vylztVhTiq

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

OIDC ImageAn image can be uploaded that is displayed with the login page.

Optionally an image can be uploaded. .


OIDC Truststore PathThe Path to a truststore.

Should the OIDC Identity Provider be configured for HTTPS connections then the indicated truststore A truststore can be indicated and has to include an X.509 certificate specified for the Extended Key Usage of Server Authentication for the Identity Provider.

    • For connections to well known OIDC Identity Providers such as Azure® users should specify the path to the Java cacerts truststore file that ships with the Java JDK used with JOC Cockpit.
    • The truststore can include a self-signed certificate or a CA signed certificate. Typically the Root CA certificate is used as otherwise the complete certificate chain involved in signing the Server Authentication Certificate has to be available with the truststore.
    • If the OIDC Identity Provider is operated for HTTPS connections and this setting is not specified then the JOC Cockpit will use the truststore that is configured with the JETTY_BASE/resources/joc/joc.properties configuration file. This includes use of settings for the truststore password and truststore type.
    • The path to the truststore is can be specified relative to the the JETTY_BASE/resources/joc directory. If the truststore is located in this directory then only then only the file name is specified, typically with a .p12 or .pfx extension. Other relative locations can be specified using, for example, ../../joc-truststore.p12 if the truststore is located in the JETTY_BASE directory.
    • An absolute path can be specified.
Use of Java truststore: /usr/lib/jvm/java-17-openjdk/lib/security/cacerts
OIDC Truststore PasswordTruststore passwordIf the OIDC Identity Provider is configured for HTTPS connections and the indicated truststore is protected by a password then the password has to be specified.Use of Java truststore: changeit
OIDC Truststore TypeTruststore type

If the OIDC Identity Provider is configured for HTTPS connections then the The type of the truststore has to be specified being is either PKCS12 or JKS (deprecated).

Use of Java truststore: PKCS12

...