Introduction

...

Services for supporting UserInfo requests and returning IdToken signature verification keys are also shipped. 

...

OIDC Flow Services

Authorization Code Flow

OidcAuthorizationCodeService is a simple AuthorizationCodeGrantService extension which enforces OIDC specific constraints. It can be registered like this. 

This service issues a code grant, while AccessTokenService returns Access and Id tokens. 

IdTokenResponseFilter (used by AccessTokenService) is where IdToken is actually added to the client response. For example, see this line.

Implicit Flow

OidcImplicitService is a simple ImplicitGrantService extension which enforces OIDC specific constraints and adds IdToken to the client response. For example, see this line (Note in this case Implicit Flow is supported due to OidcHybridService extending OidcImplicitService but OidcImplicitService can be registered directly)In order to return an id_token, the OidcImplicitService should be configured as follows:

1. If the response_type is "id_token token", then the IdTokenResponseFilter should be configured on the OidcImplicitService. The IdTokenResponseFilter in turn needs to know how to create an IdToken, so it must be configured with a IdTokenProvider implementation.
2. If the response_type is "id_token", then a IdTokenProvider implementation should be configured directly on the OidcImplicitService.

Hybrid Flow

OidcHybridService supports Hybrid Flow by delegating to both OidcImplicitService and OidcAuthorizationCodeService. For example, see this line.

UserInfo Endpoint

UserInfoService returns UserInfo. It checks UserInfoProvider first, next - OidcUserSubject, and finally it defaults to converting the existing IdToken to UserInfo.

Note UserInfoService is accessed by a client which uses the access token issued to it during the user authentication process. Therefore this line enforces it - it will fail if the access token has not been successfully validated. For example, see this line.

JWK Keys Service

OidcKeysService returns a JWK key set containing a public verification JWK key. By default only a public key is returned but the service can also be configured for JWK key to include the corresponding  X509 certificate chain too.  Use this service if IdToken is signed by a private RSA or EC key for the client be able to fetch the verification keys without having to import them into local key stores. For example, see this lineThe OidcKeysService can also return a public key stored in a JWK keys file, by specifying the id of the key via "rs.security.keystore.alias" and specifying the type of the keystore ("rs.security.keystore.type") as "jwk".

OidcDynamicRegistrationService

This service is available starting from CXF 3.1.8. It supports the dynamic client registration and management with OIDC specific properties being handled too. At the moment some of the advanced registration properties are not yet processed and linked to the way the core OIDC services operate but the service will be enhanced as needed going forward.

OidcConfigurationService

This service is available starting from CXF 3.1.8. It supports OIDC server configuration queries at ".well-known/openid-configuration".

Fediz OIDC

...

IDP

Fediz OIDC project provides a reference integration between CXF OIDC IDP code and Fediz Authentication System. It has OIDC Core supported with a minimum amount of code and configuration.

It creates IdToken in a custom SubjectCreator as described above. Currently it depends on CXF Ehcache OAuthDataProvider OOB so no custom persistence code is needed. Besides that it provides a support for managing the client registrations. It registers OIDC services as JAX-RS endpoints.

...

BasicOidc demo service is not an OAuth2 client, but a basic JAX-RS server. This server works with an HTTP Browser client which uses Google script libraries to get IdToken from Google OIDC Authorization endpoint (OIDC Implicit flow). This browser client interacts with CXF OIDC RP code to get IdToken validated and then posts this token to the demo service. Demo service depends on CXF OIDC RP to have this IdToken easily accessible in its code