Skip to content

Authentication via OIDC

Overview

As of DPF 4.3.0, DPF Batch Client supports authentication via OIDC.

You have to configure the authentication via OIDC on server and client side. If authentication via OIDC is specified on the client side, but not configured for the server, the server ignores the authentication.

Configure the DPF Server

  1. Specify the following key for dpf-jobclient-api:

    • AUTH_TYPE: Mode of client authentication, mandatory, set to oidc

    If only authentication with bearer token is required, you do not have to specify any other environment key.

  2. For the authentication with client id and secret specify for dpf-jobclient-api:

    Hint - AUTH_ISSUER_URL and AUTH_TOKEN_ENDPOINT

    AUTH_ISSUER_URL is sufficient, as long as your IDP supports OpenID Connect Discovery.

    You have to specify both URLs if:

    • Your IDP does not support automatic discovery or the feature is disabled.

    • Your IDP is behind a proxy or otherwise blocks access to the .well-known path.

    You can test it by calling <auth_issuer_url>/.well-known/openid-configuration in a browser. If automatic discovery is supported, the server returns a JSON file containing the OpenID configuration.

Authenticate the DPF Batch Client

You have two ways to specify the authentication for DPF Batch Client:

...with Command Line Parameters

For the authentication with client id and secret you have to specify:

  • --auth-client-id <client-id>: Client id, mandatory

  • --auth-client-secret <client_secret>: Client secret, mandatory

  • --auth-issuer-url <url>: URL of the token issuer, mandatory

  • --auth-token-endpoint <url>: URL of the token endpoint, optional

  • --auth-additional-scopes <scopes>: Additional scopes to use, optional

For the authentication with a bearer token specify:

  • --bearer <token>: JSON Web Token (JWT) for authentication, optional

Example - authentication with client id and client secret

dpfclient -wf example -host localhost:4303 -protocol http -loglevel T -v --auth-client-id <client-id> --auth-client-secret <secret> --auth-issuer-url https://localhost:32769/realms/SEAL/ --insecure

...in the Configuration File

If you use client id and client secret for authentication, you can specify the credentials in the configuration file dpfclient.xml for DPF Batch Client. This way, you do not have to add them via command line parameters for each call.

  1. Open the configuration file dpfclient.xml in an editor. It is located at:

    • Windows: C:\SEAL\applications\tools\bin_winnt5\dpfclient.xml
    • Linux: /opt/seal/tools/bin_linux223/dpfclient.xml

  2. Add the following section at the same level as the ENVIRONMENTS key and adapt the credentials as needed.

    <OIDC_AUTH
    AUTH_ISSUER_URL="https://localhost:32769/realms/SEAL/"
    AUTH_CLIENT_ID="<client-id>"
    AUTH_CLIENT_SECRET="<secret>"
    AUTH_TOKEN_ENDPOINT="<token_endpoint>"
    AUTH_ADDITIONAL_SCOPES="<additional_scopes>"
/>

    Example - dpfclient.xml with client id and client secret

    <?xml version="1.0" encoding="ISO-8859-1"?>
<DPF>
    <config>
        <dpfclient>
            <COMMANDLINE FLAGS="">
                <PROPERTIES>
                </PROPERTIES>
            </COMMANDLINE>
            <ENVIRONMENTS
                DB_HOST="vs2015-mak"
                DB_PORT="7128"
            />
            <REST_LOCAL
                REST_HOST="dpf-jobclient-api"
                REST_PORT="4303"
                REST_PROTOCOL="http"
            />
            <OIDC_AUTH
                AUTH_ISSUER_URL="https://localhost:32769/realms/SEAL/"
                AUTH_CLIENT_ID="dpf-batch-client"
                AUTH_CLIENT_SECRET="3ljAX29BcGbnc8VRzmz1X2F49Du1zQUh"
            />
        </dpfclient>
    </config>
</DPF>
Back to top