How to set up OpenID Connect Provider configuration in Score

The configuration of the Identity Provider (IdP) should be inserted into oauth2_app table and oauth2_app_scope table in the database including the following properties.

1. Provider Name (oauth2_app.provider_name column) – Score’s internal name of the provider. It must be unique.
2. IdP Endpoint(s): a. Issuer Endpoint (oauth2_app.issuer_uri column) – an OpenID Connect Provider may provide ‘/.well-known/openid-configuration’ endpoint that returns meta-data of provider’s information. This issuer endpoint is a base endpoint of the provider that supports the Well-Known URI Discovery mechanism. b. Authorization Endpoint, Token Endpoint, User Info Endpoint, and JSON Web Key Set Endpoint (oauth2_app.authorization_uri, oauth2_app.token_uri, oauth2_app.user_info_uri, and oauth2_app.jwk_set_uri columns, respectively) – These information can be used in case that the provider does not support the Well-Known URI Discovery mechanism.
3. Redirection URI (oauth2_app.redirect_uri column) – The external IdP should know the redirection URI to send the result of the client sign-in request by OAuth 2.0 flows. This has the following form: ‘{scheme}://{hostname}/api/oauth2/code/{provider_name}’. (‘scheme’: ‘http’ or ‘https’. It may have a specific port number., ‘hostname’: the hostname of Score, ‘provider_name’: defined in provider_name column.) This value may need to be registered in your IdP configuration. See your IdP documentation for details.
4. Client ID and Client Secret (oauth2_app.client_id and oauth2_app.client_secret columns) – These are the values issued by IdP for the registered application. See your IdP documentation for details.
5. Client Authentication Method and Authorization Grant Type (oauth2_app.client_authentication_method and oauth2_app.authorization_grant_type columns) – Possible values for client_authentication_method are ‘basic’ or ‘post’, and for ‘authroization_grant_type’ are ‘authorization_code’, ‘client_credentials’, ‘password’, etc. See your IdP documentation for details.)
6. (Optional) Prompt Parameter (oauth2_app.prompt column) – Some IdP supports the prompt parameter to provide display options during sign-in process. Typical values for the prompt are ‘none’, ‘login’, ‘consent’. See your IdP documentation for details.
7. Display provider name, Font color, Background color, and display order (oauth2_app.display_provider_name, oauth2_app.font_color, oauth2_app.background_color, and oauth2_app.display_order columns, respectively) – These are customizable options for the UI button in Score sign-in page.
8. Disable Indicator (oauth2_app.is_disabled column) – If this column sets to 1 (true), the UI button for this provider will not be exposed. Default is 0 (false).
9. Scope(s) (oauth2_app_scope.scope column) – OpenID Connect supports several scopes such as ‘openid’, ‘profile’, ‘email’, and ‘phone’. These scopes for the application should insert into oauth2_app_scope table.

Note that all fields are mandatory except Prompt Parameter. Regarding of IdP Endpoint(s), either a) or b) should be configured. Whenever the property is changed in DB, the application, especially http-gateway, must restart to load changed information. The following is an example query to insert these properties.

INSERT INTO `oauth2_app`
(`provider_name`,
 `issuer_uri`,
 `redirect_uri`,
 `client_id`,
 `client_secret`,
 `client_authentication_method`,
 `authorization_grant_type`,
 `display_provider_name`, `background_color`, `font_color`)
VALUES
('google',
 'https://accounts.google.com',
 'https://example.score.com/api/oauth2/code/google',
 '506273723586-umjg2hc17g0ggtpju4cd6q3bak19f2tk.apps.googleusercontent.com',
 'kDLG5anRHSqc0lz3ZXTSFCqn',
 'post',
 'authorization_code',
 'Google', '#df4930', '#ffffff');
INSERT INTO `oauth2_app_scope` (`oauth2_app_id`, `scope`)
VALUES
((SELECT `oauth2_app_id` FROM `oauth2_app` WHERE `provider_name` = 'google'), 'openid'),
((SELECT `oauth2_app_id` FROM `oauth2_app` WHERE `provider_name` = 'google'), 'profile'),
((SELECT `oauth2_app_id` FROM `oauth2_app` WHERE `provider_name` = 'google'), 'email');