Skip to main content

Identity providers

Built in user management

Without any configuration, Izanami uses his built in user management. You can create and manage users with the ui or with the APIs.

The documentation is available here [User management](./ui#Manage users)

Otoroshi

You can use Otoroshi in front of izanami and delegate authentication to it. Otoroshi use a custom protocol to ensure secured exchange between the targeted application and Otoroshi.

The default config is the following. You have at least to set the sharedKey (eg env variable CLAIM_SHAREDKEY or java system property izanami.filter.otoroshi.sharedKey).

izanami {
filter {
type = "Otoroshi"
otoroshi {
allowedPaths = [${?OTOROSHI_FILTER_EXCLUSION}, ${?OTOROSHI_FILTER_EXCLUSION_1}, ${?OTOROSHI_FILTER_EXCLUSION_2}, ${?OTOROSHI_FILTER_EXCLUSION_3}]
issuer = "Otoroshi"
issuer = ${?OTOROSHI_ISSUER}
sharedKey = "none"
sharedKey = ${?CLAIM_SHAREDKEY}
headerClaim = "Otoroshi-Claim"
headerClaim = ${?FILTER_CLAIM_HEADER_NAME}
headerRequestId = "Otoroshi-Request-Id"
headerRequestId = ${?FILTER_REQUEST_ID_HEADER_NAME}
headerGatewayState = "Otoroshi-State"
headerGatewayState = ${?FILTER_GATEWAY_STATE_HEADER_NAME}
headerGatewayStateResp = "Otoroshi-State-Resp"
headerGatewayStateResp = ${?FILTER_GATEWAY_STATE_RESP_HEADER_NAME}
}
}
}

You can find more information about Otoroshi here

Oauth 2 identity provider

To use an oauth2 identity provider we need to set the oauth2 endpoint, option and a way to get the user information from the oauth2 identity.

Config propertyEnv variableDescription
izanami.oauth2.enabledOAUTH2_ENABLEDEnable this config
izanami.oauth2.authorizeUrlOAUTH2_AUTHORIZE_URLOauth2 authorization url
izanami.oauth2.tokenUrlOAUTH2_TOKEN_URLOauth2 token url
izanami.oauth2.userInfoUrlOAUTH2_USER_INFO_URLOauth2 user info url
izanami.oauth2.introspectionUrlOAUTH2_INTROSPECTION_URLOauth2 introspection url
izanami.oauth2.loginUrlOAUTH2_LOGIN_URLOauth2 login url
izanami.oauth2.logoutUrlOAUTH2_LOGOUT_URLOauth2 logout url
izanami.oauth2.clientIdOAUTH2_CLIENT_IDOauth2 client id
izanami.oauth2.clientSecretOAUTH2_CLIENT_SECRETOauth2 secret if provided
izanami.oauth2.scopeOAUTH2_SCOPEOauth2 scope of the requested user info
izanami.oauth2.readProfileFromTokenOAUTH2_READ_FROM_TOKENShould the user be read from token
izanami.oauth2.useCookieOAUTH2_USE_COOKIEPass desc as query param
izanami.oauth2.useJsonOAUTH2_USE_JSONUse json or form to post data to the server
izanami.oauth2.idFieldOAUTH2_ID_FIELDthe path in the token to access the user id field (required field)
izanami.oauth2.accessTokenFieldOAUTH2_ACCESS_TOKEN_FIELDthe path in the token to access the access token field (required field)
izanami.oauth2.nameFieldOAUTH2_NAME_FIELDthe path in the token to access the user name field (required field)
izanami.oauth2.emailFieldOAUTH2_EMAIL_FIELDthe path in the token to access the user email field (optional field)
izanami.oauth2.adminFieldOAUTH2_ADMIN_FIELDthe path in the token to access the user admin field (a boolean, false if empty)
izanami.oauth2.authorizedPatternFieldOAUTH2_AUTHORIZED_PATTERN_FIELDthe path in the token to access the user authorizedPatternField field
izanami.oauth2.defaultPatternsOAUTH2_DEFAULT_PATTERNthe default patterns if authorizedPatternField is missing
izanami.oauth2.jwtVerifier.enabledOAUTH2_JWT_VERIFIER_ENABLEDEnable jwt verification
izanami.oauth2.jwtVerifier.typeOAUTH2_JWT_VERIFIER_TYPEOne of hs, es, rsa, jwks
izanami.oauth2.jwtVerifier.sizeOAUTH2_JWT_VERIFIER_RSA_SIZESize of rsa 256, 384, 512s
izanami.oauth2.jwtVerifier.sizeOAUTH2_JWT_VERIFIER_HS_SIZESize of hs 256, 384, 512
izanami.oauth2.jwtVerifier.sizeOAUTH2_JWT_VERIFIER_ES_SIZESize of es 256, 384, 512
izanami.oauth2.jwtVerifier.secretOAUTH2_JWT_VERIFIER_HS_SECRETHs secret
izanami.oauth2.jwtVerifier.publicKeyOAUTH2_JWT_VERIFIER_RSA_PUBLIC_KEYRsa public key
izanami.oauth2.jwtVerifier.publicKeyOAUTH2_JWT_VERIFIER_ES_PUBLIC_KEYES public key
izanami.oauth2.jwtVerifier.privateKeyOAUTH2_JWT_VERIFIER_RSA_PRIVATE_KEYRSA private key
izanami.oauth2.jwtVerifier.privateKeyOAUTH2_JWT_VERIFIER_ES_PRIVATE_KEYES private key
izanami.oauth2.jwtVerifier.urlOAUTH2_JWT_VERIFIER_JWKS_URLJWKS url
izanami.oauth2.jwtVerifier.headersOAUTH2_JWT_VERIFIER_JWKS_HEADERSJWKS headers
izanami.oauth2.jwtVerifier.timeoutOAUTH2_JWT_VERIFIER_JWKS_TIMEOUTJWKS timeout call

The jwt modifier should be :

HS Algorithm

jwtVerifier = {
type = "hs"
size = 256
secret = "your secret"
}

ES Algorithm

jwtVerifier = {
type = "es"
size = 256
publicKey = "your key"
privateKey = "an optional private key"
}

RSA Algorithm

jwtVerifier = {
type = "rsa"
size = 256
publicKey = "your key"
privateKey = "an optional private key"
}

JWKS Algorithm

jwtVerifier = {
type = "jwks"
url = "http://localhost:8980/auth/realms/master/protocol/openid-connect/certs"
// Optional headers
headers = {
key = value
}
// An optional timeout for the api call
timeout = 1 second
}

Here is a sample to use key cloak running on http://localhost:8980 :

izanami {
oauth2 {
enabled = true
authorizeUrl = "http://localhost:8980/auth/realms/master/protocol/openid-connect/auth"
tokenUrl = "http://localhost:8980/auth/realms/master/protocol/openid-connect/token"
userInfoUrl = "http://localhost:8980/auth/realms/master/protocol/openid-connect/userinfo"
introspectionUrl = "http://localhost:8980/auth/realms/master/protocol/openid-connect/token/introspect"
loginUrl = "http://localhost:8980/auth/realms/master/protocol/openid-connect/auth"
logoutUrl = "http://localhost:8980/auth/realms/master/protocol/openid-connect/logout"
clientId = "izanami"
clientSecret = "secret"
scope = "openid profile email name izanamiAdmin authorizedPatterns"
jwtVerifier = {
type = "hs"
size = 256
secret = "your secret"
}
readProfileFromToken = true
useCookie = false
useJson = false
idField = "sub"
accessTokenField = "access_token"
nameField = "preferred_username"
emailField = "email"
adminField = "izanamiAdmin"
authorizedPatternField = "authorizedPatterns"
defaultPatterns = "*"
}
}

You can find a keycloak tutorial Here.