Replace introspect URL with JWK for OIDC validation (#3614)

* Replace introspect url with JWK Signed-off-by: at670475 <[email protected]> * fix name Signed-off-by: at670475 <[email protected]> * temporary change to test Signed-off-by: at670475 <[email protected]> * fix Signed-off-by: at670475 <[email protected]> * fix Signed-off-by: at670475 <[email protected]> * revert back the manifest.json Signed-off-by: at670475 <[email protected]> --------- Signed-off-by: at670475 <[email protected]> Co-authored-by: Mark Ackert <[email protected]>
zowe · Oct 20, 2023 · 5bb6282 · 5bb6282
1 parent 6afc567
commit 5bb6282
Show file tree

Hide file tree

Showing 6 changed files with 8 additions and 8 deletions.
diff --git a/playbooks/roles/configfmid/defaults/main.yml b/playbooks/roles/configfmid/defaults/main.yml
@@ -70,7 +70,7 @@ zowe_apiml_security_oidc_enabled: false
 zowe_apiml_security_oidc_client_id:
 zowe_apiml_security_oidc_client_secret:
 zowe_apiml_security_oidc_registry:
-zowe_apiml_security_oidc_introspect_url:
+zowe_apiml_security_oidc_jwks_uri:
 # explorer APIs/plugins ports
 zowe_jobs_api_port: 7558
 zowe_mvs_api_port: 7559

diff --git a/playbooks/roles/configfmid/tasks/main.yml b/playbooks/roles/configfmid/tasks/main.yml
@@ -39,7 +39,7 @@
     - zowe_apiml_security_oidc_client_id
     - zowe_apiml_security_oidc_client_secret
     - zowe_apiml_security_oidc_registry
-    - zowe_apiml_security_oidc_introspect_url
+    - zowe_apiml_security_oidc_jwks_uri
     - zowe_jobs_api_port
     - zowe_mvs_api_port
     - zowe_jobs_explorer_port
@@ -299,7 +299,7 @@
       "components.gateway.apiml.security.oidc.clientId": "{{ zowe_apiml_security_oidc_client_id|string }}"
       "components.gateway.apiml.security.oidc.clientSecret": "{{ zowe_apiml_security_oidc_client_secret|string }}"
       "components.gateway.apiml.security.oidc.registry": "{{ zowe_apiml_security_oidc_registry|string }}"
-      "components.gateway.apiml.security.oidc.introspectUrl": "{{ zowe_apiml_security_oidc_introspect_url|string }}"
+      "components.gateway.apiml.security.oidc.jwks.uri": "{{ zowe_apiml_security_oidc_jwks_uri|string }}"
       # desktop customizations
       "zowe.environments.ZWED_SSH_PORT": "{{ zowe_zlux_terminal_ssh_port }}"
       "zowe.environments.ZWED_TN3270_PORT": "{{ zowe_zlux_terminal_telnet_port }}"

diff --git a/playbooks/roles/configure/defaults/main.yml b/playbooks/roles/configure/defaults/main.yml
@@ -71,7 +71,7 @@ zowe_apiml_security_oidc_enabled: false
 zowe_apiml_security_oidc_client_id:
 zowe_apiml_security_oidc_client_secret:
 zowe_apiml_security_oidc_registry:
-zowe_apiml_security_oidc_introspect_url:
+zowe_apiml_security_oidc_jwks_uri:
 # explorer APIs/plugins ports
 zowe_jobs_api_port: 7558
 zowe_mvs_api_port: 7559

diff --git a/playbooks/roles/configure/tasks/main.yml b/playbooks/roles/configure/tasks/main.yml
@@ -39,7 +39,7 @@
     - zowe_apiml_security_oidc_client_id
     - zowe_apiml_security_oidc_client_secret
     - zowe_apiml_security_oidc_registry
-    - zowe_apiml_security_oidc_introspect_url
+    - zowe_apiml_security_oidc_jwks_uri
     - zowe_jobs_api_port
     - zowe_mvs_api_port
     - zowe_jobs_explorer_port
@@ -301,7 +301,7 @@
       "components.gateway.apiml.security.oidc.clientId": "{{ zowe_apiml_security_oidc_client_id|string }}"
       "components.gateway.apiml.security.oidc.clientSecret": "{{ zowe_apiml_security_oidc_client_secret|string }}"
       "components.gateway.apiml.security.oidc.registry": "{{ zowe_apiml_security_oidc_registry|string }}"
-      "components.gateway.apiml.security.oidc.introspectUrl": "{{ zowe_apiml_security_oidc_introspect_url|string }}"
+      "components.gateway.apiml.security.oidc.jwks.uri": "{{ zowe_apiml_security_oidc_jwks_uri|string }}"
       # desktop customizations
       "zowe.environments.ZWED_SSH_PORT": "{{ zowe_zlux_terminal_ssh_port }}"
       "zowe.environments.ZWED_TN3270_PORT": "{{ zowe_zlux_terminal_telnet_port }}"

diff --git a/playbooks/roles/custom_for_test/defaults/main.yml b/playbooks/roles/custom_for_test/defaults/main.yml
@@ -68,7 +68,7 @@ zowe_apiml_security_oidc_enabled: false
 zowe_apiml_security_oidc_client_id:
 zowe_apiml_security_oidc_client_secret:
 zowe_apiml_security_oidc_registry:
-zowe_apiml_security_oidc_introspect_url:
+zowe_apiml_security_oidc_jwks_uri:
 zowe_apiml_security_zosmf_applid: IZUDFLT
 zowe_apiml_security_auth_provider: zosmf
 zowe_apiml_security_zosmf_jwt_autoconfiguration_mode: auto

diff --git a/tests/installation/src/constants.ts b/tests/installation/src/constants.ts
@@ -43,7 +43,7 @@ export const APIML_OIDC_VARS =  {
   'zowe_apiml_security_oidc_client_id': process.env['OKTA_CLIENT_ID'] || 'dummy_id_from_constants_ts',
   'zowe_apiml_security_oidc_client_secret': process.env['OKTA_CLIENT_SECRET'] || 'dummy_secret_from_constants_ts',
   'zowe_apiml_security_oidc_registry': process.env['OIDC_REGISTRY'] || 'dummy_registry_from_constants_ts',
-  'zowe_apiml_security_oidc_introspect_url': `https://${process.env['OKTA_HOSTNAME']}/oauth2/default/v1/introspect`,
+  'zowe_apiml_security_oidc_jwks_uri': `https://${process.env['OKTA_HOSTNAME']}/oauth2/default/v1/keys`,
 };
 
 // debug(`process.env >>>>>>>>>>>>>>>>>>>>>>>>>>\n${JSON.stringify(process.env)}\n<<<<<<<<<<<<<<<<<<<<<<<`);