Pages

Friday, May 27, 2016

ForgeRock OpenAM 13 and Social Login Part 2: Google

How to easily configure Google with OpenAM 13

This is a quick guide to setting up Google as a social authentication module for OpenAM 13. Prerequisites are a working OpenAM13 environments and a google developer account. This will be needed to obtain a client ID and client secret that you will need to use when you configure the authentication module.

Obtaining a Google App ID and App Secret
Go to console.developers.google.com. Login with your google account. On the left frame, under API Manager, click on the Credentials link.



On the APIs Credentials box, click on the ‘Create credentials’ and select 'OAuth client ID’.



Select ‘Web Application’ as the Application type. Give it a name and add the openam service URL under the Authorized Javascript origins. It is also important you add the Authorized redirect URIs for OpenAM. This is http://host:port/openam/oauth2c/OAuthProxy.jsp.



If this is the first application profile you create, you will be prompted to fill in some information related to the consent screen which users will see when they are asked to authenticate using their google account.



Once the profile is complete and you click on save you will receive a pop up with the client ID and secret.



Here you will copy the Client ID as well as the Client Secret. You will need both of these when configuring Google Authentication Module on OpenAM.

Configuring OpenAM 13

Now login to the OpenAM admin console at http://host:port/openam/console
Select the realm you intend on setting up social authentication module on.

Click on Configure Social Authentication:



Click on Configure Google Authentication



Enter the Client ID and Client Secret and click Create to continue. The Redirect URL is automatically populated.



Once created you will get a success message.



Expanding on the Authentication section and clicking on Modules will show a new ‘GoogleSocialAuthentication’. In addition a new chain is also created using this new module named 'GoogleSocialAuthenticationService’.



Click on the module to look at some of the default settings.

Note in particular two settings:




With these two settings, users who successfully authenticate against Google will have a profile dynamically created in your data store. Your Google users will be pre-fixed with identifier “google-“ as shown in the attribute mapper. You can modify that here if you wish to remove or change that.

Testing Google Authentication

Simplest way to validate the Google authentication chain is to update the Authentication settings and make the chain the default Organization Configuration Chain.



Test the authentication by going to http://host:port/openam. This should automatically redirect you to the Google authentication.



Google’s consent screen will appear.



Once you allow and successfully authenticate with Google, you will be redirected back to OpenAM, have your profile dynamically created, and logged into the console where you will see your profile.



Logged in as OpenAM admin user, search under subjects for the new Google created ID, you will see which attributes were shared from Google.



And that competes the setup for the Google Authentication module for use by OpenAM 13. As with any module you don’t need to set it up as the default Authentication chain used by the realm. It can appear as an icon on the login page or you can invoke the authentication chain via REST for complete UI control.



Using REST APIs via postman client



End

Thursday, May 26, 2016

ForgeRock OpenAM13 and Social Login Part:1 FaceBook

How to easily configure FaceBook with OpenAM 13

This is a quick guide to setting up FaceBook as social authentication modules for OpenAM 13. Prerequisites are a working OpenAM 13 environment. The other prerequisite is to have a developer account with Facebook.  These will be needed to obtain a clientID and client Secret that you will need to use when you configure the authentication modules.

Obtaining a Facebook ClientID and Secret
Go to developers.facebook.com. You might need to sign up to get access. Once authenticated click on the My Apps button next to your profile picture.


Next click on ‘Add a New App'


Select Website



You will need to enter an App Name as well as the Site URL. Note that an AppID will be assigned as part of the script that is supplied. This AppID will be shows again in next step, so no need to copy it yet. Click Next and continue. Click on the newly created application from the dashboard.



Here you will copy the App ID as well as the App Secret. You will need both of these when configuring FaceBook Authentication Module on OpenAM.

Configuring OpenAM 13

Now login to the OpenAM admin console at http://host:port/openam/console
Select the realm you intend on setting up social authentication module on.

Click on Configure Social Authentication:



Click on Configure FaceBook Authentication



Enter the FaceBook App ID and App Secret and click Create to continue. The Redirect URL is automatically populated.



Once created you will get a success message.



Expanding on the Authentication section and clicking on Modules will show a new ‘FacebookSocialAuthentication’ module. In addition a new Chain is also created using this new module named FaceBookSocialAuthenticationService.



Click on the module to look at some of the default settings.

Note two particular settings:




With these two settings, users who successfully authenticate against FaceBook will have a profile dynamically created in your data store. Your Facebook users will be pre-fixed with the identifier "facebook-“ as shown in the attribute mapper. You can modify it here if you which to remove or change that.

Testing Facebook Authentication

Simplest way to validate the Facebook authentication chain is to update the Authentication settings and make the chain the default Organization Configuration chain.

Test the authentication by going to http://host:port/openam. This should automatically redirect you to the FaceBook authentication.



Facebook will require you to consent to sharing some profile info



Once you are successfully authenticated at FaceBook you will be redirected back to OpenAM, have your profile dynamically created and logged into the console where you see your profile.



Logged in as the OpenAM admin user, if you search under subjects for the new Facebook created ID, you will see which attributes were shared from FaceBook.



And thats pretty much all it takes to setup the FaceBook authentication module for use by OpenAM. Of course you don’t need to set it up as the default Authentication chain used the the realm. It can simply appear as a icon on the login page. You can also access the authentication chain via REST to completely customize your user authentication look and feel.



Via REST using Postman


End