Git Product home page Git Product logo

ref-idp-server's Introduction

Disclaimer

This software is not developed for productive use. It was developed to check the feasibility of the specification.

Overview

The IDP-Global project consists of various sub-projects. These are

  • IDP-Server: Reference development of the central IDP

  • IDP-Client: Client to request ACCESS_TOKEN with SMC-B-Aut or HBA-Aut keys at the central IDP

  • IDP-Testsuite: Approval test suite for a central IDP, also includes tests for Fast Track and federated IDPs


  • IDP-Sektoral: PoC for a sectoral IDP in the Fast Track context

The last sub-project "IDP-Sektoral" in the list above is not part of the reference implementation published on github.

Idp-Server as docker image

Use existing image from docker hub

https://hub.docker.com/repository/docker/gematik1/idp-server

Build image of Idp-Server, 2 examples

in project root:

Example 1: build with all tests
$ mvn clean install -pl idp-server -am
Example 2: build without unit/int tests, set parameter commit_hash for dockerfile
$ mvn clean install -pl idp-server -am -Dskip.unittests -Dskip.inttests -Dcommit_hash=`git log --pretty=format:'%H' -n 1`

Start container

$ docker run --rm -it -p 8571:8080 gematik1/idp-server

or use docker compose:

$ mvn clean install -pl idp-server -am -Dskip.unittests -Dskip.inttests
$ export appVersion=27.0.3
$ export serverLoglevel=info (default)
$ docker-compose --project-name myidp -f docker-compose-ref.yml up -d

Smoke test: get discovery document

$ curl http://localhost:8571/auth/realms/idp/.well-known/openid-configuration

Scope Configuration via application.yaml

You can modify the scopes that are supported by the IDP Server. All you have to is add, remove or modify entries in the scopesConfiguration section of the idp-server's application.yml.

Configuration of Server URL

The URL of the idp-server is required for many fields inside the discovery document of the server. For example, the authorization endpoint:

{
"authorization_endpoint": "https://server42/sign_response",
...

The idp-server determines the URL in the following priority order if it exists:

  1. jvm arg: --idp.serverUrl=https://myServerUrlAsJvmArgument.de
  2. environment variable: IDP_SERVER_URL=myServerUrlFromEnv:8080
  3. spring boot configuration (application.yml):
idp:
   serverUrl: "https://urlPreConfiguredUrl"

During development, it is recommended to set "severUrl" not in application.yml as some unit tests will fail then. Background: serverUrl will be set several times in the discovery document and used from there in unit tests. In unit tests, random (free) ports are used, and with that they are part of the serverUrl.

  1. precompiled value: IdpConstants.DEFAULT_SERVER_URL

Unittests

disable: -Dskip.unittests

The key ref-es-sig can be published and was therefore added for unit tests (KeyUtilityTest).

Integration Testing/Approval Testing

disable: -Dskip.inttests

Tests of the Idp-Testsuite are integration tests as well.
Based on integration tests, approval tests are poosible. Please refer to README im submodule idp-testsuite.

Caveats

Call all build targets always from project root ("idp-global").

Tokenflow sites

Swagger

find generated API at: /swagger-ui/index.html

ref-idp-server's People

Contributors

dotwee avatar gematik-entwicklung avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

ref-idp-server's Issues

Arm64 build support

Hello,

Would it be possible to add support for arm64 builds? Currently the docker images are only available as amd64, which decreases the performance on Apple Silicon computers.

Thank you.

Issue with building Dockerimage

[ERROR] Failed to execute goal io.fabric8:docker-maven-plugin:0.34.1:build (default) on project idp-server: Configured Dockerfile "/Users/chris/Entwicklung/DEOS/E-Rezept/ref-idp-server/idp-server/target/tmpdocker/Dockerfile" (resolved to "/Users/chris/Entwicklung/DEOS/E-Rezept/ref-idp-server/idp-server/target/tmpdocker/Dockerfile") doesn't exist -> [Help 1]

macOS 11.6
openjdk 11.0.2
Apache Maven 3.8.2
Docker version 20.10.8, build 3967b7d

Any hints?

Ability to add a custom clientId for authentication against the Authenticator application

I'm aware of the ability to add the necessary ti-messenger related scopes to the idp-server's application.yml, yet I can't find any documentation/details on how to add a clientId to the idp-server to authenticate for.

Digging through the source code and debugging the incoming requests (like following the clientId lookup) did not help (but maybe I missed something?).

Is there a way to add a custom clientId for local development?

(Maybe @RStaeber can point me in the right direction)

General Questions

Hello,
we are going to use the central IDP to authenticate doctors based on their HBA and SMCB cards.
As a preliminary work, we look at the reference implementation of the IDP and have a few questions and comments about it:

  1. Can you please provide the .puml files as pictures?
  2. Is there a communication with the Authenticator App or is this omitted?
    From the workflow-base.puml it looks like that the IDP is called from the Authenticator app and not directly from our application. Or is the phrase Authenticator in the diagram misleading.
    If not, how can we start the process via the Authenticator?
  3. What is the reason behind the regex for the state query parameter?
    E.g. Keycloak passes CAJ6m-Dqt01-WTPyBIY0JwIW_DlxOaAhRof9wuH-UPs.zB7aqDc2-2U.account-console which doesn't match the regex.
  4. In your documentation Java 11 is mentioned, but Java 17 is mandatory since v21.0.0

Best regards

Scope "gem-auth" is missing

Hi,

please add all supported scopes of the reference environment:

"scopes_supported": [
    "openid",
    "e-rezept",
    "e-rezept-dev",
    "fh-fokus-demis",
    "fhir-vzd",
    "gem-auth",
    "pairing",
    "rpdoc-emma",
    "zvr-bnotk"
  ]

Thank you

Curve not supported: org.bouncycastle.jce.spec.ECNamedCurveSpec

Hi,

I started the IDP-Server and called http://localhost:8080/.well-known/openid-configuration
This returned
{"error":"server_error","gematik_code":"-1","gematik_timestamp":1659604593,"gematik_uuid":"8780af68-47fd-4ea2-8392-fd1e2ad671dc","gematik_error_text":"Ein Fehler ist aufgetreten"}
I started debugging and found out, that Curves are not supported by jose4j.

org.jose4j.lang.JoseException: Problem creating signature.
java.security.SignatureException: Curve not supported: org.bouncycastle.jce.spec.ECNamedCurveSpec@36aff3cd
0 = {StackTraceElement@17217} "org.jose4j.jws.BaseSignatureAlgorithm.sign(BaseSignatureAlgorithm.java:89)"
1 = {StackTraceElement@17218} "org.jose4j.jws.EcdsaUsingShaAlgorithm.sign(EcdsaUsingShaAlgorithm.java:67)"
2 = {StackTraceElement@17219} "org.jose4j.jws.JsonWebSignature.sign(JsonWebSignature.java:217)"
3 = {StackTraceElement@17220} "org.jose4j.jws.JsonWebSignature.getCompactSerialization(JsonWebSignature.java:144)"
4 = {StackTraceElement@17221} "de.gematik.idp.authentication.IdpJwtProcessor.buildJws(IdpJwtProcessor.java:97)"

Did I missed some configuration or how should it work?

Provide a running local docker-compose setup

According to the .gitignore, it looks like there is already a running docker-compose setup given in your internal environment.

It would be great if there is a way to share this setup and allow a simple and easy local development and testing environment for everyone.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.