By: Nabeel Shami user 11 Oct 2016 at 7 p.m. CDT

4 Responses
Nabeel Shami gravatar
Hi. I have setup Gluu on a Ubuntu VM to act as an Oauth2/OpenID Connect Authorisation Server for one of our applications. I followed through the documentation and am able to successfully get the Authorisation code, Authentication token and User Info from the Gluu server. I have however the following questions and would appreciate if you could respond to these: 1) As per the documentation I have enabled the default User Registration custom script with enable_user set to true. This allows me to register new users from the /identity/register endpoint. As expected when requesting the Authorisation Code, the user is directed to the oxauth/login endpoint to Login. However the login form has no link/button to Register new users. Does this (register new user link/button) need to be activated from some configuration from OxTrust? 2) I am interested in allowing Users to upload their profile pictures from the User Registration page. I have added a new attribute with Type: Photo, and added it under "Configure Registration Form Attributes". I am able to see the field on the User Registration page however it is a plain text field. How do I go about uploading images for Users? 3) The documentation suggests that for the OpenID Connect scope, "OpenID" is mandatory whereas the rest are all optional. In my testing however, I needed to include the "profile" scope in both the authorisation request and the OpenID Connect Client Scopes (from OxTrust). Is this expected behaviour? 4) OxTrust allows me to add the Organisation Logo and Favicon. I am able to upload both, however the Logo does not seem to be used anywhere and the Favicon was replaced only the first time after which uploading a new one has no effect. Do they need to be in specific formats/dimensions? Thanks in advance!

By Aliaksandr Samuseu staff 11 Oct 2016 at 7:23 p.m. CDT

Aliaksandr Samuseu gravatar
Hi, Nabeel. 1) In `login.xhtml` I can see this fragment: ``` <s:fragment rendered="#{external_registration_uri != Null}"> <a id="externalRegistrationButton" href="#{external_registration_uri}"> <input type="button" value="Register new user"/> </a> </s:fragment> ``` So it seems it should detect when this feature enabled and display it. Otherwise you can customize this page to meet your requirements. 2) I'll try to ask on dev channel about that part 3) It's not expected, you should be ok by just requesting `openid` scope. Could you please provide some HTTP captures which backup your words? Please note that list of your scopes depends on attributes you want to retrieve. So if you specify just `openid`, then you can only expect to receive claims that are included into this scope. You can check it on the "OpenID Connect->Scopes" page 4) There may be something not right with this feature, indeed, I'm also having some problem with it at the moment. I'll investigate and get back to you later. Best regards, Alex.

By Nabeel Shami user 12 Oct 2016 at 8:01 p.m. CDT

Nabeel Shami gravatar
Hi, Alex. Thanks for your response! I have looked into your suggestions and here are my findings: 1) I understand that "external_uri_registration_uri" needs to be set to the uri of the registration page. The documentation suggests this may be done by including a User Registration custom script and adding in the prepareForStep method. Based on this I made changes to the basic Sample Authentication script and enabled it. However it does not seem to do anything. I am not able to see anything in the logs at oxauth_script.log. I tried adding print statements at the start of the method, but again no output in the logs. This suggests the method is not invoked at all when opening the login page as part of an auth request. Following is the change I added to the script. ``` def prepareForStep(self, configurationAttributes, requestParameters, step): found = configurationAttributes.containsKey("registration_uri") if found: registrationUri = configurationAttributes.get("registration_uri").getValue2() Contexts.getEventContext().set("external_registration_uri", registrationUri) print "External Registration URI Set to " + Contexts.getEventContext().get("external_registration_uri") if (step == 1): print "Basic. Prepare for Step 1" return True else: return False ``` 3) I checked again and either of openid or profile scopes work on their own. Case in point: I have assigned profile, openid, and clientinfo scopes to my Client under "OpenID Connect->Clients". Making a request with clientinfo alone as the scope fails as expected returning the HTTP 403 response: ``` "{"error":"insufficient_scope","error_description":"The request requires higher privileges than provided by the access token."}" ``` However including either "openid" or "profile" in my code and token requests successfully returns the attributes for all the scopes requested. Kind regards, Nabeel.

By Aliaksandr Samuseu staff 12 Oct 2016 at 8:26 p.m. CDT

Aliaksandr Samuseu gravatar
Thanks for your feedback, Nabeel. I'll try to find some time asap to investigate all issues you reported, and let you know of results.

By Michael Schwartz Account Admin 13 Oct 2016 at 1:16 p.m. CDT

Michael Schwartz gravatar
Here are my quick answers: 1) As alex says, the user authn page can be customized. 2) Storing binary data in ldap is a bad idea. Use URL's or file locations. 3) `openid` scope is required for OpenID Connect protocol, but an application may very well need other claims that are present in other scopes. 4a) organization Logo - if this doesn't work its a bug. I think .jpg / .png / .gif format should be ok 4b) Favicon has a special format... google it. BTW, user registration via oxTrust is not really that fancy. You may want to build your own user registration page (in your portal), and use SCIM 2.0 to add a user to the Gluu Server. This is the preferred mechanism. oxTrust user registration is just a really simple, least common denominator if there is no other choice. BTW, if you think you might be interested to purchase a support contract, just book a meeting at http://gluu.org/booking or let us know when would be a good time to chat.