oidc_idp.conf

# ---------------------------------------------------------------------------- #
#                                                                              #
#                     IDP Configuration for OpenID Connect                     #
#                            (within http block)   |                           #
#                                                  |                           #
#              http {                              |                           #
#                    :                             |                           #
#                  +--------------------------+    |                           #
#                  | include "oidc_idp.conf"; | <--+                           #
#                  +--------------------------+                                #
#                    :                                                         #
#                  server {                                                    #
#                      :                                                       #
#                  }                                                           #
#                    :                                                         #
#              }                                                               #
#                                                                              #
# - This file is to configure IDP related info to handle OIDC workflow.        #
# - Each map block allows multi values so that multiple IdPs can be supported. #
#                                                                              #
# ---------------------------------------------------------------------------- #

# ---------------------------------------------------------------------------- #
#   1. OpenID Provider(IDP) Metadata Configuration via Well-Known Endpoints    #
# ---------------------------------------------------------------------------- #

map $x_client_id $idp_region {
    default "{{Edit-IdP-Region}}"; # "us-east-2"
}

map $x_client_id $idp_domain {
    default "{{Edit-IdP-Domain}}";
}

map $x_client_id $idp_user_pool_id {
    default "{{Edit-User-Pool-ID}}";
}

map $x_client_id $oidc_authz_endpoint {
    default https://$idp_domain/oauth2/authorize;
}

map $x_client_id $oidc_jwt_keyfile {
    default https://cognito-idp.$idp_region.amazonaws.com/$idp_user_pool_id/.well-known/jwks.json;
}

map $x_client_id $oidc_logout_endpoint {
    default https://$idp_domain/logout;
}

map $x_client_id $oidc_token_endpoint {
    default https://$idp_domain/oauth2/token;
}

map $x_client_id $oidc_userinfo_endpoint {
    default https://$idp_domain/oauth2/userInfo;
}

map $x_client_id $oidc_scopes {
    default "openid+profile+email";
}


# ---------------------------------------------------------------------------- #
#   2. Custom Configuration for Well-Known OIDC Endpoints                      #
# ---------------------------------------------------------------------------- #

map $x_client_id $oidc_authz_path_params_enable {
    default 0;
}

map $x_client_id $oidc_authz_path_params {
    default "";
}

map $x_client_id $oidc_authz_query_params_enable {
    default 0;
}

map $x_client_id $oidc_authz_query_params {
    default "";
}

map $x_client_id $oidc_logout_path_params_enable {
    default 0;
}

map $x_client_id $oidc_logout_path_params {
    default "";
}

map $x_client_id $oidc_logout_query_params_enable {
    default 1; # 0: OIDC RP-initiated logout, 1: custom logout
}

map $x_client_id $oidc_logout_query_params {
    # custom logout example w/ AWS Cognito
    # prerequisites: set the following URL in your app.
    #   `Allowed sign-out URLs: https://nginx.cognito.test:443/_logout`

    # example 1. AWS Cognito Logout & redirect back to client.
    default '{
        "client_id"  : "$oidc_client",
        "logout_uri" : "$redirect_base/_logout"
    }';

    # example 2. AWS Cognito Logout & prompt an user to sign in as another user.
    # default '{
    #     "response_type": "code",
    #     "client_id"    : "$oidc_client",
    #     "redirect_uri" : "$redirect_base$redir_location",
    #     "state"        : "STATE",
    #     "scope"        : "$oidc_scopes"
    # }';
}

map $x_client_id $oidc_token_path_params_enable {
    default 0;
}

map $x_client_id $oidc_token_path_params {
    default "";
}

map $x_client_id $oidc_token_query_params_enable {
    default 0;
}

map $x_client_id $oidc_token_query_params {
    default "";
}


# ---------------------------------------------------------------------------- #
#   3. Advanced OIDC Configuration                                             #
# ---------------------------------------------------------------------------- #

map $x_client_id $oidc_client {
    # Edit your client ID
    default "{{Edit-your-client-ID}}";
}

map $x_client_id $oidc_pkce_enable {
    default 1;
}

map $x_client_id $oidc_client_secret {
    default "{Edit-your-client-secret-unless-pkce-enabled}";
}

map $x_client_id $oidc_logout_redirect {
    default "/_logout"; # This is called by IdP after successful logout.
}

map $x_client_id $oidc_hmac_key {
    default "ChangeMe"; # This should be unique for every NGINX instance/cluster
}

map $x_client_id $oidc_app_name {
    default "{edit-your-idp-app-name}";
}

# vim: syntax=nginx