openid-connectopenidwebsphere-liberty

Beta: WebSphere Liberty and tools (September 2016)

September Beta of Liberty introduced a very nifty use case to allow signed JSON Web Token for authentication. This is how I configured openidConnectClient element in server.xml

<openidConnectClient id="authRP"
  clientId="authrp"
  inboundPropagation="required"
  issuerIdentifier="https://localhost:9600/oidc/endpoint/OP"
  signatureAlgorithm="RS256"
  trustAliasName="signingcert"
  trustStoreRef="defaultTrustStore"
  >

And yet, a GET call without JWT in the request parameter isn't blocked from invoking my application servlet. What am I missing in the configuration? Thanks for all the help.

Solution

  • The application servlet itself must be J2EE security role protected, i.e., it must have authorization constraint in web.xml.