oidc_idp.conf

# ---------------------------------------------------------------------------- #
#                                                                              #
#                     IDP Configuration for OpenID Connect                     #
#                            (within http block)   |                           #
#                                                  |                           #
#              http {                              |                           #
#                    :                             |                           #
#                  +--------------------------+    |                           #
#                  | include "oidc_idp.conf"; | <--+                           #
#                  +--------------------------+                                #
#                    :                                                         #
#                  server {                                                    #
#                      :                                                       #
#                  }                                                           #
#                    :                                                         #
#              }                                                               #
#                                                                              #
# - This file is to configure IDP related info to handle OIDC workflow.        #
# - Each map block allows multi values so that multiple IdPs can be supported. #
#                                                                              #
# ---------------------------------------------------------------------------- #

# ---------------------------------------------------------------------------- #
#   1. OpenID Provider(IDP) Metadata Configuration via Well-Known Endpoints    #
# ---------------------------------------------------------------------------- #

map $x_client_id $idp_region {
    default "{{Edit-IdP-Region}}"; # edit for Amazon Cognito (E.g., "us-east-2")
}

map $x_client_id $idp_domain {
    default "auth.pingone.us"; # "{{Edit-IdP-Domain}}";
}

map $x_client_id $idp_user_pool_id {
    default "{{Edit-User-Pool-ID}}"; # edit for Amacon Cognito
}

map $x_client_id $idp_env_id {
    default "{{Edit-IdP-Environment-ID}}"; # edit for Ping Identity
}

map $x_client_id $oidc_authz_endpoint {
    default https://$idp_domain/$idp_env_id/as/authorize;
}

map $x_client_id $oidc_jwt_keyfile {
    default https://$idp_domain/$idp_env_id/as/jwks;
}

map $x_client_id $oidc_logout_endpoint {
    default https://$idp_domain/$idp_env_id/as/signoff;
}

map $x_client_id $oidc_token_endpoint {
    default https://$idp_domain/$idp_env_id/as/token;
}

map $x_client_id $oidc_userinfo_endpoint {
    default https://$idp_domain/$idp_env_id/as/userinfo;
}

map $x_client_id $oidc_scopes {
    default "openid+profile+email";
}


# ---------------------------------------------------------------------------- #
#   2. Custom Configuration for Well-Known OIDC Endpoints                      #
# ---------------------------------------------------------------------------- #

map $x_client_id $oidc_authz_path_params_enable {
    default 0;
}

map $x_client_id $oidc_authz_path_params {
    default "";
}

map $x_client_id $oidc_authz_query_params_enable {
    default 0;
}

map $x_client_id $oidc_authz_query_params {
    default "";
}

map $x_client_id $oidc_logout_path_params_enable {
    default 0;
}

map $x_client_id $oidc_logout_path_params {
    default "";
}

map $x_client_id $oidc_logout_query_params_enable {
    default 0; # 0: OIDC RP-initiated logout, 1: custom logout
}

map $x_client_id $oidc_logout_query_params {
    default "";
}

map $x_client_id $oidc_token_path_params_enable {
    default 0;
}

map $x_client_id $oidc_token_path_params {
    default "";
}

map $x_client_id $oidc_token_query_params_enable {
    default 0;
}

map $x_client_id $oidc_token_query_params {
    default "";
}

map $x_client_id $oidc_token_header_params_enable {
    default 1;
}

map $x_client_id $oidc_token_header_params {
    default '{
        "Accept-Encoding": "gzip"
    }';
}

# ---------------------------------------------------------------------------- #
#   3. Advanced OIDC Configuration                                             #
# ---------------------------------------------------------------------------- #

map $x_client_id $oidc_client {
    default "{{Edit-your-client-ID}}";
}

map $x_client_id $oidc_pkce_enable {
    default 1;
}

map $x_client_id $oidc_client_secret {
    default "{Edit-your-client-secret-unless-pkce-enabled}";
}

map $x_client_id $oidc_logout_redirect {
    default "/_logout"; # This is called by IdP after successful logout.
}

map $x_client_id $oidc_hmac_key {
    default "ChangeMe"; # This should be unique for every NGINX instance/cluster
}

map $x_client_id $oidc_app_name {
    default "{edit-your-idp-app-name}";
}

# vim: syntax=nginx