Skip to content

Commit c9a3654

Browse files
javiereguiluzjaviereguiluz
committed
Minor tweak
1 parent 3682bdd commit c9a3654

File tree

1 file changed

+58
-58
lines changed

1 file changed

+58
-58
lines changed

‎security/access_token.rst‎

Lines changed: 58 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -717,10 +717,6 @@ it, and retrieves the user information from it. Optionally, the token can be enc
717717

718718
Support for encryption algorithms to decrypt JWEs was introduced in Symfony 7.3.
719719

720-
.. versionadded:: 7.4
721-
722-
Support for multiple OIDC discovery endpoints was introduced in Symfony 7.4.
723-
724720
To enable `OpenID Connect Discovery`_, the ``OidcTokenHandler`` requires the
725721
``symfony/cache`` package to store the OIDC configuration in the cache. If you
726722
haven't installed it yet, run the following command:
@@ -800,11 +796,9 @@ from the OpenID Connect Discovery), and configure the ``discovery`` option:
800796
;
801797
};
802798
803-
Configuring Multiple OIDC Discovery Endpoints
804-
.............................................
805-
806-
The ``OidcTokenHandler`` supports multiple OIDC discovery endpoints. This allows
807-
validating tokens from multiple identity providers:
799+
Following the `OpenID Connect Specification`_, the ``sub`` claim is used by
800+
default as user identifier. To use another claim, specify it on the
801+
configuration:
808802

809803
.. configuration-block::
810804

@@ -817,15 +811,11 @@ validating tokens from multiple identity providers:
817811
access_token:
818812
token_handler:
819813
oidc:
814+
claim: email
820815
algorithms: ['ES256', 'RS256']
816+
keyset: '{"keys":[{"kty":"...","k":"..."}]}'
821817
audience: 'api-example'
822-
issuers: ['https://oidc1.example.com', 'https://oidc2.example.com']
823-
discovery:
824-
base_uri:
825-
- https://idp1.example.com/realms/demo/
826-
- https://idp2.example.com/realms/demo/
827-
cache:
828-
id: cache.app
818+
issuers: ['https://oidc.example.com']
829819
830820
.. code-block:: xml
831821
@@ -843,15 +833,10 @@ validating tokens from multiple identity providers:
843833
<firewall name="main">
844834
<access-token>
845835
<token-handler>
846-
<oidc audience="api-example">
836+
<oidc claim="email" keyset="{'keys':[{'kty':'...','k':'...'}]}" audience="api-example">
847837
<algorithm>ES256</algorithm>
848838
<algorithm>RS256</algorithm>
849-
<issuer>https://oidc1.example.com</issuer>
850-
<issuer>https://oidc2.example.com</issuer>
851-
<discovery cache="cache.app">
852-
<base-uri>https://idp1.example.com/realms/demo/</base-uri>
853-
<base-uri>https://idp2.example.com/realms/demo/</base-uri>
854-
</discovery>
839+
<issuer>https://oidc.example.com</issuer>
855840
</oidc>
856841
</token-handler>
857842
</access-token>
@@ -869,25 +854,38 @@ validating tokens from multiple identity providers:
869854
->accessToken()
870855
->tokenHandler()
871856
->oidc()
857+
->claim('email')
872858
->algorithms(['ES256', 'RS256'])
859+
->keyset('{"keys":[{"kty":"...","k":"..."}]}')
873860
->audience('api-example')
874-
->issuers(['https://oidc1.example.com', 'https://oidc2.example.com'])
875-
->discovery()
876-
->baseUri([
877-
'https://idp1.example.com/realms/demo/',
878-
'https://idp2.example.com/realms/demo/',
879-
])
880-
->cache(['id' => 'cache.app'])
861+
->issuers(['https://oidc.example.com'])
881862
;
882863
};
883864
884-
The token handler fetches the JWK sets from all configured discovery endpoints
885-
and builds a combined JWK set for token validation. This enables your application
886-
to accept and validate tokens from multiple identity providers in a single firewall.
865+
By default, the ``OidcTokenHandler`` creates an ``OidcUser`` with the claims. To
866+
create your own User from the claims, you must
867+
:doc:`create your own UserProvider </security/user_providers>`::
887868

888-
Following the `OpenID Connect Specification`_, the ``sub`` claim is used by
889-
default as user identifier. To use another claim, specify it on the
890-
configuration:
869+
// src/Security/Core/User/OidcUserProvider.php
870+
use Symfony\Component\Security\Core\User\AttributesBasedUserProviderInterface;
871+
872+
class OidcUserProvider implements AttributesBasedUserProviderInterface
873+
{
874+
public function loadUserByIdentifier(string $identifier, array $attributes = []): UserInterface
875+
{
876+
// implement your own logic to load and return the user object
877+
}
878+
}
879+
880+
Configuring Multiple OIDC Discovery Endpoints
881+
.............................................
882+
883+
.. versionadded:: 7.4
884+
885+
Support for multiple OIDC discovery endpoints was introduced in Symfony 7.4.
886+
887+
The ``OidcTokenHandler`` supports multiple OIDC discovery endpoints, allowing it
888+
to validate tokens from different identity providers:
891889

892890
.. configuration-block::
893891

@@ -900,11 +898,15 @@ configuration:
900898
access_token:
901899
token_handler:
902900
oidc:
903-
claim: email
904901
algorithms: ['ES256', 'RS256']
905-
keyset: '{"keys":[{"kty":"...","k":"..."}]}'
906902
audience: 'api-example'
907-
issuers: ['https://oidc.example.com']
903+
issuers: ['https://oidc1.example.com', 'https://oidc2.example.com']
904+
discovery:
905+
base_uri:
906+
- https://idp1.example.com/realms/demo/
907+
- https://idp2.example.com/realms/demo/
908+
cache:
909+
id: cache.app
908910
909911
.. code-block:: xml
910912
@@ -922,10 +924,15 @@ configuration:
922924
<firewall name="main">
923925
<access-token>
924926
<token-handler>
925-
<oidc claim="email" keyset="{'keys':[{'kty':'...','k':'...'}]}" audience="api-example">
927+
<oidc audience="api-example">
926928
<algorithm>ES256</algorithm>
927929
<algorithm>RS256</algorithm>
928-
<issuer>https://oidc.example.com</issuer>
930+
<issuer>https://oidc1.example.com</issuer>
931+
<issuer>https://oidc2.example.com</issuer>
932+
<discovery cache="cache.app">
933+
<base-uri>https://idp1.example.com/realms/demo/</base-uri>
934+
<base-uri>https://idp2.example.com/realms/demo/</base-uri>
935+
</discovery>
929936
</oidc>
930937
</token-handler>
931938
</access-token>
@@ -943,28 +950,21 @@ configuration:
943950
->accessToken()
944951
->tokenHandler()
945952
->oidc()
946-
->claim('email')
947953
->algorithms(['ES256', 'RS256'])
948-
->keyset('{"keys":[{"kty":"...","k":"..."}]}')
949954
->audience('api-example')
950-
->issuers(['https://oidc.example.com'])
955+
->issuers(['https://oidc1.example.com', 'https://oidc2.example.com'])
956+
->discovery()
957+
->baseUri([
958+
'https://idp1.example.com/realms/demo/',
959+
'https://idp2.example.com/realms/demo/',
960+
])
961+
->cache(['id' => 'cache.app'])
951962
;
952963
};
953964
954-
By default, the ``OidcTokenHandler`` creates an ``OidcUser`` with the claims. To
955-
create your own User from the claims, you must
956-
:doc:`create your own UserProvider </security/user_providers>`::
957-
958-
// src/Security/Core/User/OidcUserProvider.php
959-
use Symfony\Component\Security\Core\User\AttributesBasedUserProviderInterface;
960-
961-
class OidcUserProvider implements AttributesBasedUserProviderInterface
962-
{
963-
public function loadUserByIdentifier(string $identifier, array $attributes = []): UserInterface
964-
{
965-
// implement your own logic to load and return the user object
966-
}
967-
}
965+
The token handler fetches the JWK sets from all configured discovery endpoints
966+
and builds a combined JWK set for token validation. This lets your application
967+
accept and validate tokens from multiple identity providers within a single firewall.
968968

969969
Creating a OIDC token from the command line
970970
-------------------------------------------

0 commit comments

Comments
 (0)