feat: access token & enhance endpoints (/login, /userinfo, /logout)

[shawnhankim]

Issue Item:

• feat: access token & enhanced endpoints (/login, /userinfo, /logout) #62

Description:

1. access token

• Enhance the NJS Code to capture the access_token sent by the IdP.
• Store the access_token in the k/v store as same as we store id_token and refresh_token

2. new endpoints

• Add /userinfo endpoint:

  • Add a map variable of $oidc_userinfo_endpoint as same as authz and token endpoints here (openid_connect_configuration.conf) .
  • Expose /userinfo endpoint here(openid_connect.server_conf) in a location block of NGINX Plus to interact with IdP's userinfo_endpoint which is defined in the endpoint ofwell-known/openid-configuration.
  • The nginx location block should proxy to the IdP’s userinfo_endpoint by adding access_token as a bearer token.

    Authorization : Bearer <access_token>
    

  • The response coming from IdP should be returned back to the caller as it is.

• Expose /login endpoint:

  • Expose the /login endpoint as a location block here (openid_connect.server_conf)
  • Proxy it to the IdP's authorization_endpoint configured in the map variable of $oidc_authz_endpoint in (openid_connect_configuration.conf).
  • This would outsource the login function to IdP as its configured.

• Enhance /logout endpoint:

  • Add a map variable of $oidc_end_session_endpoint as same as authz and token endpoints here (openid_connect_configuration.conf) .
  • Proxy it to the IdP's end_session_endpoint to finish the session by IdP.
  • Add a custom query params so that customers can add more parameters.

• Enhance /_logout endpoint:

  • Enhance /_logout endpoint which is a callback from IdP as a location block here (openid_connect.server_conf) to handle the following sequences.
    • 1. Redirected by IdP when IdP successfully finished the session.
    • 2. NGINX Plus: Clear session cookies.
    • 3. NGINX Plus: Redirect to either the landing page or the custom logout page by calling

3. add endpoints in configure.sh

• IdP's userinfo endpoint
• IdP's end session endpoint

Compatibility:

• This PR does not block the existing customers as it just adds endpoints and features.

[shawnhankim]

@route443 :

• Thanks for your review in detail for the PR. It was accidentally closed. The new commit has been submitted based on your review. I would appreciate it if you could review it and give me feedback when you get a chance.
• For your convenience, you can test this repo using https://github.com/nginx-openid-connect/nginx-oidc-examples/tree/main/001-oidc-local-test

[shawnhankim]

@route443:

• For you to easily manage this repo to reduce any concerns from the enhancements based on the reviews on the PR, I have divided a big PR into small PRs as the following example.
  • Add access token support #71
  • Add OIDC end session endpoint and custom query params #72
  • Add OIDC landing page for nginx to redirect after successful OIDC login #74
  • Add OIDC userinfo endpoint for User-Agent to obtain claims about the End-User #76

[shawnhankim]

I am closing this PR as it is divided into the following PRs:

• Add access token support #71
• Add OIDC end session endpoint and custom query params #72
• Add OIDC landing page for nginx to redirect after successful OIDC login #74
• Add OIDC userinfo endpoint for User-Agent to obtain claims about the End-User #76