The Kong OAuth auth plugin should not be used.
We need to write a lua -auth plugin to support using the Gluu Sever for client registration, authentication and introspection. There are many -auth
examples in the Kong plugins folder, including LDAP, HMAC, basic and more.
On successful client authentication, Kong should introspect the access_token and cache it until it's expired.
NOTE: We do not want to deal with any front channel issues until we complete the OpenID Connect RP plugin. This OAuth2 client is for back-channel only authentication! Scopes have no meaning here!
![image](https://user-images.githubusercontent.com/3717101/34633472-edb70754-f241-11e7-87f5-56c3957a8c33.png)
Currently when you add an OAuth client, you get this:
![image](https://user-images.githubusercontent.com/3717101/34644020-6f1a3fde-f2f4-11e7-8d09-02b77412e773.png)
In the Gluu Gateway, the client should be created directly against the Gluu Server OpenID Provider using Discovery and Dynamic Client Registration. The only grant type should be client_credentials
.
The Register Client form should look like this.
![image](https://user-images.githubusercontent.com/3717101/34645265-75b4a20c-f30e-11e7-85e1-662d92e47596.png)
As this is a "back channel only" client, redirect_uri
is not relevant. If it's required for client registration, use https://localhost
.
Success screen should look like this:
![image](https://user-images.githubusercontent.com/3717101/34644459-b8cacdbc-f2fc-11e7-9bc4-d083d6cd7ca6.png)
View of clients should look like this
![image](https://user-images.githubusercontent.com/3717101/34644385-47bbfdf4-f2fb-11e7-9fc7-cf6f06f0bb5e.png)