Signature creation during OpenID Connect authentication

[flukic]

Hi all,

we are currently in the process of setting up our CDC as OP in the OIDC federated scenario.
We are implementing each of the pages and have come to a point of signature creation during the consent endpoint step.
How exactly should the serverside logic for signature creation look like?

Our serverside is in Java. After going in detail through the OpenID Provider Setup documentation and serverside SDKs documentation - we would like to utilize the calcSigature() method of SigUtils class.
However, it seems that this method is not present only in Java SDK.

Is this an issue with the documentation or we can use some other method (maybe getOAuth1Signature())?

Any help or information on this is highly welcomed!

Thanks in advance,
Filip

[romaingorrias · Accepted solution]

Hi Filip,

This seems to be an issue with the doc as the calcSignature() method is present in the SDK. Remember to pass the userKey/applicationKey as a parameter to your consent endpoint (https://developers.gigya.com/display/GD/OpenID+Provider+Setup#OpenIDProviderSetup-UserAndApplication...) and use the corresponding user/application secret in the calcSignature method rather than the partner secret.

Hope this helps.

Romain.

[romaingorrias · Accepted solution]

note I have raised this with our technical writers, hoping for an updated reference in the near future.

[flukic · Accepted solution]

Hi Romain, thanks for the answer!

We also got a confirmation that getOAuth1Signature can be used, it seems that it calls calcSignature() method in the background.

Also, I definitely agree with the approach of using a dedicated application key/secret for signature creation in this case. We will create a dummy key/secret that will be used only for this purpose and the key will be passed back to the proxy page.