Convert an OpenAM Token to OpenID Connect (JWT)
This route transforms an OpenAM session token into an OpenID Connect token using an OpenAM REST STS instance named jwt in the /staff realm. Configure that STS instance first, and supply the OpenAM URL and protected backend URL through the openam and endpoint.api system properties.
See TokenTransformationFilter for the filter configuration and the OpenAM authorization tutorial for a complete STS setup.
{
"name": "10-api",
"condition": "${matches(request.uri.path, '^/api')}",
"monitor": true,
"timer": true,
"handler": {
"type": "Chain",
"config": {
"filters": [
{
"type": "TokenTransformationFilter",
"config": {
"openamUri": "${system['openam']}",
"realm": "/staff",
"instance": "jwt",
"from": "OPENAM",
"to": "OPENIDCONNECT",
"idToken": "${request.headers['Authorization'][0]}"
}
},
{
"type": "HeaderFilter",
"config": {
"messageType": "REQUEST",
"remove": [
"Authorization"
]
}
},
{
"type": "ConditionalFilter",
"config": {
"condition": "${not empty contexts.sts.issuedToken}",
"delegate": {
"type": "HeaderFilter",
"config": {
"messageType": "REQUEST",
"add": {
"Authorization": [
"Bearer ${contexts.sts.issuedToken}"
]
}
}
}
}
}
],
"handler": {
"type": "DispatchHandler",
"config": {
"bindings": [
{
"handler": "ClientHandler",
"capture": ["filtered_request"],
"baseURI": "${system['endpoint.api']}"
}
]
}
}
}
}
}