Identity Provider (IdP) - Hands-on

📋Learning Objectives

• Create an OIDC client via the Admin UI
• Perform Authorization Code flow
• Perform Client Credentials flow
• Introspect and validate tokens

🗺️OAuth Flows: The Big Picture

Flow 1: Client Credentials (Machine-to-Machine)

The simplest flow—no user involved. Your service proves its identity and gets a token.

Flow 2: Authorization Code (User Login)

The standard flow for user-facing apps. Involves browser redirects and user consent.

Key Differences at a Glance

🔧Exercise 1: Create an OIDC Client

Option A: Using the Experience App (OAuth Client Center)

The Experience App provides a user-friendly interface for managing OAuth clients:

Creating a New Client

1. Open https://experience.self.empowernow.ai
2. Log in with your credentials
3. Navigate to Identity → OAuth Client Center in the navigation menu
4. Click Register New Client
5. Fill in the registration form:
   • Client Name: Training Test Client
   • Application Type: Confidential (for server-side apps)
   • Redirect URIs: http://localhost:3000/callback
   • Grant Types: authorization_code, client_credentials, refresh_token
   • Scopes: openid, profile, email
6. Click Register and copy the client_id and client_secret

Editing an Existing Client

The same form UI is used for editing existing clients:

1. From the OAuth Client Center, click on any client to open its detail view
2. You'll see the full client configuration including:
   • CLIENT ID - Copy button for easy use in your application
   • Client configuration JSON - Shows grant types, scopes, redirect URIs, etc.
3. Modify any settings using the same form interface
4. Use the action buttons:
   • Export - Download client configuration
   • Clone - Create a copy of this client
   • Rotate Secret - Generate a new client secret
   • Delete - Remove the client
   • Save Changes - Persist your modifications

Option B: Using Postman (Recommended for API Testing)

Postman is excellent for testing OAuth flows. You can register clients directly via the DCR (Dynamic Client Registration) API:

1. Open Postman and create a new POST request
2. Set the URL to: https://idp.self.empowernow.ai/api/oidc/register
3. Set Content-Type header to application/json
4. Add this JSON body:

{
  "client_name": "Training Test Client",
  "application_type": "web",
  "redirect_uris": ["http://localhost:3000/callback"],
  "grant_types": ["authorization_code", "client_credentials", "refresh_token"],
  "response_types": ["code"],
  "scope": "openid profile email",
  "token_endpoint_auth_method": "client_secret_post"
}

Click Send. The response contains your new client credentials:

{
  "client_id": "generated-client-id",
  "client_secret": "generated-secret",
  "client_name": "Training Test Client",
  "registration_access_token": "...",
  ...
}

Option C: Use Pre-seeded Clients (Quick Start)

For training purposes, you can use clients already seeded in the database:

🔄Exercise 2: Client Credentials Flow

This flow is for machine-to-machine authentication (no user involved):

# Replace with your client_id and client_secret
CLIENT_ID="your-client-id"
CLIENT_SECRET="your-client-secret"

# Request access token
curl -k -X POST https://idp.self.empowernow.ai/api/oidc/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=$CLIENT_ID" \
  -d "client_secret=$CLIENT_SECRET" \
  -d "scope=openid"

Expected Response

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "openid"
}

$body = @{
    grant_type = "client_credentials"
    client_id = "your-client-id"
    client_secret = "your-client-secret"
    scope = "openid"
}
Invoke-RestMethod -Uri "https://idp.self.empowernow.ai/api/oidc/token" `
    -Method POST -Body $body -SkipCertificateCheck

👤Exercise 3: Authorization Code Flow

This flow involves user authentication. It's a multi-step process:

Step 1: Generate Authorization URL

# Build authorization URL
CLIENT_ID="your-client-id"
REDIRECT_URI="http://localhost:3000/callback"
STATE="random-state-string"
NONCE="random-nonce-string"

# Open this URL in browser
echo "https://idp.self.empowernow.ai/api/oidc/authorize?\
response_type=code&\
client_id=$CLIENT_ID&\
redirect_uri=$REDIRECT_URI&\
scope=openid%20profile%20email&\
state=$STATE&\
nonce=$NONCE"

Step 2: User Logs In

1. Open the URL in browser
2. Log in with test credentials
3. Consent to requested scopes
4. Browser redirects to redirect_uri with code parameter

Step 3: Exchange Code for Tokens

# Extract code from redirect URL query params
CODE="authorization-code-from-redirect"

# Exchange code for tokens
curl -k -X POST https://idp.self.empowernow.ai/api/oidc/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "client_id=$CLIENT_ID" \
  -d "client_secret=$CLIENT_SECRET" \
  -d "code=$CODE" \
  -d "redirect_uri=$REDIRECT_URI"

Response with All Token Types

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "dGhpcyBpcyBhIHJlZnJl...",
  "id_token": "eyJhbGciOiJSUzI1NiIs...",
  "scope": "openid profile email"
}

🔍Exercise 4: Token Introspection

Introspection allows you to verify if a token is valid and get its claims:

# Introspect an access token
ACCESS_TOKEN="your-access-token"

curl -k -X POST https://idp.self.empowernow.ai/api/oidc/token/introspect \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "token=$ACCESS_TOKEN" \
  -d "client_id=$CLIENT_ID" \
  -d "client_secret=$CLIENT_SECRET"

Active Token Response

{
  "active": true,
  "sub": "user-uuid-123",
  "client_id": "your-client-id",
  "scope": "openid profile email",
  "exp": 1699900000,
  "iat": 1699896400,
  "iss": "https://idp.self.empowernow.ai"
}

Expired/Invalid Token Response

{
  "active": false
}

🔄Exercise 5: Refresh Tokens

Use a refresh token to get a new access token:

# Use refresh token to get new access token
REFRESH_TOKEN="your-refresh-token"

curl -k -X POST https://idp.self.empowernow.ai/api/oidc/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token" \
  -d "client_id=$CLIENT_ID" \
  -d "client_secret=$CLIENT_SECRET" \
  -d "refresh_token=$REFRESH_TOKEN"

👁️Exercise 6: UserInfo Endpoint

Get user profile information using an access token:

# Get user info
ACCESS_TOKEN="your-access-token"

curl -k -X GET https://idp.self.empowernow.ai/api/oidc/userinfo \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Response

{
  "sub": "user-uuid-123",
  "name": "John Doe",
  "email": "john.doe@empowerid.com",
  "email_verified": true,
  "preferred_username": "johndoe"
}

🔬Hands-on Labs

TOKEN_RESPONSE=$(curl -s -X POST https://idp.self.empowernow.ai/api/oidc/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=bff-client" \
  -d "client_secret=secret1" \
  -d "scope=openid profile")

echo $TOKEN_RESPONSE | jq .

ACCESS_TOKEN=$(echo $TOKEN_RESPONSE | jq -r '.access_token')
echo "Token: ${ACCESS_TOKEN:0:50}..."

echo $ACCESS_TOKEN | cut -d'.' -f1 | tr '_-' '/+' | base64 -d 2>/dev/null | jq .

echo $ACCESS_TOKEN | cut -d'.' -f2 | tr '_-' '/+' | base64 -d 2>/dev/null | jq .

curl -s -X POST https://idp.self.empowernow.ai/api/oidc/token/introspect \
  -d "token=$ACCESS_TOKEN" \
  -d "client_id=bff-client" \
  -d "client_secret=secret1" | jq .

# Set variables (use your client from Exercise 1, or the pre-seeded one)
CLIENT_ID="experience-app"
REDIRECT_URI="https://experience.self.empowernow.ai/oauth/callback"
STATE="my-random-state-$(date +%s)"
NONCE="my-random-nonce-$(date +%s)"

# Build URL
AUTH_URL="https://idp.self.empowernow.ai/api/oidc/authorize?\
response_type=code&\
client_id=$CLIENT_ID&\
redirect_uri=$REDIRECT_URI&\
scope=openid%20profile%20email&\
state=$STATE&\
nonce=$NONCE"

echo "Open this URL in your browser:"
echo $AUTH_URL

https://experience.self.empowernow.ai/oauth/callback?code=AUTH_CODE_HERE&state=my-random-state-...

CODE="paste-your-code-here"

curl -s -X POST https://idp.self.empowernow.ai/api/oidc/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "client_id=$CLIENT_ID" \
  -d "code=$CODE" \
  -d "redirect_uri=$REDIRECT_URI" | jq .

REFRESH_TOKEN="paste-refresh-token-from-lab-2"

curl -s -X POST https://idp.self.empowernow.ai/api/oidc/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token" \
  -d "client_id=experience-app" \
  -d "refresh_token=$REFRESH_TOKEN" | jq .

🔧Troubleshooting OAuth Flows

docker exec empowernow-db-1 psql -U postgres -d idp_db \
  -c "SELECT client_id FROM idp.oauth_clients WHERE client_id = 'your-client-id';"

# Check registered URIs
docker exec empowernow-db-1 psql -U postgres -d idp_db \
  -c "SELECT redirect_uris FROM idp.oauth_clients WHERE client_id = 'your-client-id';"

🌐Federation: Hands-On Labs

Lab: Inspect a Federated Token

In this lab, you'll decode a federated token and identify its unique characteristics.

Step 1: Get a Federated Token (Simulated)

If you don't have Azure AD federation configured, use this example token for analysis:

# Example federated token payload (decoded)
{
  "iss": "https://idp.self.empowernow.ai",
  "sub": "auth:account:entra.contoso:ffe9b9f0-ec04-4b9c-bd48-30fdefd72a5e",
  "aud": ["bff-client"],
  "email": "john.doe@contoso.com",
  "name": "John Doe",
  "roles": ["User", "Admin"],
  "idp": "entra.contoso",
  "idp_sub": "ffe9b9f0-ec04-4b9c-bd48-30fdefd72a5e",
  "federation": {
    "orig_iss": "https://login.microsoftonline.com/contoso.com/v2.0",
    "orig_sub": "ffe9b9f0-ec04-4b9c-bd48-30fdefd72a5e",
    "stable_id_claim": "oid",
    "mapped_at": "2025-01-20T10:30:00Z"
  },
  "emp_account_arn": "auth:account:entra.contoso:ffe9b9f0-ec04-4b9c-bd48-30fdefd72a5e",
  "exp": 1737456600,
  "iat": 1737453000
}

Step 2: Identify Federation Markers

Look for these claims that indicate a federated identity:

Step 3: Decode Using jwt.io

1. Go to jwt.io
2. Paste the complete JWT (header.payload.signature)
3. Look at the decoded payload
4. Find the federation.orig_iss to see which external IdP authenticated the user

Lab: Trace Federation in Logs

When troubleshooting federation issues, IdP logs contain valuable information.

View Federation Logs

# Filter IdP logs for federation events
docker logs idp-app 2>&1 | grep -i "federation\|external\|jwks"

# Expected log entries for successful federation:
# [INFO] Federation: Validating token from issuer https://login.microsoftonline.com/...
# [INFO] Federation: JWKS cache hit for entra-id
# [INFO] Federation: Token signature valid, mapping claims
# [INFO] Federation: Minted ARN auth:account:entra.contoso:ffe9b9f0...

Common Federation Errors

Lab: Test PDP Authorization for Federated Users

PDP policies work the same for local and federated users—they just target different ARN patterns.

# AuthZEN request for a federated user
curl -X POST https://pdp.self.empowernow.ai/access/v1/evaluation \
  -H "Content-Type: application/json" \
  -d '{
    "subject": {
      "type": "user",
      "id": "auth:account:entra.contoso:ffe9b9f0-ec04-4b9c-bd48-30fdefd72a5e"
    },
    "action": {
      "name": "document.view"
    },
    "resource": {
      "type": "document",
      "id": "doc-123"
    }
  }'

# Example policy that permits all Azure AD users from contoso
# Policy subjects:
#   - { type: user, id: "auth:account:entra.contoso:*" }

❓Knowledge Check

📝Day 7 Checkpoint

• Created an OIDC client via Admin UI
• Successfully performed Client Credentials flow
• Completed Authorization Code flow
• Introspected a token and verified it's active
• Refreshed an access token using refresh token
• Retrieved user info from UserInfo endpoint