Camelid example relying party

TEMPLATE-alpaca-tracker.ENV.txt

NODE_ENV=development
NODE_PORT=3004
OIDC_CLIENT_ID={{CLIENT_ID}}
OIDC_PRIVATE_KEY={{PRIVATE_KEY}}
OIDC_ISSUER_DISCOVERY_ENDPOINT=https://oidc.integration.account.gov.uk/.well-known/openid-configuration
IV_PUBLIC_KEY={{PUBLIC_KEY}}
OIDC_AUTHORIZE_REDIRECT_URI=http://localhost:3004/oauth/callback
OIDC_LOGOUT_REDIRECT_URI=http://localhost:3004/logged-out
LOGOUT_TOKEN_MAX_AGE_SECONDS=120
TOKEN_CLOCK_SKEW=10
SERVICE_NAME=Register your alpaca
SERVICE_INTRO_MESSAGE=Login or register to access the Alpaca Tracker service. <br>To use this service you must own an alpaca.
SESSION_SECRET={{SESSION_SECRET}}
SERVICE_URL=http://localhost:3001
HOME_PAGE_URL=https://gov.uk
SESSION_NAME=alpaca
ROOT_ROUTE=/start
HOME_ROUTE=/alpaca/home
SERVICE_TYPE=verify
GLOBAL_SIGN_OUT_URL=https://home.integration.account.gov.uk/sign-out

TEMPLATE-camelid-dashboard.ENV.txt

NODE_ENV=development
NODE_PORT=3001
OIDC_CLIENT_ID={{CLIENT_ID}}
OIDC_PRIVATE_KEY={{PRIVATE_KEY}}
OIDC_ISSUER_DISCOVERY_ENDPOINT=https://oidc.integration.account.gov.uk/.well-known/openid-configuration
IV_PUBLIC_KEY={{PUBLIC_KEY}}
OIDC_AUTHORIZE_REDIRECT_URI=http://localhost:3001/oauth/callback
OIDC_LOGOUT_REDIRECT_URI=http://localhost:3001/logged-out
LOGOUT_TOKEN_MAX_AGE_SECONDS=120
TOKEN_CLOCK_SKEW=10
SERVICE_NAME=Camelid dashboard service
SERVICE_INTRO_MESSAGE=Login or register to access the dashboard. <br>To use the dashboard service you must own at least one species of camelid.
SERVICE_URL=http://localhost:3001
HOME_PAGE_URL=https://gov.uk
SESSION_SECRET={{SESSION_SECRET}}
SESSION_NAME=camelid
ROOT_ROUTE=/start
HOME_ROUTE=/camelid/dashboard
SERVICE_TYPE=login
GLOBAL_SIGN_OUT_URL=https://home.integration.account.gov.uk/sign-out

TEMPLATE-camelid-example-rp-nodejs.md

Camelid example relying party

An example implementation of an OpenID Connect relying party that connects to the GOV.UK One Login OpenID provider in javascript using node.js and Typescript

Overview

This consists of four interrelated services belonging to a hypothetical department of Camelids that demonstrates some of the key concepts of integration with GOV.UK One Login:

service	type	description
Camelid dashboard	auth only	a dashboard service for all camelids
Dromedary directory	?	a directory of dromedaries
Llama ledger	?	a ledger of llamas
Alpaca tracker	auth + idv	a tracker for alpacas

DIAGRAM

Description of the diagram

Setup

This requires that you have:

• a set of four OpenID client IDs for the services configured appropriately against the integration environment
• the required software dependencies to run the example, homebrew, node.js, typescript, direnv, visual studio code, visual studion extensions
• test data to allow you to prove an identity

Request clients in integration environment

The four service all require their own OpenID Connect client ID configured in the integration environment.

Because all these services require control of the sector id or require the use of the identity service they must be manually configured against integration and are not able to use the self service admin tool which only supports auth only,

• get client ID for Camelid dashboard
• get client ID for Dromedary directory
• get client ID for Llama ledger
• get client ID for Alpaca tracker

Install dependencies

Assuming you are using MacOS

tool	instructions
homebrew	/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
node.js	brew install node
direnv	brew install direnv
typescript	brew install typescript
ts-node	npm install -g ts-node
Visual Studio Code	visual-studio-code
Visual Studio Code extensions

Install example code

• git clone https://github.com/philf999/di-rp-reference
• git checkout camels
• cd di-rp-reference/clients/nodejs

Configure example code

• copy template environment settings
• configure environment settings

Test example code

• prepare IDE
• run directory service
• signup
• access directory
• navigate to other service
• signup with identity
• assess service
• navigate to third service
• authentiate using login sharing the identity

...