Class ConcreteCmsOidcIntegration

java.lang.Object
com.cloudforge.core.oidc.ConcreteCmsOidcIntegration
All Implemented Interfaces:
OidcIntegration
public class ConcreteCmsOidcIntegration extends Object implements OidcIntegration
OIDC integration for Concrete CMS via OAuth extension / ALB OIDC.

Concrete CMS supports OAuth 2.0 / OIDC via the community OAuth package. Authentication is primarily handled at the ALB layer via Cognito.

Since:
3.2.0

  • Constructor Details

    • ConcreteCmsOidcIntegration

      public ConcreteCmsOidcIntegration()

  • Method Details

    • isSupported

      public boolean isSupported()
      Description copied from interface: OidcIntegration
      Returns whether this application supports OIDC integration.
      Specified by:
      isSupported in interface OidcIntegration
      Returns:
      true if application has OIDC support

    • getIntegrationMethod

      public String getIntegrationMethod()
      Description copied from interface: OidcIntegration
      Returns the OIDC integration method for this application.

      Examples:

      • jenkins: OIDC Plugin
      • gitlab: Built-in OmniAuth
      • grafana: Built-in generic_oauth
      • sonarqube: OIDC Plugin
      Specified by:
      getIntegrationMethod in interface OidcIntegration
      Returns:
      integration method description

    • getEnvironmentVariables

      public Map<String,String> getEnvironmentVariables(OidcConfiguration config)
      Description copied from interface: OidcIntegration
      Returns environment variables needed for OIDC configuration.

      These are passed to the container or EC2 userdata script.

      Example for Grafana:

      GF_AUTH_GENERIC_OAUTH_ENABLED=true
GF_AUTH_GENERIC_OAUTH_NAME=Cognito
GF_AUTH_GENERIC_OAUTH_CLIENT_ID=${clientId}
GF_AUTH_GENERIC_OAUTH_AUTH_URL=${authUrl}
      Specified by:
      getEnvironmentVariables in interface OidcIntegration
      Parameters:
      config - OIDC configuration from provider
      Returns:
      map of environment variable name to value

    • getUserDataCommands

      public List<String> getUserDataCommands(OidcConfiguration config, Ec2Context context)
      Description copied from interface: OidcIntegration
      Returns UserData commands for setting up OIDC integration.

      These commands are added to the EC2 userdata script to configure OIDC integration during instance initialization.

      Specified by:
      getUserDataCommands in interface OidcIntegration
      Parameters:
      config - OIDC configuration from provider
      context - EC2 context with stack information
      Returns:
      list of shell commands

    • getOidcCallbackPath

      public String getOidcCallbackPath()
      Description copied from interface: OidcIntegration
      Returns the OIDC callback path for this application.

      This is the path where the OIDC provider redirects after authentication. Each application has a different callback path based on its OIDC implementation.

      Examples:

      • Jenkins: /securityRealm/finishLogin
      • Mattermost: /signup/gitlab/complete (uses GitLab OAuth provider for OIDC)
      • GitLab: /users/auth/openid_connect/callback
      • Grafana: /login/generic_oauth
      Specified by:
      getOidcCallbackPath in interface OidcIntegration
      Returns:
      callback path (e.g., "/securityRealm/finishLogin")

    • supportsAlbOidc

      public boolean supportsAlbOidc()
      Description copied from interface: OidcIntegration
      Returns whether this application supports ALB-level OIDC authentication.

      ALB-level auth means authentication is handled by the ALB before traffic reaches the application. The application sees already-authenticated users via headers (X-Amzn-Oidc-*).

      Most applications support this as it's transparent to the application.

      Specified by:
      supportsAlbOidc in interface OidcIntegration
      Returns:
      true if ALB-level OIDC is supported (default: true)

    • supportsCognito

      public boolean supportsCognito()
      Description copied from interface: OidcIntegration
      Returns whether this application supports Cognito as an identity provider.

      Cognito provides:

      • User pool with email/password authentication
      • MFA support (TOTP, SMS)
      • OAuth 2.0 / OIDC endpoints
      • Hosted UI for login
      Specified by:
      supportsCognito in interface OidcIntegration
      Returns:
      true if Cognito OIDC is supported (default: true)

    • supportsApplicationOidc

      public boolean supportsApplicationOidc()
      Description copied from interface: OidcIntegration
      Returns whether this application supports application-level OIDC.

      Application-level OIDC means the application handles authentication itself using its built-in OIDC/OAuth support. The application needs:

      • Client ID and secret
      • OIDC endpoints (issuer, auth, token, userinfo)
      • Redirect URL configuration

      Examples: Jenkins OIDC plugin, GitLab OmniAuth, Grafana generic_oauth

      Specified by:
      supportsApplicationOidc in interface OidcIntegration
      Returns:
      true if application-level OIDC is supported (default: true if integration exists)