JoelGauci · JoelGauci · Nov 19, 2020 · Nov 19, 2020 · Nov 19, 2020 · Nov 19, 2020
diff --git a/CODEOWNERS b/CODEOWNERS
@@ -9,6 +9,8 @@
 /references/js-callout                @seymen
 /references/proxy-template            @laughingbiscuit
 /references/southbound-mtls           @danistrebel
+/references/oidc-mock		      @joelgauci
+/references/dummy		      @joelgauci
 /labs/best-practices-hackathon	      @laughingbiscuit @sauliuz @seymen
 /tools/organization-cleanup           @laughingbiscuit
 /tools/pipeline-runner                @laughingbiscuit @seymen

diff --git a/README.md b/README.md
@@ -34,6 +34,11 @@ further to fit a particular use case.
 - [Southbound mTLS](references/southbound-mtls) -
   Reference for using mTLS client authentication for securely connecting Apigee to
   backend services
+- [Identity Proxy](references/dummy) -
+  Reference for using Apigee as an identity proxy for end-user authentication
+  via OIDC
+- [OIDC Mock Identity Proxy](references/oidc-mock) -
+  Reference project that includes an oidc mock identity provider
 
 ## Tools
 

diff --git a/references/dummy/.gitignore b/references/dummy/.gitignore
@@ -0,0 +1,5 @@
+.DS_Store
+target/
+node_modules
+_edge.json
+
diff --git a/references/dummy/README.md b/references/dummy/README.md
@@ -0,0 +1 @@
+dummy identity-v1
diff --git a/references/dummy/apiproxy/identity-api-v1.xml b/references/dummy/apiproxy/identity-api-v1.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?><!--
+ Copyright 2020 Google LLC
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+      http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<APIProxy revision="1" name="identity-api-v1"/>
diff --git a/references/dummy/apiproxy/policies/AM-BuildIdpRequest.xml b/references/dummy/apiproxy/policies/AM-BuildIdpRequest.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<!--
+ Copyright 2020 Google LLC
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+      http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<AssignMessage async="false" continueOnError="false" enabled="true" name="AM-BuildIdpRequest">
+    <DisplayName>AM-BuildIdpRequest</DisplayName>
+    <Properties/>
+    <AssignTo createNew="true" type="request">idpPostTokenRequest</AssignTo>
+    <Set>
+        <Headers>
+            <Header name="content-type">application/x-www-form-urlencoded</Header>
+            <Header name="accept">application/json</Header>
+            <Header name="Authorization">{flow.idp.Authorization}</Header>
+        </Headers>
+        <FormParams>
+            <FormParam name="code">{request.formparam.code}</FormParam>
+            <FormParam name="redirect_uri">{flow.idp.apigee.redirect_uri}</FormParam>
+            <FormParam name="scope">{oauthv2authcode.OA2-GetOriginalStateAttributes.scope}</FormParam>
+            <FormParam name="grant_type">authorization_code</FormParam>
+        </FormParams>
+        <Verb>POST</Verb>
+    </Set>
+    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
+</AssignMessage>
diff --git a/references/dummy/apiproxy/policies/AM-GenerateState2ForIdp.xml b/references/dummy/apiproxy/policies/AM-GenerateState2ForIdp.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<!--
+ Copyright 2020 Google LLC
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+      http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<AssignMessage async="false" continueOnError="false" enabled="true" name="AM-GenerateState2ForIdp">
+    <DisplayName>AM-GenerateState2ForIdp</DisplayName>
+    <Properties/>
+    <AssignVariable>
+        <Name>oidc.flow.authorization.state2</Name>
+        <Ref>oauthv2authcode.OA2-GenerateAzCode-State2.code</Ref>
+    </AssignVariable>
+    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
+    <AssignTo createNew="false" transport="http" type="request"/>
+</AssignMessage>
diff --git a/references/dummy/apiproxy/policies/AM-RedirectToApp.xml b/references/dummy/apiproxy/policies/AM-RedirectToApp.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<!--
+ Copyright 2020 Google LLC
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+      http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<AssignMessage async="false" continueOnError="false" enabled="true" name="AM-RedirectToApp">
+    <DisplayName>AM-RedirectToApp</DisplayName>
+    <Properties/>
+    <Set>
+        <Headers>
+            <Header name="Location">{oidc.flow.authorize.redirect_uri}?code={oauthv2authcode.OA2-StoreExternalAuthorizationCode.code}&amp;state={oidc.flow.authorize.state1}</Header>
+        </Headers>
+        <StatusCode>302</StatusCode>
+        <ReasonPhrase>Found</ReasonPhrase>
+    </Set>
+    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
+    <AssignTo createNew="false" transport="http" type="request"/>
+</AssignMessage>
diff --git a/references/dummy/apiproxy/policies/AM-RedirectToIdpAuth.xml b/references/dummy/apiproxy/policies/AM-RedirectToIdpAuth.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<!--
+ Copyright 2020 Google LLC
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+      http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<AssignMessage async="false" continueOnError="false" enabled="true" name="AM-RedirectToIdpAuth">
+    <DisplayName>AM-RedirectToIdpAuth</DisplayName>
+    <Properties/>
+    <Set>
+        <Headers>
+            <Header name="Location">https://{flow.idp.az.hostname}/{flow.idp.az.uri}?client_id={flow.idp.apigee.client_id}&amp;response_type=code&amp;scope={oidc.flow.authorize.scope}&amp;state={oidc.flow.authorization.state2}&amp;redirect_uri={flow.idp.apigee.redirect_uri}&amp;prompt=consent</Header>
+        </Headers>
+        <StatusCode>302</StatusCode>
+        <ReasonPhrase>Found</ReasonPhrase>
+    </Set>
+    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
+    <AssignTo createNew="false" transport="http" type="request"/>
+</AssignMessage>
diff --git a/references/dummy/apiproxy/policies/AM-SanitizeRequest.xml b/references/dummy/apiproxy/policies/AM-SanitizeRequest.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<!--
+ Copyright 2020 Google LLC
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+      http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<AssignMessage async="false" continueOnError="false" enabled="true" name="AM-SanitizeRequest">
+    <DisplayName>AM-SanitizeRequest</DisplayName>
+    <Properties/>
+    <Remove>
+        <Headers>
+            <Header name="authorization"/>
+        </Headers>
+    </Remove>
+    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
+    <AssignTo createNew="false" transport="http" type="request"/>
+</AssignMessage>
diff --git a/references/dummy/apiproxy/policies/AM-SetClientIdAsFormParam.xml b/references/dummy/apiproxy/policies/AM-SetClientIdAsFormParam.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<!--
+ Copyright 2020 Google LLC
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+      http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<AssignMessage async="false" continueOnError="false" enabled="true" name="AM-SetClientIdAsFormParam">
+    <DisplayName>AM-SetClientIdAsFormParam</DisplayName>
+    <Properties/>
+    <Add>
+        <FormParams>
+            <FormParam name="client_id">{request.queryparam.client_id}</FormParam>
+            <FormParam name="client_secret">{oidc.flow.client_secret}</FormParam>
+        </FormParams>
+    </Add>
+    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
+    <AssignTo createNew="false" transport="http" type="request"/>
+</AssignMessage>
diff --git a/references/dummy/apiproxy/policies/AM-SetDummyResponse.xml b/references/dummy/apiproxy/policies/AM-SetDummyResponse.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<!--
+ Copyright 2020 Google LLC
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+      http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<AssignMessage async="false" continueOnError="false" enabled="true" name="AM-SetDummyResponse">
+    <DisplayName>AM-SetDummyResponse</DisplayName>
+    <Properties/>
+    <Set>
+        <Payload contentType="application/json">{"response":{"status":"ok","message":"access token has been validated!","user":{"name":"{flow.protected.name}","email":"{flow.protected.email}"}}}</Payload>
+    </Set>
+    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
+    <AssignTo createNew="false" transport="http" type="response"/>
+</AssignMessage>
diff --git a/references/dummy/apiproxy/policies/AM-SetState1InResponseHeader.xml b/references/dummy/apiproxy/policies/AM-SetState1InResponseHeader.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<!--
+ Copyright 2020 Google LLC
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+      http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<AssignMessage async="false" continueOnError="false" enabled="true" name="AM-SetState1InResponseHeader">
+    <DisplayName>AM-SetState1InResponseHeader</DisplayName>
+    <Properties/>
+    <Set>
+        <Headers>
+            <Header name="x-state">{oauthv2authcode.OA2-GetOriginalStateAttributes.state1}</Header>
+        </Headers>
+    </Set>
+    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
+    <AssignTo createNew="false" transport="http" type="request"/>
+</AssignMessage>
diff --git a/references/dummy/apiproxy/policies/AM-StateAttributes.xml b/references/dummy/apiproxy/policies/AM-StateAttributes.xml
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<!--
+ Copyright 2020 Google LLC
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+      http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<AssignMessage async="false" continueOnError="false" enabled="true" name="AM-StateAttributes">
+    <DisplayName>AM-StateAttributes</DisplayName>
+    <Properties/>
+    <AssignVariable>
+        <Name>oidc.flow.authorize.state1</Name>
+        <Ref>oauthv2authcode.OA2-AttributesFromAzCode-State2.state1</Ref>
+    </AssignVariable>
+    <AssignVariable>
+        <Name>request.formparam.client_id</Name>
+        <Ref>oauthv2authcode.OA2-AttributesFromAzCode-State2.client_id</Ref>
+    </AssignVariable>
+    <AssignVariable>
+        <Name>oidc.flow.authorize.redirect_uri</Name>
+        <Ref>oauthv2authcode.OA2-AttributesFromAzCode-State2.redirect_uri</Ref>
+    </AssignVariable>
+    <AssignVariable>
+        <Name>oidc.flow.authorize.response_type</Name>
+        <Ref>oauthv2authcode.OA2-AttributesFromAzCode-State2.response_type</Ref>
+    </AssignVariable>
+    <AssignVariable>
+        <Name>oidc.flow.authorize.scope</Name>
+        <Ref>oauthv2authcode.OA2-AttributesFromAzCode-State2.scope</Ref>
+    </AssignVariable>
+    <AssignVariable>
+        <Name>oauth_external_authorization_status</Name>
+        <Value>true</Value>
+    </AssignVariable>
+    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
+    <AssignTo createNew="false" transport="http" type="request"/>
+</AssignMessage>
diff --git a/references/dummy/apiproxy/policies/BA-AddClientID-ClientSecret-AzHeader.xml b/references/dummy/apiproxy/policies/BA-AddClientID-ClientSecret-AzHeader.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<!--
+ Copyright 2020 Google LLC
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+      http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<BasicAuthentication async="false" continueOnError="false" enabled="true" name="BA-AddClientID-ClientSecret-AzHeader">
+    <DisplayName>BA-AddClientID-ClientSecret-AzHeader</DisplayName>
+    <Operation>Encode</Operation>
+    <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
+    <User ref="flow.idp.apigee.client_id"/>
+    <Password ref="flow.idp.apigee.client_secret"/>
+    <AssignTo createNew="true">flow.idp.Authorization</AssignTo>
+</BasicAuthentication>
diff --git a/references/dummy/apiproxy/policies/BA-GetClientCredentials.xml b/references/dummy/apiproxy/policies/BA-GetClientCredentials.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<!--
+ Copyright 2020 Google LLC
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+      http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<BasicAuthentication async="false" continueOnError="false" enabled="true" name="BA-GetClientCredentials">
+    <DisplayName>BA-GetClientCredentials</DisplayName>
+    <Operation>Decode</Operation>
+    <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
+    <User ref="request.queryparam.client_id"/>
+    <Password ref="oidc.flow.client_secret"/>
+    <Source>request.header.Authorization</Source>
+</BasicAuthentication>
diff --git a/references/dummy/apiproxy/policies/EV-ExtractJWKS.xml b/references/dummy/apiproxy/policies/EV-ExtractJWKS.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<!--
+ Copyright 2020 Google LLC
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+      http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<ExtractVariables async="false" continueOnError="false" enabled="true" name="EV-ExtractJWKS">
+    <DisplayName>EV-ExtractJWKS</DisplayName>
+    <Source>jwks</Source>
+    <JSONPayload>
+        <Variable name="flow.idp.jwks_payload" type="string">
+            <JSONPath>$</JSONPath>
+        </Variable>
+    </JSONPayload>
+</ExtractVariables>