NAME

Lemonldap::NG::Portal::Plugins::CustomPlugin::WebFinger - RFC 7033 WebFinger endpoint for OpenID Connect issuer discovery.

SYNOPSIS

Enable the plugin as a custom plugin:

Lemonldap::NG::Portal::Plugins::CustomPlugin::WebFinger

Optional parameters:

{
  "useMail": false,
  "userDB": undef
}

DESCRIPTION

This plugin exposes the standard WebFinger endpoint

/.well-known/webfinger

used by OpenID Connect Discovery.

The plugin accepts RFC7033 account identifiers and returns the issuer configured by LemonLDAP::NG.

CONFIGURATION

useMail

Default:

false

When disabled, the local-part of the account identifier is passed to UserDB::getUser().

Example:

acct:alice@example.org

becomes

alice

When enabled, the complete account identifier is passed to the UserDB mail lookup mechanism.

Example:

acct:alice@example.org

is searched as

alice@example.org

using

getUser(..., useMail => 1)

userDB

Default: undef

Used to load a UserDB module when defined. Needed when using Combination module.

ENDPOINT

GET /.well-known/webfinger

Parameters

• resource

  An RFC7033 account URI.

  Example:

    acct:alice@example.org
  

Success

Returns

application/jrd+json

Example:

{
  "subject":"acct:alice@example.org",
  "links":[
    {
      "rel":"http://openid.net/specs/connect/1.0/issuer",
      "href":"https://example.org/"
    }
  ]
}

Errors

400

Missing or malformed resource parameter.

404

Unknown account or unsupported domain.

500

Portal configuration error.

LIMITATIONS

Only one UserDB backend may be used by this plugin.

The requested domain must match the configured portal hostname.

AUTHOR

Tramway <tramway@tarrasque.tech>

LICENSE

Same license as LemonLDAP::NG.