• Mitigate insecure file permissions vulnerability in Docker container for those of who just copy the Dockerfile although it is for testing purpose.
• Disable client_id validation so that anyone can continue to sign-in again without removing a cookie when default map key is used. --> When multiple client IdPs are required this client_id validation should be enabled.

Background:

• https://openid.net/specs/openid-connect-session-1_0-17.html
• In 2.1. OpenID Provider Discovery Metadata, end_session_endpoint is required field.
• Currently, the name is called as $oidc_logout_endpoint in NGINX Plus OIDC.
• Hence, it needs to be replaced with end_session_endpoint to be consistent name with the OIDC specification to prevent any confusion.

AC:

• Replace $oidc_logout_endpoint with $oidc_session_end_point.

Background:

• Multiple IdP client applications can be used to a specific host for the following example.
  • host: www.xxx.com
  • Users want to choose either [email protected], or [email protected] based on their email.
  • To support this use case, we need to be able to configure multiple IdP apps per server block.

AC:

• Replace $host map variable to $oidc_app_identifier.
• Assign $x_client_id map to $oidc_app_identifier.
• SPA set $x_client_id in the cookie so that NGINX Plus can choose which IdP app is used.