Auth0 OIDC/OpenID with Domino & Some other interesting findings
Daniel Nashed 22 February 2024 00:00:51
We are working on a OIDC setup with a German business partner for a larger German customer.
Auth0 is one of the major providers. We got it working but only with some tricks for now.
It turned out the Auth0 OIDC endpoint has a cache expiration for 15 seconds. This looks like a setting that can't be changed.
The Domino OIDC cache uses the expiration header to invalidate the cache. So our cache on the Domino side was constantly reloading and invalid in some cases.
You really have to have an expiration that is at least a couple of minutes. Better at least 1 hour.
Faking the cache expiration
This has been reported to HCL and the team is working on an enhancement.
Meanwhile I came up with a work-around setting up a Fake provider on a NGINX server to forward the requests.
1. Simple NGINX proxy config overwriting the expired header
2. Certificate created by an exportable MicroCA certificate which is trusted by the Domino OIDC config.
Samesite "Strict" can break the configuration
If the OIDC provider runs under the same domain than your Domino server, you are all set.
But if one domain involved is different, any redirect to a different domain -- even the final request goes to the original URL, will let the browser not send back the cookie.
So you have to change your cookie policy to Lax in this case. See details in Domino 14.0 help -> https://help.hcltechsw.com/domino/14.0.0/admin/conf_samesite_cookie.html
Settings in general are straightforward
Auth0 sets an ID as the audience. Domino 14.0 allows you to specify the audience in the a OIDC configuration document.
The claim is by default the e-mail address. So you are all set with the settings.
I hope this helps to configure it out. If you need help for this type of configuration or other OIDC providers or security related configurations, I am always trying to help as long it isn't exceeding my community limits.
But you can always involve me as a business partner as well.
-- Daniel
- Comments [0]
![[HCL Domino]](../lotus-domino.gif){kind=small}
![[Domino on Linux]](../domino-linux.gif){kind=small}
![[Nash!Com]](../nashcom.gif){kind=small}
![[Daniel Nashed]](../daniel-nsh.gif){kind=small}