**1. access token**  - Enhance the NJS Code to capture the `access_token` sent by the IdP.  - Store the `access_token` in the k/v store as same as we store `id_token` and `refresh_token`**2. new endpoints**  - Add `/userinfo` endpoint:    - Add a map variable of `$oidc_userinfo_endpoint` as same as authz and token endpoints here (`openid_connect_configuration.conf`) .    - Expose `/userinfo` endpoint here(`openid_connect.server_conf`) in a location block of NGINX Plus to interact with IdP's `userinfo_endpoint` which is defined in the endpoint of`well-known/openid-configuration`.    - The nginx location block should proxy to the IdP’s `userinfo_endpoint` by adding `access_token` as a bearer token.      ```      Authorization : Bearer <access_token>      ```    - The response coming from IdP should be returned back to the caller as it is.  - Expose `/login` endpoint:    - Expose the `/login` endpoint as a location block here (`openid_connect.server_conf`)    - Proxy it to the IdP's `authorization_endpoint` configured in the map variable of `$oidc_authz_endpoint` in (`openid_connect_configuration.conf`).    - This would outsource the login function to IdP as its configured.  - Expose `/v2/logout` endpoint:    - Expose the `/v2/logout` endpoint as a location block here (`openid_connect.server_conf`)    - Add a map variable of `$oidc_end_session_endpoint` as same as authz and token endpoints here (`openid_connect_configuration.conf`) .    - Proxy it to the IdP's `end_session_endpoint` to finish the session by IdP.  - Expose `/v2/_logout` endpoint:    - Expose `/v2/_logout` endpoint which is a callback from IdP as a location block here (`openid_connect.server_conf`) to handle the following sequences.      - 1. Redirected by IdP when IdP successfully finished the session.      - 2. NGINX Plus: Clear session cookies.      - 3. NGINX Plus: Redirect to either the original landing page or the custom logout page by calling    - Add a map of `$post_logout_return_uri`: After the successful logout from the IdP, NGINX Plus calls this URI to redirect to either the original page or a custom logout page. The default is original page based on the configuration of `$redirect_base`.**3. add endpoints in `configure.sh`**  - IdP's userinfo endpoint  - IdP's end session endpoint

…-endpointsfeat: access token & new endpoints (/login, /userinfo, /v2/logout)

added doctoc for automatic toc creationbroke getting started info out into new doc

pmoghef5 left a comment