Description

The example YAML file provided below contains a basic YAML configuration for an IBM® Application Gateway (IAG) container which:

1. Specifies a server certificate;
2. Configures an IBM Security Verify tenant as the identity provider using OIDC;
3. Enables the in-built credential viewer application.

Example YAML

version: "23.10"

#
# Configure an IAG container with a very basic configuration.  This 
# configuration will simply define a server certificate, configure an IBM 
# Security Verify tenant as the identity provider, and enable the inbuilt
# credential viewer application.
#

#
# Specify a server certificate to be used by the container.  The server 
# certificate was created using an openssl command:
#  openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 \
#        -out cert.pem
#
# To remove the dependency on external files a base-64 representation of the
# key.pem and cert.pem files can be embedded within this YAML, where the 
# base-64 encoded file is prefixed with 'B64:', for example: 
#   "B64:PGhy4KICAgIDxoND5...."
# 
# If no certificate is specified a self-signed certificate will be 
# automatically created and used by the container.
#

server:
  ssl:
    front_end:
      certificate: 
        - "@cert.pem"
        - "@key.pem"

  #
  # Enable the inbuilt credential viewer application.  The 'enable_html'
  # configuration entry will control whether the HTML file is enabled in
  # addition to the JSON API.  We also exclude the 'AUTHENTICATION_LEVEL' 
  # credential attribute from the response.
  #

  local_applications:
    cred_viewer:
      path_segment: "cred-viewer"
      enable_html: true
      attributes:
        - -AUTHENTICATION_LEVEL

#
# Specify an IBM Security Verify tenant as the identity provider for the 
# container.  Please note that the values provided below are for illustrative
# purposes only and don't reflect a real tenant.  A free tenant can be created 
# using the instructions found at the following URL:
#    https://www.ibm.com/us-en/marketplace/cloud-identity-for-consumers
#
# The discovery endpoint has the following format:
#    https://<tenant host>/oidc/endpoint/default/.well-known/openid-configuration
#
# The redirect URI which is used in the SSO flow is constructed from the host 
# header contained in the request, appended with '/pkmsoidc' (for example: 
# https://ibm-app-gateway.ibm.com/pkmsoidc).  This redirect URI should be
# specified when creating the custom application within the IBM Security Verify
# administrators console.
#

identity:
  oidc:
    discovery_endpoint: "https://ibm-app-gw.verify.ibm.com/oidc/endpoint/default/.well-known/openid-configuration"
    client_id: "300141b6-690b-4e4e-862d-2c96da2bb1ba"
    client_secret: "wPP8rM8N0d"