First things first, screen-cast that follows this write up is based on the ForgeRock documentation on OpenIG that’s found here. Secondly, if you aren’t familiar with ForgeRock OpenIG or ForgeRock OpenAM, I’d recommend you to do some reading on the products from the official ForgeRock documentation or watch the following screen-casts on it to become familiarized with it:
ForgeRock OpenIG
– ForgeRock OpenIG Installation
– ForgeRock OpenIG: Getting Credentials from a File Data Store
– ForgeRock OpenIG: Getting Credentials from a JDBC Data Store
– ForgeRock OpenIG: Getting Credentials from ForgeRock OpenAM
ForgeRock OpenAM
– ForgeRock OpenAM Installation & Configuration
– Creating Realm in OpenAM and Setting Up OpenDJ as a Data Store
– ForgeRock OpenAM Authentication With Google Account Using OAuth2
– ForgeRock OpenAM High Availability Deployment
– Configuring Database as OpenAM Log Type
– ForgeRock OpenAM 12: Switching from XUI to Legacy UI
– Adding User Profile Attribute in ForgeRock OpenAM
Cut to present, we have OpenIG acting as a resource server. So in the video log, you’ll see the curl command being used to contact OpenAM to get an Access Token, use the same command to contact OpenIG with the Access Token, which is when OpenIG (acting as a resource server), will contact OpenAM (acting as an authorization server) for validating the token. Once validated, OpenIG will apply additional filters to post the credentials to a HTTP Server and get the user profile in response to it. A one-liner definition for the mouthful of jargon I used above can be found here. The illustration below might make the long story said above slightly shorter.
Now to the real action: