Using OpenID Connect to authenticate users

Here is the Tokens I get :

{ "access_token":"ewogICJhbGciOiJSUzI1NiIsCiAgImtpZCI6ImFkbWluIgp9.ewogICJ0b2tlbl90eXBlIjoiQmVhcmVyIiwKICAic2NvcGUiOiJteXNjb3BlIiwKICAic2NvcGVfZGF0YSI6WwogICAgewogICAgICAgICJpZCI6Im15c2NvcGUiLAogICAgICAgICJ2YWx1ZSI6ImthcmltIgogICAgfQogIF0sCiAgImlzcyI6Imh0dHBzOi8vb2F1dGgua2FiZS5sYWIiLAogICJteWNsYWltIjoia2FyaW0iLAogICJzdWIiOiIvQ29tbW9uL2thYmVfb2F1dGhfYXV0aG9yaXphdGlvbi5rYXJpbSIsCiAgImp0aSI6ImY5MTQyMGQxMDYzMmNiNmY5MTM2OGU1ODI4ZDdhNWI1YWIxZDRhYWI1ZDVmNTVlN2ZlZjY1NjBiOWFkNjQxMDIiLAogICJpYXQiOjE1MzkwODk3ODMsCiAgImV4cCI6MTUzOTA5MDA4MywKICAibmJmIjoxNTM5MDg5NDgzCn0.aTeXibnRqICbXDT84x7US6eMxx7Sdb5fDUHbpBSjvHVSKPHKRDcOoG76PTm9cOedJAH4WfgCNT1AmKE1uI0C-tUvdSPaBIpVOfLUGec9MyG2Fj1v-eeV3HoEM1RypdYvLAcGLR-AoZgbn2mca40CJPHAyw8yonpdxgNhVR3l4pzmi3xhv9hlnizNjXIG2J2qNU_2lGJfA8L2LoNKF7oEWk77_erutWKLwcuwSIdO2i5Rrr2vNahV-nxI4BG4jQXcgVJS8K4dGOe4gZwK-aBbRoliEX4DG2gLJ4t07BlvboHeHLpy7KagsRu_0yaChxqZ65l1e-zGvBjAhbu3jwAvqw", "expires_in":"300", "token_type":"Bearer", "scope":"myscope", "refresh_token":"CEJ7xkwqXJKPN8PQnnmUlRlSaI5Y6XsvIPzPq3zURuZCLn4AIak7WfasNA-ccM3Ejc1mPv6gxSAO5CgkolyQejGlw9tvIBP16y9kutn66nV7ecl7DMytO3UBQUt55RvAwfhqkyRKkjy4u5DudNOBS4wH20FfIMhM4XY3nto3yINYAewYVzpv4wIhZnZKPXRIq5qEUPhjaU-szAoLfX9aBIRmrhmGoWfgG2T3uQW7fjwfTRFzb_LkzXCi4dsAzq-WjDoBuQ4fSv6cqoRP66P9XygHODPcl0ldaOssH_oVPiXQoppKZ_I_2Bce4qcHmkobzQzZWlVvxFbnvyRCCf9-xN9PpO2d7OYzNO-2wODQEmLSHKSpnRl7Oa8A1nlDA4gZ_ks8OAz1Q0vyZgM9YcCErF1NBUN-wCTMfXBvRcNza-8z9ITDbmKlntIE9XVl9NMTHcvY1RlhLSwwsfYa67ZBSoMX67VP1DCfuD45HoBx6A3Uko4L0PxLpUkD1OzjzINTmoAy6DBlGNXnrFZXa0Aic8OHa7VIn1R0zGTfLmBybHnbZI9rN-nyhjr5vqY-HjxB-K_8X9bpmI39oWS3-eriUK1H03_M_t0VO6je3SEXK1GbgjyW2owuhZR4dBgk_eK1M9iSSiHt8Gau1bfl-9t3_prnVlrKips3aIAWIyz2q3yJLytNlejWZXTmycafdqFHerO14Dq4BG1mTcQBjeT7UBP-V3g" }

Below is my oauth configuration :

apm profile oauth /Common/kabe_ouath {
    app-service none
    audience none   
    client-apps {
        /Common/kabe_postman { }
    }
    issuer https://oauth.kabe.lab
    jwt-refresh-token-enc-key $M$Dz$pa6iJ2laNDA7DK2Lk9Lhl0yvxZWSXuUMaMOpe681aKsJaBh+u9fViazYSWYRhITn
    jwt-token enabled
    opaque-token disabled
    primary-key /Common/kabe_jwt_key
}
apm oauth oauth-client-app /Common/kabe_postman {
    app-name openid_debuger
    client-id e1111098ccff5f81859f9fc83eaa000c29267803efc0bb5b
    client-secret 7c40cd50e3a99c99caefb35d6cfa000c29267803efc0bb5b
    customization-group /Common/kabe_postman_oauth_authz_client_app_customization
    grant-code enabled
    redirect-uris { https://oidcdebugger.com/debug }
    scopes {
        /Common/kabe_scope { }
    }
}
apm oauth oauth-scope /Common/kabe_scope {
    customization-group /Common/kabe_scope_oauth_authz_scope_customization
    scope-name myscope
    scope-value "%{session.logon.last.username}"
}
apm oauth jwk-config /Common/kabe_jwt_key {
    alg-type RS256
    cert /Common/default.crt
    cert-chain /Common/default.crt
    cert-key /Common/default.key
    cert-thumbprint-sha1 nbfOLqFiwWesgPxQXUrvoCyyZBk
    cert-thumbprint-sha256 ha7lBh7DSPvDzMtboP2NJ9zcI4B8wo9oJhy8sHeng3w
    key-id admin
    modulus p6Vhksrx3oxndL1ZOBS4CoCVumA_xw4n31yftdAyeiL3NRPO-        Pa4sAopJ3S1f5joQeYLQWcxRvhp94SgeklF_BDk8gGLAjloCs1ENmCt84ktULPiItOCrHx_zsjm-dO7Dmj7RwTQahqzipLq1BN0Bqaf35jNcVOTdR1CbW2qRDGmpl407Bk9VKaHIHv17ivZW4ACWoWgyx884FTzmIr5juAEOPuJvcq_pJNctrmK6VUrumNX-uTtsHg36FGVZSVcfcZnhKOUzhwT9fD9uD1xdlmQJLbHipZM8GpKsfGm-NdnmuLiK47L9PYiEleXVOF6McT3zmj3DRW1NztnH80isw
    passphrase $M$8p$wqUeSn31SPsxWhnp4opxnA==
    public-exponent AQAB
}

Support for this only seems to start in version 14.0.0.

From the release notes:

Authorization server support for OpenID Connect

APM includes OpenID Connect support in the APM Authorization Server Framework for ID token and UserInfo generation.

We have upgraded to version 14.0.0.1 build 002 and have OAuth 2 working as an authorization server. We would like to enable OpenID in order to access ID token so we can request UserInfo attributes. Has anyone successfully enable OpenID on the F5(Provider)? Anyone have a working example?

This helped alot however be aware, in a HA pair if you use the default .crt/.key as per this config you will get sync errors, it's not immediately obvious.

https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/big-ip-access-policy-manager-oauth-configuration-14-1-0/04.html

For Certificate File, select a certificate. Important: Do not select the default certificate when the BIG-IP system is on a chassis platform or is included in an HA pair. F5 strongly discourages the use of the default certificate in a JWK in any configuration. For Certificate Key, select one. Important: Do not use the default key when the BIG-IP system is on a chassis platform or is included in an HA pair. F5 strongly discourages the use of the default key in a JWK in any configuration.

Hi,

should we create the openid scope?

I was wondering if anyone figured out why user info is not being provided to servcie provider?  I am trying to connect ESRI using open ID but keep getting user profile parameter is not received from providor.  

I know I have ESRI configured correctly because if I use google as my IDP for oauth I am able to authenticate.  

I tried to create a scope of openID in version 14.1 and said that can't be used.  

Oauth profile:
I have Opaque Token turned off
I have support for JWT Token and OpenID connect enabled

It is also strange that teh userinfo endpoint url page won't come up but that may be because you can't access it directly.

Anythoughts would be great.  Thank you