Documentation

[shimt]

Documentation

[Glowsome]

@willfurnell
i am using this with a NetIQ (now called Microfocus) AccessManager and works fine.
Still fiddling around, but this gives successfull authentication :
`{
client-id: "",
client-secret: "",
redirect-url: "urn:ietf:wg:oauth:2.0:oob",
scopes: ["email"],
endpoint-auth-url: "https://your AccessManager/nidp/oauth/nam/authz",
endpoint-token-url: "https://your AccessManager/nidp/oauth/nam/token",
extra-parameters: {
acr: "saml/secure/form/password/smartphone"
},
username-format: "%s",
}
``
As you can see i have adapted the 'extra-parameter' to request a specific authentication contract from my box.
If you were to remove it it will authenticate you with the default authentication contract.

On the Accessmanager the client config is quite simple (for testing-purposes)

[alerque]

As another data point that could be documented, here is a working config file using this PAM module to connect to a Keycloak server:

{
   client-id: pam,
   client-secret: <REDACTED>,
   scopes: ["profile"],
   endpoint-token-url: "https://keycloak.example.com/auth/realms/<REALM_NAME>/protocol/openid-connect/token",
   extra-parameters: {
   },
}

This uses a custom client setup on the Keycloak end called "pam" with settings that look like this: