Merge pull request #197 from c00kiemon5ter/feature-oidc-backend-verify-ssl

Add verify_ssl option to OIDC backend

Author: c00kiemon5ter

example/plugins/backends/openid_backend.yaml.example

@@ -4,6 +4,7 @@ config:
   provider_metadata:
     issuer: https://op.example.com
   client:
+    verify_ssl: yes
     auth_req_params:
       response_type: code
       scope: [openid, profile, email, address, phone]

src/satosa/backends/openid_connect.py

@@ -52,7 +52,11 @@ def __init__(self, auth_callback_func, internal_attributes, config, base_url, na
         super().__init__(auth_callback_func, internal_attributes, base_url, name)
         self.auth_callback_func = auth_callback_func
         self.config = config
-        self.client = _create_client(config["provider_metadata"], config["client"]["client_metadata"])
+        self.client = _create_client(
+            config["provider_metadata"],
+            config["client"]["client_metadata"],
+            config["client"].get("verify_ssl", True),
+        )
         if "scope" not in config["client"]["auth_req_params"]:
             config["auth_req_params"]["scope"] = "openid"
         if "response_type" not in config["client"]["auth_req_params"]:
@@ -230,7 +234,7 @@ def get_metadata_desc(self):
         return get_metadata_desc_for_oauth_backend(self.config["provider_metadata"]["issuer"], self.config)
 
 
-def _create_client(provider_metadata, client_metadata):
+def _create_client(provider_metadata, client_metadata, verify_ssl=True):
     """
     Create a pyoidc client instance.
     :param provider_metadata: provider configuration information
@@ -240,7 +244,9 @@ def _create_client(provider_metadata, client_metadata):
     :return: client instance to use for communicating with the configured provider
     :rtype: oic.oic.Client
     """
-    client = oic.Client(client_authn_method=CLIENT_AUTHN_METHOD)
+    client = oic.Client(
+        client_authn_method=CLIENT_AUTHN_METHOD, verify_ssl=verify_ssl
+    )
 
     # Provider configuration information
     if "authorization_endpoint" in provider_metadata: