{"id":52026719,"url":"https://github.com/openconext/openconext-sso-query","last_synced_at":"2026-08-01T08:01:30.180Z","repository":{"id":368382912,"uuid":"1237442079","full_name":"OpenConext/OpenConext-SSO-Query","owner":"OpenConext","description":null,"archived":false,"fork":false,"pushed_at":"2026-06-30T09:54:07.000Z","size":54,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"develop","last_synced_at":"2026-06-30T11:14:00.315Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/OpenConext.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-13T07:28:37.000Z","updated_at":"2026-06-30T09:24:38.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/OpenConext/OpenConext-SSO-Query","commit_stats":null,"previous_names":["openconext/openconext-sso-query"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/OpenConext/OpenConext-SSO-Query","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenConext%2FOpenConext-SSO-Query","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenConext%2FOpenConext-SSO-Query/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenConext%2FOpenConext-SSO-Query/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenConext%2FOpenConext-SSO-Query/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/OpenConext","download_url":"https://codeload.github.com/OpenConext/OpenConext-SSO-Query/tar.gz/refs/heads/develop","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenConext%2FOpenConext-SSO-Query/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36149985,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-08-01T02:00:05.789Z","response_time":100,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-08-01T08:01:29.661Z","updated_at":"2026-08-01T08:01:30.173Z","avatar_url":"https://github.com/OpenConext.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# OC SSO Query\n\nThis Application is created to implement a SSO Query service for OpenConext. With SSO Query, a Service\nProvider is able to determine whether a user has a (potential) session with the Federation. Based on this information,\nthe Service Provider may decide next steps to take in the logging procedure. This is especially convenient to guide\nexisting users in a different manner than new users, for example guide them through the account creation process. In\ncases where the Service Provider allows multiple Identity Providers (or Federations), this functionality may help\nassessing the origin of the user, which also helps optimizing the login flow.\n\nThe SSO Query service has three types of response:\n- TRUE: the user is known to this Federation, and has an active session within this Federation\n- REMOTE: the user is known to this Federation through an SSO notification cookie, but does not have an active session currently\n- FALSE: no session found for this user within this Federation\n\nTo ensure security, the SSO Query checks a whitelist to authorize the destination URL for user redirection following the\nquery execution. The whitelist can be provided in two ways, controlled by the `application.properties` configuration:\n\n1. **Remote API (Data Services)** — Set `api.endpoint.url` to the URL of an application that returns the whitelist as\n   a JSON array of strings (e.g. `[\"https://example.com\", \"https://other.org\"]`). The service will call this endpoint\n   to retrieve the whitelist and cache the result. Optionally, an API key can be configured via `api.key.header.key`\n   and `api.key.header.value` to secure the endpoint. A cache-hash URL (`api.cacheHash.url`) can be configured to\n   detect upstream changes and invalidate the cache proactively.\n\n2. **Static file** — Leave `api.endpoint.url` empty and set `data.location` to a local JSON file containing the\n   whitelist (e.g. `file:/conf/idp.data.json`). The file must contain a JSON array of allowed origin URLs. This\n   option is useful when no external Data Services application is available. Example file content:\n\n   ```json\n   [\n     \"https://test.nl\",\n     \"https://vm.openconext.org\",\n     \"https://*.vm.openconext.org\"\n   ]\n   ```\n\n   Wildcard entries (e.g. `https://*.vm.openconext.org`) are supported when `host.wildcard.enabled=true` is set,\n   and will match any single subdomain level (e.g. `https://foo.vm.openconext.org`).\n\nIn both cases the whitelist is cached in memory and refreshed automatically.\n\nTo handle increased load of the OC SSO Query service without interfering with the regular authentication a\nmicroservice is created to handle only the OC SSO Queries.\n\n## Development\n\nFor development you can start the Spring Boot application from the root of the project using:\n\n    mvn clean install \u0026\u0026 ./run.sh\n\nYou can access the service by using (for example) Chrome Poster.\n\n- /sso/ssoquery (you'll need to add an \"response_url\" to the URL query, not the header, e.g.\n  ?response_url=https://test.vm.openconext.org). Optionally the JSON flag can also be set (\u0026format=json).\n- /actuator/health\n- /actuator/info\n\nThese example requests can be executed in the browser as following:\n\n- http://localhost:8080/sso/ssoquery?response_url=https%3A%2F%2Ftest.vm.openconext.org\u0026format=json\n- http://localhost:8080/sso/ssoquery?response_url=https%3A%2F%2Ftest.vm.openconext.org\n- http://localhost:8080/actuator/health\n- http://localhost:8080/actuator/info\n\nTo make use of the SSO Query microservice, it needs to run on the same domain as the Federation. On a development\nenvironment this can be done by adding a domain name to your hosts file and point it towards the running Spring Boot /\nDocker instance. E.g. for MacOS, the following line can be added:\n\n    127.0.0.1 ssoquery.vm.openconext.org\n\nSince the SSO Query service is now able to access the cookies set by the Federation, it can respond based on the\navailability and the values of these cookies.\n\n## Installation Manual\n\n[Installation Manual](release/src/site/markdown/docs/installation-manual.md)\n\n## External resources\n\n* \u003chttps://developers.wiki.kennisnet.nl/index.php?title=KNF:Hoofdpagina\u003e - Public developers Wiki\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenconext%2Fopenconext-sso-query","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fopenconext%2Fopenconext-sso-query","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenconext%2Fopenconext-sso-query/lists"}