$docker pull openidentityplatform/openam
$docker run -h openam-01.domain.com -p 8080:8080 --name openam-01 openidentityplatform/openam

$docker container lsCONTAINER ID        IMAGE                         COMMAND                  CREATED             STATUS              PORTS                    NAMES
91d60b3e3538        openidentityplatform/openam   "/usr/local/tomcat/b…"   2 hours ago         Up 2 hours          0.0.0.0:8080->8080/tcp   openam-01

{"response_types_supported":["code token id_token","code","code id_token","id_token","code token","token","token id_token"],"claims_parameter_supported":false,"end_session_endpoint":"http://localhost:8080/openam/oauth2/connect/endSession","version":"3.0","check_session_iframe":"http://localhost:8080/openam/oauth2/connect/checkSession","scopes_supported":["address","phone","openid","profile","email"],"issuer":"http://localhost:8080/openam/oauth2","id_token_encryption_enc_values_supported":["A256GCM","A192GCM","A128GCM","A128CBC-HS256","A192CBC-HS384","A256CBC-HS512"],"acr_values_supported":[],"authorization_endpoint":"http://localhost:8080/openam/oauth2/authorize","userinfo_endpoint":"http://localhost:8080/openam/oauth2/userinfo","device_authorization_endpoint":"http://localhost:8080/openam/oauth2/device/code","claims_supported":["zoneinfo","address","profile","name","phone_number","given_name","locale","family_name","email"],"id_token_encryption_alg_values_supported":["RSA-OAEP","RSA-OAEP-256","A128KW","RSA1_5","A256KW","dir","A192KW"],"jwks_uri":"http://localhost:8080/openam/oauth2/connect/jwk_uri","subject_types_supported":["public"],"id_token_signing_alg_values_supported":["ES384","HS256","HS512","ES256","RS256","HS384","ES512"],"registration_endpoint":"http://localhost:8080/openam/oauth2/connect/register","token_endpoint_auth_methods_supported":["client_secret_post","private_key_jwt","client_secret_basic"],"token_endpoint":"http://localhost:8080/openam/oauth2/access_token"}

$ mkdir myapp
$ npx express-generator

$ ls
app.js                  node_modules            package.json            routes
bin                     package-lock.json       public                  views

extends layout

block content
  h1= title
  p Welcome to #{title}

  hoge-button
    a(href="http://localhost:3000/auth/openidconnect", target="_blank") SSO連携

varexpress=require("express");varrouter=express.Router();/* GET home page. */router.get("/",function(req,res,next){res.render("index",{title:"Express"});});module.exports=router;

// 参考:https://github.com/ForgeRock/exampleOAuth2Clients/tree/master/node-passport-openidconnect// 各モジュールをインポートvarcreateError=require("http-errors");varexpress=require("express");varpath=require("path");// sessionを使うのに求められるvarcookieParser=require("cookie-parser");varlogger=require("morgan");// pathを定義// indexにログインボタンを設置// ログイン失敗時　→　loginfail// ログイン成功時　→　login// に遷移するようにするvarindexRouter=require("./routes/index");varloginFRouter=require("./routes/loginfail");varloginRouter=require("./routes/login");varapp=express();//session有効varsession=require("express-session");app.use(session({//クッキー改ざん検証用IDsecret:"YOUR_PASSWORD",//未初期化のセッションを保存するかsaveUninitialized:false,//他にもsessionの寿命とか、httpsならsecureも設定できる}));// view engine setupapp.set("views",path.join(__dirname,"views"));app.set("view engine","jade");app.use(logger("dev"));app.use(express.json());app.use(express.urlencoded({extended:false}));app.use(cookieParser());app.use(express.static(path.join(__dirname,"public")));app.use("/",indexRouter);//追記ここからapp.use("/loginfail",loginFRouter);app.use("/login",loginRouter);//認証セクションvarpassport=require("passport");const{token}=require("morgan");varOpenidConnectStrategy=require("passport-openidconnect").Strategy;app.use(passport.initialize());app.use(passport.session());passport.use(newOpenidConnectStrategy({issuer:"http://localhost:8080/openam/oauth2",authorizationURL:"http://localhost:8080/openam/oauth2/authorize",tokenURL:"http://localhost:8080/openam/oauth2/access_token",userInfoURL:"http://localhost:8080/openam/oauth2/userinfo",clientID:"sampleRP",clientSecret:"RP_PASSWORD",callbackURL:"http://localhost:3000/oauth2callback",scope:["openid","email","profile"],},function(issuer,sub,profile,jwtClaims,accessToken,refreshToken,tokenResponse,done){//認証成功したらこの関数が実行される//ここでID tokenの検証を行うconsole.log("issuer: ",issuer);console.log("sub: ",sub);console.log("profile: ",profile);console.log("jwtClaims: ",jwtClaims);console.log("accessToken: ",accessToken);console.log("refreshToken: ",refreshToken);console.log("tokenResponse: ",tokenResponse);returndone(null,{profile:profile,accessToken:{token:accessToken,scope:tokenResponse.scope,token_type:tokenResponse.token_type,expires_in:tokenResponse.expires_in,},idToken:{token:tokenResponse.id_token,claims:jwtClaims,},});}));passport.serializeUser(function(user,done){//userにはprofileが入るdone(null,user);});passport.deserializeUser(function(obj,done){done(null,obj);});app.get("/auth/openidconnect",passport.authenticate("openidconnect"));app.get("/oauth2callback",passport.authenticate("openidconnect",{failureRedirect:"/loginfail",}),function(req,res){// Successful authentication, redirect home.console.log("認可コード:"+req.query.code);req.session.user=req.session.passport.user.displayName;res.redirect("/login");});//ここまで// catch 404 and forward to error handlerapp.use(function(req,res,next){next(createError(404));});// error handlerapp.use(function(err,req,res,next){// set locals, only providing error in developmentres.locals.message=err.message;res.locals.error=req.app.get("env")==="development"?err:{};// render the error pageres.status(err.status||500);res.render("error");});module.exports=app;

extends layout

block content
  h1= title
  p Welcome to #{title}
  p login成功！

varexpress=require("express");varrouter=express.Router();/* GET home page. */router.get("/",function(req,res,next){res.render("login",{title:"ログイン"});});module.exports=router;

extends layout

block loginfail
  block content
  h1= title
  p Welcome to #{title}
  p Login失敗

varexpress=require('express');varrouter=express.Router();/* GET home page. */router.get('/',function(req,res,next){res.render('loginfail',{title:'ログインできなかったよ'});});module.exports=router;

$lsapp.js                  node_modules            package.json            routes
bin                     package-lock.json       public                  views
$ls views 
error.jade      index.jade      layout.jade     login.jade      loginfail.jade
$ls routes 
index.js        login.js        loginfail.js

$npm start