The Agence Nationale de la Sécurité des Systèmes d’Information (ANSSI) is a French Agency for the Security of Information Systems.
They published a document to securize OpenID Connect. It contains around fifty recommandations to strengthen your OIDC service, as OpenID provider or relying party.
We describe here how to configure LemonLDAP::NG to match the majority of these recommandations. You can find the list at the end of the page (in French language, as the original document).
A lot of recommandations are built-in features of LemonLDAP::NG, so there is nothing to configure to respect them:
Some other are not directly related to LemonLDAP::NG, but come with a correct configuration of the web server or the global infrastructure:
This is the default configuration, be sure to not enable Implicit or Hybrid flows in OpenID Connect Service > Security.
You need to fix the access mode for each relying party in Options > Security > Require JWS for authorization requests
Require the state parameter in Options > Security > Require "state" in authorization request
Require the nonce parameter in Options > Security > Require "nonce" in authorization request
The default value is already quite low (1 minute) but you can still change it in OpenID Connect Service > Timeouts > Authorization Codes. You can configure timeouts for other tokens too.
Enable hashed session in General Parameters > Advanced parameters > Security > Hashed session storage
Require JWS authentication on token endpoint in Options > Security > Token endpoint authentication method You can also enforce this for userinfo endpoint.
Configure the log level to info or notice (access tokens can be seen in debug level).
Use a random value for client_secret (for example with command pwgen)
There is no automatic renewal of client_secret, you need to plan it on your side.
Simple. Just be sure to have different client_secret values for each configured relying party.
Quite simple. Be sure your manager is well protected, and your configuration backend too.
Forbid the use of HS algorithms, prefer those with public/private keys. You can configure the algorithm of JWS (ID Token, and if configured as JWT, access token and userinfo) in Options > Algorithms.
Configuration metadata are available anonymously, you can disable access in OpenID Connect Service > Security > Don't display metadata
This is the defaut configuration, be sure to keep this disabled in OpenID Connect Service > Dynamic registration > Activation
Set method and algoroithm in Options > Protocol > Authentication method for authorization code request and Signature algorithm for authorization code authentication. Forbid the use of HS algorithms, prefer those with public/private keys.
This is the default configuration, check it in Options > Protocol > Use nonce
Set authentication on token endpoint in Options > Protocol > Token endpoint authentication method, prefer JWS authentication method.
Configure the log level to info or notice (access tokens can be seen in debug level).
Quite simple. Be sure your manager is well protected, and your configuration backend too.
