|
| 1 | +# OIDC Connect |
| 2 | + |
| 3 | +The Helper has an authentication layer that let you configure your Open ID provider, so your users can use an SSO to authenticate to the Helper application. |
| 4 | + |
| 5 | +## Configuration |
| 6 | + |
| 7 | +First of all, you need to configure this environment variables: |
| 8 | + |
| 9 | +```env |
| 10 | +OIDC_CLIENT_ID= |
| 11 | +OIDC_CLIENT_SECRET= |
| 12 | +OIDC_DISCOVERY_ENDPOINT= |
| 13 | +OIDC_REDIRECT_URI="${APP_URL}/oidc/callback" |
| 14 | +OIDC_REALM="myrealm" |
| 15 | +OIDC_URL_AUTHORIZE="${OIDC_DISCOVERY_ENDPOINT}/realms/${OIDC_REALM}/protocol/openid-connect/auth" |
| 16 | +OIDC_URL_ACCESS_TOKEN="${OIDC_DISCOVERY_ENDPOINT}/realms/${OIDC_REALM}/protocol/openid-connect/token" |
| 17 | +OIDC_URL_RESOURCE_OWNER_DETAILS="${OIDC_DISCOVERY_ENDPOINT}/realms/${OIDC_REALM}/protocol/openid-connect/userinfo" |
| 18 | +OIDC_SCOPE="openid" |
| 19 | +``` |
| 20 | + |
| 21 | +> Those variables can be found in the `.env.example` file |
| 22 | +
|
| 23 | +|Key|Description| |
| 24 | +|--|---| |
| 25 | +|OIDC_CLIENT_ID|The OIDC client id| |
| 26 | +|OIDC_CLIENT_SECRET|The OIDC client secret| |
| 27 | +|OIDC_DISCOVERY_ENDPOINT|The OIDC provider base url| |
| 28 | +|OIDC_REDIRECT_URI|The url used by the helper as a callback for OIDC connect, **DON'T CHANGE**| |
| 29 | +|OIDC_REALM|The OIDC provider REALM name| |
| 30 | +|OIDC_URL_AUTHORIZE|The url used to authorize your users| |
| 31 | +|OIDC_URL_ACCESS_TOKEN|The url used to get the access token| |
| 32 | +|OIDC_URL_RESOURCE_OWNER_DETAILS|The ur used to get the authenticated user details| |
| 33 | +|OIDC_SCOPE|The scopes that will be used to get information for your authenticated user. Separated by comma (,)| |
| 34 | + |
| 35 | +## Example - Keycloak |
| 36 | + |
| 37 | +In this example we will use the Keycloak Docker image, but feel free to use another OIDC provider. |
| 38 | + |
| 39 | +1. Follow the steps in the Keycloak documentation, here: [https://www.keycloak.org/getting-started/getting-started-docker](https://www.keycloak.org/getting-started/getting-started-docker) |
| 40 | +2. Configure the environment variables, in your `.env` file: |
| 41 | + |
| 42 | +```env |
| 43 | +OIDC_CLIENT_ID="YOUR_CLIENT_ID" |
| 44 | +OIDC_CLIENT_SECRET="YOUR_CLIENT_SECRET" |
| 45 | +OIDC_DISCOVERY_ENDPOINT="http://localhost:8080" |
| 46 | +OIDC_REDIRECT_URI="${APP_URL}/oidc/callback" |
| 47 | +OIDC_REALM="YOUR_OIDC_REALM" |
| 48 | +OIDC_URL_AUTHORIZE="${OIDC_DISCOVERY_ENDPOINT}/realms/${OIDC_REALM}/protocol/openid-connect/auth" |
| 49 | +OIDC_URL_ACCESS_TOKEN="${OIDC_DISCOVERY_ENDPOINT}/realms/${OIDC_REALM}/protocol/openid-connect/token" |
| 50 | +OIDC_URL_RESOURCE_OWNER_DETAILS="${OIDC_DISCOVERY_ENDPOINT}/realms/${OIDC_REALM}/protocol/openid-connect/userinfo" |
| 51 | +OIDC_SCOPE="openid" |
| 52 | +``` |
| 53 | + |
| 54 | +3. Make sure in your administration **General settings** you have enabled `Enable OIDC login?` flag: |
| 55 | + |
| 56 | + |
| 57 | + |
| 58 | +4. Your users can now click the button **OIDC Connect** in the login page: |
| 59 | + |
| 60 | + |
| 61 | + |
| 62 | +> Feel free to customize your login page, by enabling / disabling login sections: |
| 63 | +> - Form login |
| 64 | +> - Social login |
| 65 | +> - OIDC login |
| 66 | +
|
0 commit comments