Skip to content

Commit 7c963da

Browse files
martinydemartinyde
authored
Merge pull request #361 from itk-dev/feature/2270-setup-local-OIDC
feature/2270 setup local OIDC
2 parents c289b0a + 56e09fc commit 7c963da

File tree

7 files changed

+149
-9
lines changed

7 files changed

+149
-9
lines changed

‎.docker/oidc-server-mock/cert/docker.pfx‎

2.44 KB
Binary file not shown.

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ Versioning](https://semver.org/spec/v2.0.0.html).
88

99
## [Unreleased]
1010

11+
- [PR-361](https://github.com/itk-dev/os2loop/pull/361)
12+
Added local OIDC server-mock
13+
1114
## [1.1.1]
1215

1316
- [PR-360](https://github.com/itk-dev/os2loop/pull/360)

‎config/sync/openid_connect.client.generic.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
uuid: 398e2246-b9c9-4721-8036-28076d5028c8
2-
langcode: en
2+
langcode: da
33
status: true
44
dependencies: { }
55
id: generic
66
label: generic
77
plugin: generic
88
settings:
9-
client_id: "file:///settings.local.php#$config['openid_connect.client.generic']['settings']['client_id']"
10-
client_secret: "file:///settings.local.php#$config['openid_connect.client.generic']['settings']['client_secret']"
9+
client_id: client-id
10+
client_secret: '[client-secret]'
11+
iss_allowed_domains: ''
1112
issuer_url: ''
12-
authorization_endpoint: "file:///settings.local.php#$config['openid_connect.client.generic]['settings']['client_id']"
13-
token_endpoint: "file:///settings.local.php#$config['openid_connect.client.generic]['settings'][token_endpoint']"
13+
authorization_endpoint: 'https://idp-citizen.os2loop.local.itkdev.dk/connect/authorize'
14+
token_endpoint: 'https://idp-citizen.os2loop.local.itkdev.dk/connect/token'
1415
userinfo_endpoint: ''
15-
end_session_endpoint: ''
16+
end_session_endpoint: 'https://idp-citizen.os2loop.local.itkdev.dk/connect/endsession'
1617
scopes:
1718
- openid
18-
- email

‎config/sync/openid_connect.settings.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ connect_existing_users: true
33
override_registration_settings: true
44
end_session_enabled: true
55
user_login_display: above
6-
redirect_login: ''
7-
redirect_logout: ''
6+
redirect_login: 'http://os2loop.local.itkdev.dk/user/login'
7+
redirect_logout: 'http://os2loop.local.itkdev.dk/user/logout'
88
userinfo_mappings:
99
timezone: zoneinfo
1010
os2loop_user_family_name: family_name

‎config/sync/os2loop_user_login.settings.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
show_drupal_login: 0
2+
show_oidc_login: 1
3+
default_login_method: ''
4+
hide_logout_menu_item: 0

‎docker-compose.override.yml‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,123 @@ services:
1818
environment:
1919
# Match PHP_MAX_EXECUTION_TIME above
2020
- NGINX_FASTCGI_READ_TIMEOUT=300
21+
22+
idp-citizen:
23+
image: ghcr.io/soluto/oidc-server-mock:0.8.6
24+
profiles:
25+
- oidc
26+
- test
27+
# Let this container be accessible both internally and externally on the same domain.
28+
container_name: idp-citizen.${COMPOSE_DOMAIN}
29+
networks:
30+
- app
31+
- frontend
32+
ports:
33+
# https://github.com/Soluto/oidc-server-mock?tab=readme-ov-file#https
34+
# - '80'
35+
- '443'
36+
volumes:
37+
- .:/tmp/config:ro
38+
labels:
39+
- "traefik.enable=true"
40+
- "traefik.docker.network=frontend"
41+
- "traefik.http.routers.${COMPOSE_PROJECT_NAME}_idp-citizen.rule=Host(`idp-citizen.${COMPOSE_DOMAIN}`)"
42+
- "traefik.http.services.${COMPOSE_PROJECT_NAME}_idp-citizen.loadbalancer.server.port=443"
43+
- "traefik.http.services.${COMPOSE_PROJECT_NAME}_idp-citizen.loadbalancer.server.scheme=https"
44+
- "traefik.http.routers.${COMPOSE_PROJECT_NAME}_idp-citizen.middlewares=redirect-to-https"
45+
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
46+
47+
environment:
48+
# https://github.com/Soluto/oidc-server-mock?tab=readme-ov-file#https
49+
ASPNETCORE_URLS: https://+:443;http://+:80
50+
ASPNETCORE_Kestrel__Certificates__Default__Password: mock
51+
ASPNETCORE_Kestrel__Certificates__Default__Path: /tmp/config/.docker/oidc-server-mock/cert/docker.pfx
52+
53+
ASPNETCORE_ENVIRONMENT: Development
54+
SERVER_OPTIONS_INLINE: |
55+
AccessTokenJwtType: JWT
56+
Discovery:
57+
ShowKeySet: true
58+
Authentication:
59+
CookieSameSiteMode: Lax
60+
CheckSessionCookieSameSiteMode: Lax
61+
62+
LOGIN_OPTIONS_INLINE: |
63+
{
64+
"AllowRememberLogin": false
65+
}
66+
67+
LOGOUT_OPTIONS_INLINE: |
68+
{
69+
"AutomaticRedirectAfterSignOut": true
70+
}
71+
72+
CLIENTS_CONFIGURATION_INLINE: |
73+
- ClientId: client-id
74+
ClientSecrets: [client-secret]
75+
Description: Mock IdP
76+
AllowedGrantTypes:
77+
# - client_credentials
78+
# - implicit
79+
- authorization_code
80+
# https://github.com/Soluto/oidc-server-mock/issues/46#issuecomment-704963181
81+
RequireClientSecret: false
82+
AllowAccessTokensViaBrowser: true
83+
# https://github.com/Soluto/oidc-server-mock/issues/26#issuecomment-705022941
84+
AlwaysIncludeUserClaimsInIdToken: true
85+
AllowedScopes:
86+
- openid
87+
- profile
88+
- email
89+
ClientClaimsPrefix: ''
90+
RedirectUris:
91+
- '*'
92+
# https://github.com/Soluto/oidc-server-mock/issues/60
93+
PostLogoutRedirectUris:
94+
- '*'
95+
# https://github.com/Soluto/oidc-server-mock/issues/46#issuecomment-704845375
96+
RequirePkce: false
97+
98+
# Needed to set custom claim types in "profile"
99+
# https://github.com/Soluto/oidc-server-mock/issues/123#issuecomment-1427129278
100+
# https://github.com/Soluto/oidc-server-mock/blob/master/README.md#simple-configuration
101+
# https://docs.docker.com/compose/compose-file/compose-file-v3/#environment
102+
OVERRIDE_STANDARD_IDENTITY_RESOURCES: 'true'
103+
IDENTITY_RESOURCES_INLINE: |
104+
# https://auth0.com/docs/get-started/apis/scopes/openid-connect-scopes#standard-claims
105+
- Name: openid
106+
ClaimTypes:
107+
- sub
108+
- Name: email
109+
ClaimTypes:
110+
- email
111+
- Name: profile
112+
ClaimTypes:
113+
# Add your custom claims here
114+
- dk_ssn
115+
- name
116+
- email
117+
- zip
118+
- uuid
119+
120+
USERS_CONFIGURATION_INLINE: |
121+
- SubjectId: 1
122+
Username: citizen1
123+
Password: citizen1
124+
Claims:
125+
# Claims added here must be defined above in IDENTITY_RESOURCES_INLINE
126+
- Type: dk_ssn
127+
Value: '1111111111'
128+
ValueType: string
129+
- Type: name
130+
Value: 'Anders And'
131+
ValueType: string
132+
- Type: email
133+
Value: [email protected]
134+
ValueType: string
135+
- Type: zip
136+
Value: '1111'
137+
ValueType: string
138+
- Type: uuid
139+
Value: '11111111-1111-1111-1111-111111111111'
140+
ValueType: string

‎patches/guzzle-with-self-signed-certificate.patch‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
diff --git a/web/modules/contrib/openid_connect/src/Plugin/OpenIDConnectClientBase.php b/web/modules/contrib/openid_connect/src/Plugin/OpenIDConnectClientBase.php
2+
index f70effe8..4c9cec4a 100644
3+
--- a/web/modules/contrib/openid_connect/src/Plugin/OpenIDConnectClientBase.php
4+
+++ b/web/modules/contrib/openid_connect/src/Plugin/OpenIDConnectClientBase.php
5+
@@ -341,6 +341,9 @@ protected function getRequestOptions(string $authorization_code, string $redirec
6+
'headers' => [
7+
'Accept' => 'application/json',
8+
],
9+
+ // We use a self-signed certificate for development.
10+
+ // https://docs.guzzlephp.org/en/stable/request-options.html?highlight=verify#verify
11+
+ \GuzzleHttp\RequestOptions::VERIFY => FALSE,
12+
];
13+
}

0 commit comments

Comments
 (0)