doda-sentry-auth-oidc 9.1.0

OpenID Connect authentication provider for Sentry

An SSO provider for Sentry which enables OpenID Connect Apps authentication.

This is a fork of sentry-auth-google.

Why fork, instead of adapting sentry-auth-google to work with every OpenID Connect provider?

The maintainer has different ideas with sentry-auth-google. See:

• https://github.com/getsentry/sentry-auth-google/pull/29

• https://github.com/getsentry/sentry/issues/5650

Install

$ pip install doda-sentry-auth-oidc

Example Setup for Google

Start by creating a project in the Google Developers Console.

In the Authorized redirect URIs add the SSO endpoint for your installation:

https://sentry.example.com/auth/sso/

Naturally other providers, that are supporting OpenID-Connect can also be used (like GitLab).

Finally, obtain the API keys and the well-known account URL and plug them into your sentry.conf.py:

OIDC_CLIENT_ID = ""

OIDC_CLIENT_SECRET = ""

OIDC_SCOPE = "openid email"

OIDC_PKCE_ENABLED = False  # Set to True to use PKCE with S256

OIDC_DOMAIN = "https://accounts.google.com"  # e.g. for Google

The OIDC_DOMAIN defines where the OIDC configuration is going to be pulled from. Basically it specifies the OIDC server and adds the path .well-known/openid-configuration to it. That’s where different endpoint paths can be found.

Detailed information can be found in the ProviderConfig specification.

You can also define OIDC_ISSUER to change the default provider name in the UI, even when the OIDC_DOMAIN is set.

Set OIDC_PKCE_ENABLED = True to enable PKCE using the S256 code challenge method. Leave it disabled to preserve OAuth 2.0 compatibility with providers that do not support PKCE.

If your provider doesn’t support the OIDC_DOMAIN, then you have to set these required endpoints by yourself (autorization_endpoint, token_endpoint, userinfo_endpoint, issuer).

OIDC_AUTHORIZATION_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth"  # e.g. for Google

OIDC_TOKEN_ENDPOINT = "https://www.googleapis.com/oauth2/v4/token"  # e.g. for Google

OIDC_USERINFO_ENDPOINT = "https://www.googleapis.com/oauth2/v3/userinfo" # e.g. for Google

OIDC_ISSUER = "Google"

Development

FAQ

• If you are using macOS brew’s openssl and you get a psycopg build error such as:

  ld: library not found for -lssl

  Please setup the following environment variables:

  export LDFLAGS="-L/usr/local/opt/openssl/lib"
  export CPPFLAGS="-I/usr/local/opt/openssl/include"