Install

Install oidc provider in the same virtual environment as endi.

$VENV/bin/pip install endi_oidc_provider

Configure your development.ini file

• Ensure the paths to the session files :

  • session.data_dir : path on disk

  • session.lock_dir : path on disk

• Set the connection uri for database access :

  • sqlalchemy.url : the mysql uri to access endi’s database

• Configure oidc specific keys (unique salt and oidc endpoint url ):

  • oidc.salt : a unique salt used for encryption

  • oidc.issuer_url : url of the oidc endpoint (like https://myendi.coop/oidc)

Start the service

• $VENV/bin/pserve development.ini

Client’s key

You can generate a Client private key through command-line or through the administration panel https://myendi.coop/admin/oidc/

oidc-manage <config_uri> clientadd --client=<client> --uri=<redirect_uri> --scopes=<scopes> --cert_salt=<cert_salt> --logout_uri=<logout_uri> --admin_email=<admin_email>

• config_uri : Your ini file

• client: A label for your client

• redirect_uri : The redirect uri has described in the openid connect specifications (The one passed in the Authorize step)

• scopes : The scope the application is requesting (at least the openid scope should be provided) e.g: “openid profile”

• cert_salt : A salt random key that will be used to encrypt the client secret in the database

• logout_uri : The uri to call on global logout (will be called through iframes)

• admin_email: The e-mail of the consumers administrator

After generating both client_id and client_secret. The client app is able to request authentication. The client secret and client id should be pased to the consumer’s admin, they are mandatory to allow the oidc authentication/authorization.