endi-oidc-provider 6.3.1

Getting Started

$VENV/bin/pip install endi_oidc_provider

enDI integration

In your enDI’s ini file add the following :

pyramid.includes =
                    ...
                    endi_oidc_provider
                    ...

That’s for model registration so that the db startup initialize the tables.

And add the following :

endi.includes =
                    ...
                    endi_oidc_provider.plugin
                    ...

It adds an administration panel to manage the oidc consumers that access the API.

Authorization handling

Client’s key

You can generate a Client private key through command-line or through the administration panel https://myendi.coop/admin/oidc/

oidc-manage <config_uri> clientadd --client=<client> --uri=<redirect_uri> --scopes=<scopes> --cert_salt=<cert_salt> --logout_uri=<logout_uri> --admin_email=<admin_email>

• config_uri : Your ini file

• client: A label for your client

• redirect_uri : The redirect uri has described in the openid connect specifications (The one passed in the Authorize step)

• scopes : The scope the application is requesting (at least the openid scope should be provided) e.g: “openid profile”

• cert_salt : A salt random key that will be used to encrypt the client secret in the database

• logout_uri : The uri to call on global logout (will be called through iframes)

• admin_email: The e-mail of the consumers administrator

After generating both client_id and client_secret. The client app is able to request authentication. The client secret and client id should be pased to the consumer’s admin, they are mandatory to allow the oidc authentication/authorization.