OIDC Authorization Flow

1: Unauthorized User --------redirect--------> Authorization Endpoint
2: Callback View    <--------redirect--------  Authorization Endpoint
3: OIDC Plugin      <-------client call------> Token Endpoint
4: OIDC Plugin      <-------client call------> JWKS Endpoint
5: Validation of Token using the matching JWK
6: OIDC Plugin      <-------client call------> User Info Endpoint
7: Provision user in Plone

Configuration

Once a plugin was added it can be configured by clicking on the plugin in acl_users/manage_main.

Don’t forget to add the plugin as the first to be challenged:

• go to route: http://localhost:8080/Plone/acl_users/plugins/manage_plugins

• go to Challenge Plugins

• activate your freshly added plugin and move to the top

Properties Mapping holds the information how to map userinformation. It has to be valid json like:

{
    "plone_property1": "oidc_property1",
    "plone_property2": "oidc_property2",
    ...
}

The Properties Mapping must contain the Plone property userid.