ophix-auth-oidc
Sign in to your fleet with the SSO you already have — not one more password to manage.
Every extra login system is one more account to provision, one more to deprovision when someone leaves, and one more place credentials can go stale. ophix-auth-oidc lets any Ophix server authenticate against your existing OpenID Connect provider — Azure AD included, with a one-variable shortcut — so staff sign in the same way they sign in everywhere else, and group membership alone decides who gets admin access.
Activated automatically when OIDC_RP_CLIENT_ID is set in .env. Provides
OphixOIDCBackend with group claim merging, user auto-provisioning, and
staff/superuser mapping from group membership.
Installation
pip install ophix-auth-oidc
Configuration (.env)
| Variable | Default | Purpose |
|---|---|---|
OIDC_RP_CLIENT_ID |
— | OAuth2 client ID — setting this activates the plugin |
OIDC_RP_CLIENT_SECRET |
— | OAuth2 client secret |
OIDC_RP_SIGN_ALGO |
RS256 |
Token signing algorithm |
OIDC_OP_AUTHORIZATION_ENDPOINT |
— | Provider authorisation endpoint URL |
OIDC_OP_TOKEN_ENDPOINT |
— | Provider token endpoint URL |
OIDC_OP_USER_ENDPOINT |
— | Provider userinfo endpoint URL |
OIDC_OP_JWKS_ENDPOINT |
— | Provider JWKS endpoint URL |
OIDC_AZURE_TENANT_ID |
— | Azure AD tenant ID — sets all four endpoint URLs automatically |
OIDC_STAFF_GROUP_ID |
— | Group claim value that grants is_staff=True |
OIDC_SUPERUSER_GROUP_ID |
— | Group claim value that grants is_superuser=True |
Azure AD shortcut
Set only OIDC_AZURE_TENANT_ID and all four endpoint URLs are derived automatically
from the Microsoft identity platform — no need to configure them individually.
Notes
- OIDC and LDAP (
ophix-auth-ldap) can be active simultaneously — OIDC handles the SSO redirect flow, LDAP handles the admin username/password form. - Falls back gracefully if
mozilla-django-oidcis not installed — a warning is logged and the plugin has no effect.
1 maintainer
Metadata
1 maintainer
Release files for ophix-auth-oidc 2026.10.4.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| ophix_auth_oidc-2026.10.4.1.tar.gz | 10.5 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| ophix_auth_oidc-2026.10.4.1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 20.1 kB
Release files / ophix_auth_oidc-2026.10.4.1.tar.gz
| Download URL | ophix_auth_oidc-2026.10.4.1.tar.gz |
|---|---|
| Size | 10.5 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
023070d2dba5838daeab0bc4c8a269ec0164b426554ab81c6651602e35e673b1
|
|
BLAKE2b-256 checksum How to use checksums |
dbb6077cd62f9efb2277491f63362281fd77b931ed36a6ee4c98bff25217d22d
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.14.3
|
Release files / ophix_auth_oidc-2026.10.4.1-py3-none-any.whl
| Download URL | ophix_auth_oidc-2026.10.4.1-py3-none-any.whl |
|---|---|
| Size | 9.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
09254a6982784887698c7a95e207df837e530fc0287aa71e00c1aee67ce4afb3
|
|
BLAKE2b-256 checksum How to use checksums |
1fa7273e40d944e35e38c8b609fc6417d918336a80e4b9cbd17c85988d2c7104
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.14.3
|
