OpenID Connect Authenticator
 | Allow an XWiki instance to authenticate on an OpenID Connect provider |
| Type | JAR |
| Category | Authenticator |
| Developed by | |
| Active Installs | 56 |
| Rating | |
| License | GNU Lesser General Public License 2.1 |
Table of contents
Description
Allow an XWiki instance to authenticate on an OpenId Connect provider. It also automatically synch
See also OpenID Connect Provider.
Release notes can be found on OpenID Connect project page.
Main limitations
Configuration
xwiki.cfg
xwiki.authentication.authclass=org.xwiki.contrib.oidc.auth.OIDCAuthServiceImpl
xwiki.properties
#-# See following endpoints properties if the provider is not an XWiki instance.
#-# If not indicated, it will be asked to the user.
# oidc.xwikiprovider=https://xwikiorg-node1.xwikisas.com/xwiki/oidc
#-# The generic OpenId Connect endpoints to use to communicate with the provider.
#-# Not needed in case of XWiki based provider.
# oidc.endpoint.authorization=https://xwikiorg-node1.xwikisas.com/xwiki/oidc/authorization
# oidc.endpoint.token=https://xwikiorg-node1.xwikisas.com/xwiki/oidc/token
# oidc.endpoint.userinfo=https://xwikiorg-node1.xwikisas.com/xwiki/oidc/userinfo
#-# The pattern to use to generate the XWiki user name.
#-#
#-# The following variables are available:
#-# oidc.user.subject: the unique id of the user in the provider
#-# oidc.user.mail: the mail of the user
#-# oidc.user.familyName : the last name of the user
#-# oidc.user.givenName: the first name of the user
#-# oidc.user.preferredUsername: the recommended string to use as id for the user
#-# oidc.provider: the URL of the XWiki provider (only when a XWiki provider is used)
#-# oidc.provider.host: the host of the provider URL
#-# oidc.provider.path: the path of the provider URL
#-# oidc.provider.protocol: the protocol (usually https) of the provider URL
#-# oidc.provider.port: the port of the provider URL
#-# oidc.issuer: the issuer URI
#-# oidc.issuer.host: the host of the issuer URI
#-# oidc.issuer.path: the path of the issuer URI
#-# oidc.issuer.scheme: the scheme (usually https) of the issuer URI
#-# oidc.issuer.port: the port of the issuer URI
#-#
#-# The following suffixes can be used:
#-# * ".lowerCase": the lower case version of the string
#-# * ".upperCase": the upper case version of the string
#-# * ".clean": a version of the string stripped from ".", ":", ",", "@", "^" characters and "\s" (all forms of white spaces).
#-# It can itself be suffixed with ".lowerCase" and ".uperCase".
#-#
#-# The default is:
# oidc.user.nameFormater=${oidc.issuer.host.clean}-${oidc.user.preferredUsername.clean}
#-# The pattern to use to generate the unique identifier of the user in the OpenId Connect provider.
#-# It is used to avoid collisions with user have similar name.
#-#
#-# The syntax is the same than the one described for oidc.user.nameFormater property.
#-#
#-# The default is:
# oidc.user.idFormater=${oidc.user.subject}
#-# The OpenID Connect client identifier used by the authenticator.
#-#
#-# The default is the automatically generated unique id of the XWiki instance.
# oidc.idtokenclaims=xwiki_instance_id
#-# The name of the claim used to get the list of group the user belong to
#-#
#-# The default is:
# oidc.groups.claim=xwiki_groups
#-# The custom claims to request to the provider for the UserInfo
#-#
#-# The available custom claims are:
#-# xwiki_groups (or whatever you indicated in oidc.groups.claim): the groups a user belong to in the provider (see "Group synchronization" section for more details)
#-# xwiki_user_<fieldname>: the suffix to use to request any field in the user profile document (generally when the provider is XWiki)
#-# The default is:
# oidc.userinfoclaims=xwiki_user_accessibility,xwiki_user_company,xwiki_user_displayHiddenDocuments,xwiki_user_editor,xwiki_user_usertype
#-# The client identifier used by the authentication.
#-# The default is the identifier of the XWiki instance.
# oidc.clientid=
#-# Receiving a groups list is enough to enable group synchronization but you might need to configure XWiki groups names different from the remote groups names.
#-#
# oidc.groups.mapping=MyXWikiGroup=my-oidc-group
# oidc.groups.mapping=MyXWikiGroup2=my-oidc-group2
# oidc.groups.mapping=MyXWikiGroup2=my-oidc-group3
#-# The groups the user need to belong to be allowed to authenticate.
#-# Not taken into account if not set or empty.
#-#
# oidc.groups.allowed=
#-# If the user belong to one of these groups it won't be allowed to authenticate
#-#
# oidc.groups.forbidden=
#-# Disable the OpenId Connect authenticator
#-#
#-# The default is:
# oidc.skipped=false
Bypass OpenID Connect
As indicated in the previous section you can disable OpenID Connect using the property oidc.skipped in the xwiki.properties file.
It's also possible to skip OpenId Connect temporarily using a URL parameter: for example https://mydomain/xwiki/bin/view/Main/?oidc.skipped=true.
Group synchronization
The default group synchronization is enabled by adding the claim xwiki_groups to the property oidc.userinfoclaims in the xwiki.properties file.
This synchronization expect to receive the list of group names (without the `wiki:XWiki.` prefix) in which the user should should be placed (groups are automatically created when they don't exist).
It's also possible to implement your own custom group synchronization in a listener. See Listeners section.
Customization
Templates
The authenticator use a template to ask the user for the target provider when it's not provided in the configuration. This template can be overwritten trough the standard template system.
The name of the template is oidc/client/provider.vm.
Listeners
It's possible to implement an event listener and be notified during user profile update to add more to this process or do other things after it:
- org.xwiki.contrib.oidc.event.OIDCUserUpdating to modify the user profile before it being saved
- org.xwiki.contrib.oidc.event.OIDCUserUpdated to do something after the user profile has been saved
Prerequisites & Installation Instructions
We recommend using the Extension Manager to install this extension (Make sure that the text "Installable with the Extension Manager" is displayed at the top right location on this page to know if this extension can be installed with the Extension Manager).
You can also use the manual method which involves dropping the JAR file and all its dependencies into the WEB-INF/lib folder and restarting XWiki.
Once you installed the extension you will need to indicate you want to use it as authenticator with the property xwiki.authentication.authclass in xwiki.cfg file. See Configuration section for more details.
Dependencies
Dependencies for this extension (org.xwiki.contrib.oidc:oidc-authenticator 1.11.5):
- org.xwiki.platform:xwiki-platform-oldcore 8.4
- com.nimbusds:oauth2-oidc-sdk 5.44
- org.xwiki.contrib.oidc:oidc-provider 1.11.5
