mirror of
https://github.com/wekan/wekan.git
synced 2025-12-20 09:20:12 +01:00
72 lines
2.7 KiB
Markdown
72 lines
2.7 KiB
Markdown
# salleman:oidc package
|
|
|
|
A Meteor implementation of OpenID Connect Login flow
|
|
|
|
## Usage and Documentation
|
|
|
|
Look at the `salleman:accounts-oidc` package for the documentation about using OpenID Connect with Meteor.
|
|
|
|
## Usage with e.g. authentik for updating users via oidc
|
|
|
|
To use the following features set:
|
|
'export PROPAGATE_OIDC_DATA=true'
|
|
|
|
SIMPLE: If user is assigned to 'group in authentik' it will be automatically assigned to corresponding team in wekan if exists
|
|
|
|
ADVANCED: Users can be assigned to teams or organisations via oidc on login. Teams and organisations that do not exist in wekan, yet, will be created, when specified. Admin privileges for wekan through a specific group can be set via Oidc.
|
|
See example below:
|
|
|
|
|
|
1. Specify scope in authentik for what will be delivered via userinfo["wekanGroups"]
|
|
|
|
Possible configuration for *yourScope*:
|
|
'
|
|
groupsDict = {"wekanGroups": []}
|
|
for group in request.user.ak_groups.all():
|
|
groupDict = {"displayName": group.name}
|
|
groupAdmin = {"isAdmin": group.isAdmin}
|
|
groupAttributes = group.attributes
|
|
tmp_dict= groupDict | groupAttributes | groupAdmin
|
|
|
|
groupsDict["wekanGroups"].append(tmp_dict)
|
|
return groupsDict
|
|
'
|
|
2. Tell provider to include *yourScope* and set
|
|
OAUTH2_REQUEST_PERMISSIONS="openid profile email *yourScope*"
|
|
|
|
3. In your group settings in authentik add attributes:
|
|
desc: groupDesc // default group.name
|
|
isAdmin: true // default false
|
|
website: groupWebsite // default group.name
|
|
isActive: true // default false
|
|
shortName: groupShortname // default group.name
|
|
forceCreate: true // default false
|
|
isOrganisation: true // default false
|
|
|
|
4. On next login user will be added to either newly created group/organization or to already existing
|
|
|
|
NOTE: orgs & teams won't be updated if they already exist.
|
|
|
|
5. Manages admin rights as well. If user is in Group which has isAdmin: set to true, user will get admin
|
|
privileges in Wekan as well.
|
|
If no adjustments (e.g. 1-3) are made on oidc provider's side, user will receive his/her admin rights from before.
|
|
|
|
## For further empowerment of oidc as sso solution
|
|
|
|
If you want to be redirected to your oidc provider on LOGIN without going the extra loop of signing in.
|
|
On LOGOUT you will be redirected to the oidc provider as well.
|
|
|
|
Add to your .env file:
|
|
|
|
OIDC_REDIRECTION_ENABLED=true
|
|
OAUTH2_SERVER_URL=http://localhost:9000
|
|
DASHBOARD_URL=/if/session-end/wekan/
|
|
|
|
Example for authentik.
|
|
The latter specifies the OIDC Dashboard you'll get redirected on logout
|
|
|
|
Flow:
|
|
You need to have an oidc provider configured to get this feature
|
|
Make sure to have
|
|
Authorize Application (default-provider-authorization-implicit-consent)
|
|
enabled
|