Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision		 Previous revision
en:2.0:single_sign_on:oidc_joomla [2025/05/07 01:32] – created kainhoferen:2.0:single_sign_on:oidc_joomla [2026/09/08 15:52] (current) – [Caveats and Things to Consider] kainhofer
Line 7: Line 7:
 Throughout the document we will assume you have both Admidio and Joomla already set up properly at https://admidio.local/ and https://joomla.local/. Please modify these URLs to your actual installation. Throughout the document we will assume you have both Admidio and Joomla already set up properly at https://admidio.local/ and https://joomla.local/. Please modify these URLs to your actual installation.
    
-As a first step, one needs to **configure Admidio to act as an OpenID Provider** (OP). This has to be done once and is not specific to Joomla. Please follow this guide: [[en:2.0:single_sign_on|#a_basic_setup_for_admidio_as_an_oidc_id_provider]]+As a first step, one needs to **configure Admidio to act as an OpenID Provider** (OP). This has to be done once and is not specific to any particular client. Please [[en:2.0:single_sign_on#a_basic_setup_for_admidio_as_an_oidc_id_provider|folow this guide]]: 
 {{ :en:2.0:sso:sso_oidc_01-05_setup_admidio_preferences.png?direct&600 |}} {{ :en:2.0:sso:sso_oidc_01-05_setup_admidio_preferences.png?direct&600 |}}
  
-Basically, one (1) needs to **create a cryptographic key** to sign message and **choose a unique EntityID**. +Basically, one needs to enable OpenID Connect (OIDC). The Issuer URL should in most cases be left blank, which means Admidio's public URL will be used as issuer URL. 
-The page https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata.+ 
 +The page https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the automatic discovery URL, and the individual settings in case a client does not support auto-configuration via metadata. 
 + 
 +===== Quick Overview =====
  
-===== TL;DR; - Quick Overview =====+Setting up a client (OpenID "Relying Party" = "RP") to use Admidio's user accounts for log-in consists of two steps:  
 +  - The client (RP, Joomla in our case) needs to be set up with the data about the OpenID Provider (OP). Typically this is done via the metadata provided in the discovery URL of the provider. Otherwise one has to manually paste the endpoint URLs of the OpenID provider. Since Admidio provides those URLs with copy buttons in the preferences screen, even the manual configuration is rather straightforward.  
 +  - Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration.
  
-Setting up a client (OpenID "Relying Party" - short RP) to use Admidio's user accounts for logging in consists of two steps: (1) The client (RP, Joomla in our case) needs to be set up with the data about the OpenID Provider (OP). Typically this is done via the metadata provided in the discovery URL of the provider. Otherwise one has to manually paste the endpoint URLs of the OpenID provider. Since Admidio provides those URLs with copy buttons in the preferences screen, even the manual configuration is rather straigtforward. (2) Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration. 
  
 The concrete steps are: The concrete steps are:
Line 24: Line 29:
     * Choose an easily understood **label for the client** (only used in Admidio's list of clients, but has no technical use)     * Choose an easily understood **label for the client** (only used in Admidio's list of clients, but has no technical use)
     * Enter the **ClientID from the RP**, Copy the created Client Secret (you will later need to paste it indo Joomla's configuration), and enter the **Redirect URI** for the RP. Typically the latter can be found either on the RP's configuration page or in the documentation.     * Enter the **ClientID from the RP**, Copy the created Client Secret (you will later need to paste it indo Joomla's configuration), and enter the **Redirect URI** for the RP. Typically the latter can be found either on the RP's configuration page or in the documentation.
 +    * Many open source OIDC clients do not support encryption (PKCE, which is a security mechanism that prevents attackers from obtaining access unless their application started the initial login). By default, PKCE is required by Admidio, so in this case make sure that the requirement checkbox is turned off. Otherwise you will get an error. 
   * Optionally select (both in Admidio and the RP) which **profile fields should be mapped** to OpenID claims (attributes) and sent to the client, and configure which **group memberships** should be transmitted.   * Optionally select (both in Admidio and the RP) which **profile fields should be mapped** to OpenID claims (attributes) and sent to the client, and configure which **group memberships** should be transmitted.
  
Line 35: Line 41:
 {{ :en:2.0:sso:sso_oidc_joomla_01_plugin.png?direct&200 |}} {{ :en:2.0:sso:sso_oidc_joomla_01_plugin.png?direct&200 |}}
  
-This plugin is available as a **(very stripped-down) free version** and an (expensive) paid version that supports all OpenID Connect features. The free version only allows login to Joomla through Admidio. Features missing from the free version are: (1) automati creation of new users, (2) automatic plugin configuration from the discovery URL, (3) group mapping for permissions in Joomla, (4) attribute/field mapping for profile data, (5) single-log out from all other apps connected through OpenID with Admidio, (6) login to the administration backend with OpenID.+This plugin is available as a **(very stripped-down) free version** and an (expensive) paid version that supports all OpenID Connect features. The free version only allows login to Joomla through Admidio. Features missing from the free version are:  
 +  - automatic creation of new users,  
 +  - automatic plugin configuration from the discovery URL,  
 +  - group mapping for permissions in Joomla,  
 +  - attribute/field mapping for profile data,  
 +  - single-log out from all other apps connected through OpenID with Admidio,  
 +  - login to the administration backend with OpenID.
  
 <WRAP center round important 60%> <WRAP center round important 60%>
Line 58: Line 70:
   * The Client Secret should be a random string and will serve like a password. Admidio will create one and allow it to be copied to the client. Afterwards it is only stored as a hash in the database and not be recovered any more. However, one can create a new Client Secret in Admidio and copy that to the client's configuration.   * The Client Secret should be a random string and will serve like a password. Admidio will create one and allow it to be copied to the client. Afterwards it is only stored as a hash in the database and not be recovered any more. However, one can create a new Client Secret in Admidio and copy that to the client's configuration.
   * The "Redirect URL" in Admidio's config should be the Redirect / Callback URL of Step 1 of the Joomla configuration (typically ''https://[YOUR_INSTALLATION]''){{ :en:2.0:sso:sso_oidc_joomla_05_clientsetup.png?direct&900 |}}   * The "Redirect URL" in Admidio's config should be the Redirect / Callback URL of Step 1 of the Joomla configuration (typically ''https://[YOUR_INSTALLATION]''){{ :en:2.0:sso:sso_oidc_joomla_05_clientsetup.png?direct&900 |}}
 +  * The Joomla OIDC plugin does not support encryption (PKCE, which is a security mechanism that prevents attackers from obtaining access unless their application started the initial login). By default, PKCE is required by Admidio, so make sure that the requirement checkbox is turned off. Otherwise you will get an error. 
   * Enter the **scopes** you desire in Joomla's config and make sure that Admidio's config matches them. At least **openid must be included** (Admidio will implicitly add it). As the free plugin does not support advanced fields mapping or group mappin, only the "email" and "profile" scopes are relevant and should be selected (otherwise the email and username will not be sent to Joomla).   * Enter the **scopes** you desire in Joomla's config and make sure that Admidio's config matches them. At least **openid must be included** (Admidio will implicitly add it). As the free plugin does not support advanced fields mapping or group mappin, only the "email" and "profile" scopes are relevant and should be selected (otherwise the email and username will not be sent to Joomla).
  
Line 105: Line 118:
   * The free version of the miniOrange plugin is very limited, allowing only login for existing joomla users (with their Admidio passwords at the admidio site). Each user must first be created manually in Joomla!   * The free version of the miniOrange plugin is very limited, allowing only login for existing joomla users (with their Admidio passwords at the admidio site). Each user must first be created manually in Joomla!
   * The free version also does not allow transferring any group information from Admidio to Joomla, or other profile fields.   * The free version also does not allow transferring any group information from Admidio to Joomla, or other profile fields.
-  * Currently, there are no full-featured, free Single-Sign-On solutions for Joomla that support field and group mapping for permissions in Joomla. The miniOrange plugins we described here provide only basic SSO functionality, while the useful features are available only in the paid versions. Given the high costs of these versions and considering the tight budget most non-profit associations face, the paid version is usually way to expensive to even consider...+  * Currently, there are no full-featured, free Single-Sign-On solutions for Joomla that support field and group mapping for permissions in Joomla. The miniOrange plugins we described here provide only basic SSO functionality, while the useful features are available only in the paid versions. Given the high costs of these versions and considering the tight budget most non-profit associations face, the paid version is usually way too expensive to even consider...
  • en/2.0/single_sign_on/oidc_joomla.1746574351.txt.gz
  • Last modified: 2025/05/07 01:32
  • by kainhofer