Differences

This shows you the differences between two versions of the page.

--- en:2.0:single_sign_on:oidc_mailman3 [2025/05/30 15:22] – kainhofer
+++ en:2.0:single_sign_on:oidc_mailman3 [2026/09/09 13:55] (current) – [Setting up the Client (RP) in Admidio] kainhofer
@@ Line 10: / Line 10: @@
 Throughout the document we will assume you have both Admidio and Mailman3 already set up properly at https://admidio.local/ and https://mailman.local/. Please modify these URLs to your actual installation.
-As a first step, one needs to **configure Admidio to act as an OpenID Provider** (OP). This has to be done once and is not specific to Mailman3. Please follow this guide: [[en:2.0:single_sign_on|#a_basic_setup_for_admidio_as_an_oidc_id_provider]]
+As a first step, one needs to **configure Admidio to act as an OpenID Provider** (OP). This has to be done once and is not specific to any particular client. Please [[en:2.0:single_sign_on#a_basic_setup_for_admidio_as_an_oidc_id_provider|folow this guide]]:
 {{ :en:2.0:sso:sso_oidc_01-05_setup_admidio_preferences.png?direct&600 |}}
-Basically, one (1) needs to **create a cryptographic key** to sign message and **choose a unique EntityID**.
-The page https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata.
+Basically, one needs to enable OpenID Connect (OIDC). The Issuer URL should in most cases be left blank, which means Admidio's public URL will be used as issuer URL.
+The page https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the automatic discovery URL, and the individual settings for clients that do not support auto-configuration via metadata.
 ===== Quick Overview =====
-Setting up a client (OpenID "Relying Party" - short RP) to use Admidio's user accounts for logging in consists of two steps: (1) The Mailman3 client (RP) needs to be set up for the OpenID Provider (OP), which can be done by providing the Discovery URL. (2) Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration.
+Setting up a client (OpenID "Relying Party" = "RP") to use Admidio's user accounts for log-in consists of two steps:
+  - The Mailman3 client (RP) needs to be set up with the data about the OpenID Provider (OP), which can be done by providing the Discovery URL.
+  - Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration.
 The concrete steps are:
@@ Line 26: / Line 31: @@
     * Also, choose which scopes (groups of profile fields) should be requested from Admidio ("openid" is required; "groups" are not supported, but other scopes like "profile" and "email" might be useful).
   * In **Admidio**, **create a new OpenID client**.
-    * Choose an **label for the client** (displayed in the login form, but no technical use)
+    * Choose an easily understood **label for the client** (only used in Admidio's list of clients, but has no technical use)
     * Enter the **ClientID from the RP**, copy the created Client Secret, and enter the **Redirect URI** for the RP. The latter includes the provider_id and has the form ''https://[YOUR_MAILMAN]/accounts/[PROVIDER_ID]/login/callback/''.
+    * Many open source OIDC clients do not support encryption (PKCE, which is a security mechanism that prevents attackers from obtaining access unless their application started the initial login). By default, PKCE is required by Admidio, so in this case make sure that the requirement checkbox is turned off. Otherwise you will get an error.
     * In Admidio, map the user ID, username, email and fullname to fields that are included in the OpenID login response (so-called "claims") and enter the corresponding claim names in Mailman3.
@@ Line 59: / Line 65: @@
   * Go to the Accounts section and select "Social Apps", where you can add a new OpenID provider through Admidio (see below where the individual settings can be copied from):
 {{ :en:2.0:sso:sso_mailman3_oidc_02_mailman_socialapp.png?direct&600 |}}
-{{ :en:2.0:sso:sso_mailman3_oidc_03_mailman_socialappsettings.png?direct&600 |}}
   * It is now a good idea to keep two browser windows open with Admidio and Mailman3's configuration so one can easily select and copy the settings.
@@ Line 77: / Line 82: @@
   * Enter the **scopes** you desire in the Mailman3 config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it).
   * In mailman, choose a provider_id, which will be part of the redirect URL that needs to be entered into Admidio. The Redirect URL for Admidio is:<code>https://[YOUR_MAILMAN]/accounts/[PROVIDER_ID]/login/callback/</code>
+  * Enabling PKCE for increased security cannot fully be done in the UI. The ''"oauth_pkce_enabled": true'' setting is only one part. The overall PKCE enablement must be done in ''settings_local.py'': <code python>
+# PKCE must be configured here, not in the "Settings" field in the Django admin.
+# Note: no "APPS" key here on purpose -- the app is configured in the Django admin, and
+# declaring it in both places makes allauth fail with multiple matching apps.
+SOCIALACCOUNT_PROVIDERS = {
+    "openid_connect": {
+        "OAUTH_PKCE_ENABLED": True,
+    }
+}
+</code>