Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
en:2.0:single_sign_on:oidc_mailman3 [2026/09/09 12:30] – [Prerequisites] kainhoferen:2.0:single_sign_on:oidc_mailman3 [2026/09/09 13:55] (current) – [Setting up the Client (RP) in Admidio] kainhofer
Line 22: Line 22:
 ===== Quick Overview ===== ===== Quick Overview =====
  
-Setting up a client (OpenID "Relying Party" - short RP) to use Admidio's user accounts for logging in consists of two steps: (1) The Mailman3 client (RP) needs to be set up for the OpenID Provider (OP), which can be done by providing the Discovery URL. (2) Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration.+Setting up a client (OpenID "Relying Party" = "RP") to use Admidio's user accounts for log-in consists of two steps:  
 +  - The Mailman3 client (RP) needs to be set up with the data about the OpenID Provider (OP), which can be done by providing the Discovery URL. 
 +  - Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration.
  
 The concrete steps are: The concrete steps are:
Line 29: Line 31:
     * Also, choose which scopes (groups of profile fields) should be requested from Admidio ("openid" is required; "groups" are not supported, but other scopes like "profile" and "email" might be useful).     * Also, choose which scopes (groups of profile fields) should be requested from Admidio ("openid" is required; "groups" are not supported, but other scopes like "profile" and "email" might be useful).
   * In **Admidio**, **create a new OpenID client**.    * In **Admidio**, **create a new OpenID client**. 
-    * Choose an **label for the client** (displayed in the login form, but no technical use)+    * Choose an easily understood **label for the client** (only used in Admidio's list of clients, but has no technical use)
     * Enter the **ClientID from the RP**, copy the created Client Secret, and enter the **Redirect URI** for the RP. The latter includes the provider_id and has the form ''https://[YOUR_MAILMAN]/accounts/[PROVIDER_ID]/login/callback/''.     * Enter the **ClientID from the RP**, copy the created Client Secret, and enter the **Redirect URI** for the RP. The latter includes the provider_id and has the form ''https://[YOUR_MAILMAN]/accounts/[PROVIDER_ID]/login/callback/''.
 +    * Many open source OIDC clients do not support encryption (PKCE, which is a security mechanism that prevents attackers from obtaining access unless their application started the initial login). By default, PKCE is required by Admidio, so in this case make sure that the requirement checkbox is turned off. Otherwise you will get an error. 
     * In Admidio, map the user ID, username, email and fullname to fields that are included in the OpenID login response (so-called "claims") and enter the corresponding claim names in Mailman3.      * In Admidio, map the user ID, username, email and fullname to fields that are included in the OpenID login response (so-called "claims") and enter the corresponding claim names in Mailman3. 
  
Line 62: Line 65:
   * Go to the Accounts section and select "Social Apps", where you can add a new OpenID provider through Admidio (see below where the individual settings can be copied from):   * Go to the Accounts section and select "Social Apps", where you can add a new OpenID provider through Admidio (see below where the individual settings can be copied from):
 {{ :en:2.0:sso:sso_mailman3_oidc_02_mailman_socialapp.png?direct&600 |}} {{ :en:2.0:sso:sso_mailman3_oidc_02_mailman_socialapp.png?direct&600 |}}
-{{ :en:2.0:sso:sso_mailman3_oidc_03_mailman_socialappsettings.png?direct&600 |}} 
  
   * It is now a good idea to keep two browser windows open with Admidio and Mailman3's configuration so one can easily select and copy the settings.   * It is now a good idea to keep two browser windows open with Admidio and Mailman3's configuration so one can easily select and copy the settings.
Line 80: Line 82:
   * Enter the **scopes** you desire in the Mailman3 config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it).   * Enter the **scopes** you desire in the Mailman3 config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it).
   * In mailman, choose a provider_id, which will be part of the redirect URL that needs to be entered into Admidio. The Redirect URL for Admidio is:<code>https://[YOUR_MAILMAN]/accounts/[PROVIDER_ID]/login/callback/</code>   * In mailman, choose a provider_id, which will be part of the redirect URL that needs to be entered into Admidio. The Redirect URL for Admidio is:<code>https://[YOUR_MAILMAN]/accounts/[PROVIDER_ID]/login/callback/</code>
 +  * Enabling PKCE for increased security cannot fully be done in the UI. The ''"oauth_pkce_enabled": true'' setting is only one part. The overall PKCE enablement must be done in ''settings_local.py'': <code python>
 +# PKCE must be configured here, not in the "Settings" field in the Django admin. 
 +# Note: no "APPS" key here on purpose -- the app is configured in the Django admin, and
 +# declaring it in both places makes allauth fail with multiple matching apps.
 +SOCIALACCOUNT_PROVIDERS = {
 +    "openid_connect": {
 +        "OAUTH_PKCE_ENABLED": True,
 +    }
 +}
 +</code>
  
  
  • en/2.0/single_sign_on/oidc_mailman3.1788949821.txt.gz
  • Last modified: 2026/09/09 12:30
  • by kainhofer