Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
en:2.0:single_sign_on:oidc_mailman3 [2026/09/09 13:01] – [Configuring the IdP settings for the Relying Party (Mailman3)] kainhoferen:2.0:single_sign_on:oidc_mailman3 [2026/09/09 13:55] (current) – [Setting up the Client (RP) in Admidio] kainhofer
Line 82: Line 82:
   * Enter the **scopes** you desire in the Mailman3 config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it).   * Enter the **scopes** you desire in the Mailman3 config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it).
   * In mailman, choose a provider_id, which will be part of the redirect URL that needs to be entered into Admidio. The Redirect URL for Admidio is:<code>https://[YOUR_MAILMAN]/accounts/[PROVIDER_ID]/login/callback/</code>   * In mailman, choose a provider_id, which will be part of the redirect URL that needs to be entered into Admidio. The Redirect URL for Admidio is:<code>https://[YOUR_MAILMAN]/accounts/[PROVIDER_ID]/login/callback/</code>
 +  * Enabling PKCE for increased security cannot fully be done in the UI. The ''"oauth_pkce_enabled": true'' setting is only one part. The overall PKCE enablement must be done in ''settings_local.py'': <code python>
 +# PKCE must be configured here, not in the "Settings" field in the Django admin. 
 +# Note: no "APPS" key here on purpose -- the app is configured in the Django admin, and
 +# declaring it in both places makes allauth fail with multiple matching apps.
 +SOCIALACCOUNT_PROVIDERS = {
 +    "openid_connect": {
 +        "OAUTH_PKCE_ENABLED": True,
 +    }
 +}
 +</code>
  
  
  • en/2.0/single_sign_on/oidc_mailman3.1788951705.txt.gz
  • Last modified: 2026/09/09 13:01
  • by kainhofer