Differences

This shows you the differences between two versions of the page.

--- en:2.0:single_sign_on:oidc_matomo [2025/05/30 19:02] – created kainhofer
+++ en:2.0:single_sign_on:oidc_matomo [2026/09/09 11:44] (current) – [Quick Overview] kainhofer
@@ Line 10: / Line 10: @@
 Throughout the document we will assume you have both Admidio and Matomo already set up properly at https://admidio.local/ and https://matomo.local/. Please modify these URLs to your actual installation.
-As a first step, one needs to **configure Admidio to act as an OpenID Provider** (OP). This has to be done once and is not specific to Matomo. Please follow this guide: [[en:2.0:single_sign_on|#a_basic_setup_for_admidio_as_an_oidc_id_provider]]
+As a first step, one needs to **configure Admidio to act as an OpenID Provider** (OP). This has to be done once and is not specific to any particular client. Please [[en:2.0:single_sign_on#a_basic_setup_for_admidio_as_an_oidc_id_provider|folow this guide]]:
 {{ :en:2.0:sso:sso_oidc_01-05_setup_admidio_preferences.png?direct&600 |}}
-Basically, one (1) needs to **create a cryptographic key** to sign message and **choose a unique EntityID**.
+Basically, one needs to enable OpenID Connect (OIDC). The Issuer URL should in most cases be left blank, which means Admidio's public URL will be used as issuer URL.
-The page https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata.
+The page https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the automatic discovery URL, and the individual settings for clients that do not support auto-configuration via metadata.
 ===== Quick Overview =====
-Setting up Matomo (OpenID "Relying Party" - short RP) to use Admidio's user accounts for logging in consists of two steps: (1) Matomo needs to be set up with the data about the OpenID Provider (OP). One has to manually paste the Admidio endpoint URLs of the OpenID provider into the client's configuration. (2) Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration.
+Setting up Matomo (OpenID "Relying Party" = "RP") to use Admidio's user accounts for log-in consists of two steps:
+  - Matomo needs to be set up with the data about the OpenID Provider (OP). One has to manually paste the Admidio endpoint URLs of the OpenID provider into the client's configuration.
+  - Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration.
 The concrete steps are:
@@ Line 27: / Line 31: @@
   * In **Admidio**, **create a new OpenID client**.
     * Choose an easily understood **label for the client** (only used in Admidio's list of clients and in the login form, but has no technical use)
-    * Enter the **ClientID from the RP**, Copy the created Client Secret (you will later need to paste it into the Matomo configuration), and enter the **Redirect URI** for the RP. The latter can be found on the plugin's documentation (''https://[YOUR_MATOMO_URL]/index.php?module=LoginOIDC&action=callback&provider=oidc'')
+    * Enter the **ClientID from the RP**, copy the created Client Secret (you will later need to paste it into the Matomo configuration), and enter the **Redirect URI** for the RP. The latter can be found on the plugin's documentation (''https://[YOUR_MATOMO_URL]/index.php?module=LoginOIDC&action=callback&provider=oidc'').
+    * Matomo does not support PKCE, so the corresponding setting needs to be turned off.
     * In Admidio, map the user ID, username, email and fullname to fields that are included in the OpenID login response (so-called "claims") and enter the corresponding claim names in Matomo.
@@ Line 56: / Line 61: @@
     * The **Client Name** is the label of the client in Admidio's client list, it can be anything you like.
     * The **"Client ID"** and **"Client Secret"** in Admidio and Matomo have to match exactly. The ID is typically the client's URL, although some clients allow any unique identifier. The Client Secret should be a random string and will serve like a password.((Admidio will create a secure client secret and allow it to be copied to the client. Afterwards it is only stored as a hash in the database and not be recovered any more. However, one can create a new Client Secret in Admidio and copy that to the client's configuration.))
+    * Matomo does not yet support PKCE for increased security, so it needs to be explicitly disabled to prevent errors.
     * Enter the **scopes** you desire in the Matomo config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it), ''profile'' and ''email'' are recommended so that Matomo receives the ''username'' and ''email'' fields from Admidio.
     * Matomo does not display its **Redirect URL** directly in the plugin config. Rather, the FAQ of the plugins lists it as: ''https://[YOUR_MATOMO_URL]/index.php?module=LoginOIDC&action=callback&provider=oidc'' (or for the RebelOIDC plugin: ''https://[YOUR_MATOMO_URL]/index.php?module=RebelOIDC&action=callback&provider=oidc''). Enter this URL in Admidio.