| Both sides previous revision Previous revision Next revision | Previous revision |
| en:2.0:single_sign_on:oidc_matomo [2026/09/09 10:40] – [Prerequisites] kainhofer | en:2.0:single_sign_on:oidc_matomo [2026/09/09 11:44] (current) – [Quick Overview] kainhofer |
|---|
| ===== Quick Overview ===== | ===== Quick Overview ===== |
| |
| Setting up Matomo (OpenID "Relying Party" - short RP) to use Admidio's user accounts for logging in consists of two steps: (1) Matomo needs to be set up with the data about the OpenID Provider (OP). One has to manually paste the Admidio endpoint URLs of the OpenID provider into the client's configuration. (2) Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration. | Setting up Matomo (OpenID "Relying Party" = "RP") to use Admidio's user accounts for log-in consists of two steps: |
| | - Matomo needs to be set up with the data about the OpenID Provider (OP). One has to manually paste the Admidio endpoint URLs of the OpenID provider into the client's configuration. |
| | - Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration. |
| |
| The concrete steps are: | The concrete steps are: |
| * In **Admidio**, **create a new OpenID client**. | * In **Admidio**, **create a new OpenID client**. |
| * Choose an easily understood **label for the client** (only used in Admidio's list of clients and in the login form, but has no technical use) | * Choose an easily understood **label for the client** (only used in Admidio's list of clients and in the login form, but has no technical use) |
| * Enter the **ClientID from the RP**, Copy the created Client Secret (you will later need to paste it into the Matomo configuration), and enter the **Redirect URI** for the RP. The latter can be found on the plugin's documentation (''https://[YOUR_MATOMO_URL]/index.php?module=LoginOIDC&action=callback&provider=oidc'') | * Enter the **ClientID from the RP**, copy the created Client Secret (you will later need to paste it into the Matomo configuration), and enter the **Redirect URI** for the RP. The latter can be found on the plugin's documentation (''https://[YOUR_MATOMO_URL]/index.php?module=LoginOIDC&action=callback&provider=oidc''). |
| | * Matomo does not support PKCE, so the corresponding setting needs to be turned off. |
| * In Admidio, map the user ID, username, email and fullname to fields that are included in the OpenID login response (so-called "claims") and enter the corresponding claim names in Matomo. | * In Admidio, map the user ID, username, email and fullname to fields that are included in the OpenID login response (so-called "claims") and enter the corresponding claim names in Matomo. |
| |
| * The **Client Name** is the label of the client in Admidio's client list, it can be anything you like. | * The **Client Name** is the label of the client in Admidio's client list, it can be anything you like. |
| * The **"Client ID"** and **"Client Secret"** in Admidio and Matomo have to match exactly. The ID is typically the client's URL, although some clients allow any unique identifier. The Client Secret should be a random string and will serve like a password.((Admidio will create a secure client secret and allow it to be copied to the client. Afterwards it is only stored as a hash in the database and not be recovered any more. However, one can create a new Client Secret in Admidio and copy that to the client's configuration.)) | * The **"Client ID"** and **"Client Secret"** in Admidio and Matomo have to match exactly. The ID is typically the client's URL, although some clients allow any unique identifier. The Client Secret should be a random string and will serve like a password.((Admidio will create a secure client secret and allow it to be copied to the client. Afterwards it is only stored as a hash in the database and not be recovered any more. However, one can create a new Client Secret in Admidio and copy that to the client's configuration.)) |
| | * Matomo does not yet support PKCE for increased security, so it needs to be explicitly disabled to prevent errors. |
| * Enter the **scopes** you desire in the Matomo config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it), ''profile'' and ''email'' are recommended so that Matomo receives the ''username'' and ''email'' fields from Admidio. | * Enter the **scopes** you desire in the Matomo config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it), ''profile'' and ''email'' are recommended so that Matomo receives the ''username'' and ''email'' fields from Admidio. |
| * Matomo does not display its **Redirect URL** directly in the plugin config. Rather, the FAQ of the plugins lists it as: ''https://[YOUR_MATOMO_URL]/index.php?module=LoginOIDC&action=callback&provider=oidc'' (or for the RebelOIDC plugin: ''https://[YOUR_MATOMO_URL]/index.php?module=RebelOIDC&action=callback&provider=oidc''). Enter this URL in Admidio. | * Matomo does not display its **Redirect URL** directly in the plugin config. Rather, the FAQ of the plugins lists it as: ''https://[YOUR_MATOMO_URL]/index.php?module=LoginOIDC&action=callback&provider=oidc'' (or for the RebelOIDC plugin: ''https://[YOUR_MATOMO_URL]/index.php?module=RebelOIDC&action=callback&provider=oidc''). Enter this URL in Admidio. |
