| Both sides previous revision Previous revision Next revision | Previous revision |
| en:2.0:single_sign_on:oidc_matomo [2026/09/09 10:57] – [Quick Overview] kainhofer | en:2.0:single_sign_on:oidc_matomo [2026/09/09 11:44] (current) – [Quick Overview] kainhofer |
|---|
| * Choose an easily understood **label for the client** (only used in Admidio's list of clients and in the login form, but has no technical use) | * Choose an easily understood **label for the client** (only used in Admidio's list of clients and in the login form, but has no technical use) |
| * Enter the **ClientID from the RP**, copy the created Client Secret (you will later need to paste it into the Matomo configuration), and enter the **Redirect URI** for the RP. The latter can be found on the plugin's documentation (''https://[YOUR_MATOMO_URL]/index.php?module=LoginOIDC&action=callback&provider=oidc''). | * Enter the **ClientID from the RP**, copy the created Client Secret (you will later need to paste it into the Matomo configuration), and enter the **Redirect URI** for the RP. The latter can be found on the plugin's documentation (''https://[YOUR_MATOMO_URL]/index.php?module=LoginOIDC&action=callback&provider=oidc''). |
| | * Matomo does not support PKCE, so the corresponding setting needs to be turned off. |
| * In Admidio, map the user ID, username, email and fullname to fields that are included in the OpenID login response (so-called "claims") and enter the corresponding claim names in Matomo. | * In Admidio, map the user ID, username, email and fullname to fields that are included in the OpenID login response (so-called "claims") and enter the corresponding claim names in Matomo. |
| |
| * The **Client Name** is the label of the client in Admidio's client list, it can be anything you like. | * The **Client Name** is the label of the client in Admidio's client list, it can be anything you like. |
| * The **"Client ID"** and **"Client Secret"** in Admidio and Matomo have to match exactly. The ID is typically the client's URL, although some clients allow any unique identifier. The Client Secret should be a random string and will serve like a password.((Admidio will create a secure client secret and allow it to be copied to the client. Afterwards it is only stored as a hash in the database and not be recovered any more. However, one can create a new Client Secret in Admidio and copy that to the client's configuration.)) | * The **"Client ID"** and **"Client Secret"** in Admidio and Matomo have to match exactly. The ID is typically the client's URL, although some clients allow any unique identifier. The Client Secret should be a random string and will serve like a password.((Admidio will create a secure client secret and allow it to be copied to the client. Afterwards it is only stored as a hash in the database and not be recovered any more. However, one can create a new Client Secret in Admidio and copy that to the client's configuration.)) |
| | * Matomo does not yet support PKCE for increased security, so it needs to be explicitly disabled to prevent errors. |
| * Enter the **scopes** you desire in the Matomo config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it), ''profile'' and ''email'' are recommended so that Matomo receives the ''username'' and ''email'' fields from Admidio. | * Enter the **scopes** you desire in the Matomo config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it), ''profile'' and ''email'' are recommended so that Matomo receives the ''username'' and ''email'' fields from Admidio. |
| * Matomo does not display its **Redirect URL** directly in the plugin config. Rather, the FAQ of the plugins lists it as: ''https://[YOUR_MATOMO_URL]/index.php?module=LoginOIDC&action=callback&provider=oidc'' (or for the RebelOIDC plugin: ''https://[YOUR_MATOMO_URL]/index.php?module=RebelOIDC&action=callback&provider=oidc''). Enter this URL in Admidio. | * Matomo does not display its **Redirect URL** directly in the plugin config. Rather, the FAQ of the plugins lists it as: ''https://[YOUR_MATOMO_URL]/index.php?module=LoginOIDC&action=callback&provider=oidc'' (or for the RebelOIDC plugin: ''https://[YOUR_MATOMO_URL]/index.php?module=RebelOIDC&action=callback&provider=oidc''). Enter this URL in Admidio. |
