Package: allianceauth-oidc-provider
allianceauth_oidcAllianceauth OIDC ProviderFeaturesOIDC / OAuth2Scopes AvailableopenidemailprofileIncludesgroupsclaim with all a members groups and state as a list of stringsApplication level permissionsglobal accessState accessgroup accessExampleSetup/Install:pip install allianceauth-oidc-provideradd to INSTALLED_APPS'allianceauth_oidc',
    'oauth2_provider',Extra Settings Required# at the top of the filefrompathlibimportPath# Add these to the file further downOAUTH2_PROVIDER_APPLICATION_MODEL='allianceauth_oidc.AllianceAuthApplication'OAUTH2_PROVIDER={"OIDC_ENABLED":True,# https://django-oauth-toolkit.readthedocs.io/en/stable/oidc.html#creating-rsa-private-key"OIDC_RSA_PRIVATE_KEY":Path("/path/to/key/file").read_text(),## Load your private key"OAUTH2_VALIDATOR_CLASS":"allianceauth_oidc.auth_provider.AllianceAuthOAuth2Validator","SCOPES":{"openid":"User Profile","email":"Registered email","profile":"Main Character affiliation and Auth groups"},"PKCE_REQUIRED":False,"APPLICATION_ADMIN_CLASS":"allianceauth_oidc.admin.ApplicationAdmin",'ACCESS_TOKEN_EXPIRE_SECONDS':60,'REFRESH_TOKEN_EXPIRE_SECONDS':24*60*60,'ROTATE_REFRESH_TOKEN':True,}Please seethisfor more info on creating and managing a private keyAdd the endpoints to yoururls.pypath('o/', include('allianceauth_oidc.urls', namespace='oauth2_provider')),run migrationsrestart authApplication setupThe Big 4Authorization:https://your.url/o/authorize/Token:https://your.url/o/token/Profile:https://your.url/o/userinfo/Issuerhttps://your.url/oClaimsopenid profile emailClaim key mappingnameEve Main Character Name ( Profile Grant? )emailRegistered email on auth ( Email Grant )groupsList of all groups with the members state thrown in too ( Profile Grant )subPK of user modelWikiJSManually create and groups you care for your users to have in the wiki and the service will map them for you. This greatly cuts down on group spam.
in auth createAdministratorsto give access to the full wiki admin site.Administration > Authentication > Generic OpenID Connect / OAuth2Skip User ProfileoffEmail claimemailDisplay Name ClaimnameMap GroupsonGroups ClaimgroupsAllow Self RegistrationonGrafanaTested only with access no group mapping as yetGroup>Team mapping requires Grafana cloud or Enterprise and is outside of the scope of this doc./etc/grafana/grafana.ini[auth.generic_oauth]enabled=truename=Your Site Nameallow_sign_up=trueclient_id=******client_secret=*****scopes=openid,email,profileempty_scopes=falseemail_attribute_path=emailname_attribute_path=nameauth_url=https://your.url/o/authorize/token_url=https://your.url/o/token/api_url=https://your.url/o/userinfo/Debugging an applicationEnableDebug Modefor the specific application in the auth admin site.then in yourgunicorn.loglook for long lines similar to this after you attempt to log in,[01/Jan/2099 00:00:05] WARNING [allianceauth_oidc.signals:12] {"access_token": "abcdefghijklmnopqrstuvwxyz", "expires_in": 60, "token_type": "Bearer", "scope": "openid profile email", "refresh_token": "abcdefghijklmnopqrstuvwxyz", "id_token": "long ass string here"}take theid_tokenfield and paste it intohttps://jwt.io/to debug the data being sent to the application. it should be fairly self explanitory expect for these 2 fields.issis the issuer that must match exactly in the applications own settings.subis your user id if you need to debug why user is being sent.