Package: barrier
Serve static files safely behind OpenIDConnect-compatible authentication (i.e. Okta)OpenID Connect Provider Set-upOktaThe following steps will get you the values necessary to integrate Okta with your Barrier-protected content.Go to theApplicationssection of your Okta admin app. (hint: the url of the admin app ishttps://<yourorganization>>-admin.okta.com/dev/console)ClickAdd ApplicationOn theCreate New Applicationpage, chooseWeband clickNextYou will need to enter some details about the application:Name:<yourbarrier-protectedsite name>Base URIs:https://<yourbarrier-protecteddomain>/orhttp://localhost:8000during development)Login redirect URIs:https://<yourbarrier-protecteddomain>/oidc/callbackorhttp://localhost:8000/oidc/callback, &http://localhost:5000/oidc/callbackduring developmentGroup Assigments:Everyoneis fine, unless you have specific requirements.Grant Type Allowed:Client acting on behalf of itself[ ]Client CredentialsClient acting on behalf of a user[x]Authorization Code[ ]Refresh Token[ ]Implicit (Hybrid)ClickNextagainYou’re now at the General Settings for your new Okta integration, scroll to the bottom and copy theClient IDandClient secretvalues.Visit theDashboardpage and copy theOrg URL.Use the following guide to set your environment variables[1]:BARRIER_CLIENT_ID=Client IDBARRIER_CLIENT_SECRET=Client secretBARRIER_AUTH_URI=<OrgURL>/oauth2/default/v1/authorizeBARRIER_TOKEN_URI=<OrgURL>/oauth2/default/v1/tokenBARRIER_ISSUER=<OrgURL>/oauth2/defaultBARRIER_USERINFO_URI=<OrgURL>/oauth2/default/userinfoCongratulations! You’re ready to install or deploy!Installation$ pip install (--user) https://github.com/gadventures/barrierCommandsThe following is a brief overview, but you can call any of these commands with--helpfor more information.barrier-configGenerate “client-secrets.json”, required for running the other commands. See the help text for required options. Options passed on the command line will override any values set in the environment.barrier-devFlask development server. Useful if extending this project to add more features.barrier-wsgiGunicorn WSGI wrapper. Can be placed behind nginx, Apache, or whatever you like.EnvironmentRequiredNameDescriptionWhere to get itBARRIER_USERINFO_URIUserInfo URI. Part of OpenIDConnect secrets configuration.OpenID Connect ProviderBARRIER_ISSUERIssuer ID. Part of OpenIDConnect secrets configuration.OpenID Connect ProviderBARRIER_TOKEN_URIToken URI. Part of OpenIDConnect secrets configuration.OpenID Connect ProviderBARRIER_AUTH_URIAuth URI. Part of OpenIDConnect secrets configuration.OpenID Connect ProviderBARRIER_CLIENT_SECRETClient Secret Key. Part of OpenIDConnect secrets configuration.OpenID Connect ProviderBARRIER_CLIENT_IDClient ID. Part of OpenIDConnect secrets configuration.OpenID Connect ProviderBARRIER_REDIRECT_URIRedirect URI. Part of OpenIDConnect secrets configuration.OpenID Connect Provider, The value to set is:https://{your-hostname}/oidc/callbackBARRIER_SECRET_KEYUsed for HMAC Authentication. Generate a long random string.Any source of random informationOptionalNameDescriptionWhere to get itBARRIER_RESOURCE_ROOTRoot path of static files to serve. (Default:./build/html)                                                                                                                                                  | Wherever you choose to add the static files in your custom layer, or add your files to the default location.BARRIER_DEFAULT_RESOURCEThe file/path that users will be redirected to after login. (Default:index.html)Probably not necessary to change this.BARRIER_CLIENT_SECRETSOpenIDConnect secrets configuration file location. If your provider allows automatic configuration download and has a different filename, override with that filename here. (Default:client-secrets.json)OpenID Connect Provider[1]https://developer.okta.com/blog/2018/07/12/flask-tutorial-simple-user-registration-and-login#step-1-create-an-openid-connect-config-file