Package: guillotina-hydraidp
This addon aims to provide an identity provider through guillotina
for hydra.It also implements the login and consent flow for hydra.Endpoints:GET/@usersPOST/@users{‘id’, ‘username’, ‘password’, ‘phone’, ‘email’, ‘data’, ‘allowed_scopes’}DELETE/@users/{userid}GET/@users/{userid}GET/@hydra-loginPOST/@hydra-loginGET/@hydra-consentPOST/@hydra-consentPOST/@hydra-joinGET/@hydra-userPATCH/@hydra-userConfiguringConfiguration depends on your frontend login implementation. Using an application
that renders html and can be the auth endpoint as well makes the flow more simple.See the angular app example in the repo and integration test flow to see how
it can work.Tests require a hydra instance to be running with the following configuration:OAUTH2_ISSUER_URL=http://localhost:4444OAUTH2_CONSENT_URL=http://localhost:8080/@hydra-consentOAUTH2_LOGIN_URL=http://localhost:8080/@hydra-loginDATABASE_URL=postgres://hydra:secret@postgresd:5432/hydra?sslmode=disableSYSTEM_SECRET=youReallyNeedToChangeThisOAUTH2_SHARE_ERROR_DEBUG=1OIDC_SUBJECT_TYPES_SUPPORTED=public,pairwiseOIDC_SUBJECT_TYPE_PAIRWISE_SALT=youReallyNeedToChangeThisThen you need to configure guillotina:auth_providers:
  hydra:
    configuration:
      client_id: auth-code-client
      client_secret: secret
      base_url: http://localhost:4444/
      authorize_url: http://localhost:4444/oauth2/auth
      access_token_url: http://localhost:4444/oauth2/token
    state: true
    scope: openid offline
hydra:
  db:
    dsn: postgres://hydra:secret@localhost:5432/hydra
    pool_size: 20
  # hydra admin url should be internal, protected!
  admin_url: http://localhost:4445/
  allow_registration: false
recaptcha_private_key: null
recaptcha_public_key: nullTo add an oauth client to hydra:curl -XPUT http://localhost:4445/clients/auth-code-client -d '{
    "client_id": "auth-code-client",
    "client_name": "",
    "redirect_uris": [
        "http://localhost:8080/@callback/hydra"
    ],
    "grant_types": [
        "authorization_code",
        "refresh_token"
    ],
    "response_types": [
        "code",
        "id_token"
    ],
    "scope": "openid offline",
    "owner": "",
    "policy_uri": "",
    "allowed_cors_origins": [],
    "tos_uri": "",
    "client_uri": "",
    "logo_uri": "",
    "contacts": [],
    "client_secret_expires_at": 0,
    "subject_type": "public",
    "jwks": {
        "keys": null
    },
    "token_endpoint_auth_method": "client_secret_post",
    "userinfo_signed_response_alg": "none"
}'Seehttps://github.com/guillotinaweb/guillotina_hydraidp/blob/master/integration_tests.pyfor an example on using the flow.This is just the API implementation. You will still need to implement the frontend!Scope formatUse scopes to grant access to guillotina containers.The format of scopes is:[container id]:[type]:[value].For example, to give the user access to containercmsas a user, the scope would becms:role:guillotina.MemberOther examples:
-cms:role:guillotina.Reader-cms:permission:guillotina.AccessContentDevelop FrontendStart persistent layers:docker-compose up redis postgres hydra-migrate hydra hydra-proxyStart idp:virtualenv .
source bin/activate
g -c config-pg.yamlStart ngapp:cd loginapp
ng serveOpen browser:http://localhost:42001.0.3 (2018-10-27)Adding events
[bloodbare]1.0.2 (2018-10-25)Join RSA pub key
[bloodbare]1.0.1 (2018-10-22)be able to work as a regular login endpoint
[vangheem]provide angular login app
[bloodbare]1.0.0 (2018-10-09)initial