Package: tahoe-idp
Tahoe Identity ProviderA package of IdP user authentication modules designed to work in Open edX.README NEEDS UPDATEThe readme is obsolete because this package is now using FusionAuth instead of Auth0.0. PrerequisitesTo be able to use this library, you need to have the followingAn Auth0Tenant.An Auth0APIAn Auth0Machine to Machineapplication.At least one organization.One custom connection.0.1. Configuring the APIWe need to register an API to perform user registration and to communicate with
Auth0 organizations.Your API must have the following permissions:read:usersupdate:usersdelete:userscreate:usersread:user_idp_tokensread:organizationscreate:organization_invitations0.2. Configuring the Machine to Machine applicationWe need to integrate Auth0 with a machine-to-machine (M2M) application. This library
will use this Machine to Machine application to be able to communicate with
the API we configured above for two purposes:Registering users.Reading organizations and hook them with edx-platform.This application doesn't require extra configuration.NOTEThe Client ID and Secret of this application are going to be added toTAHOE_IDP_CONFIGSsettings.0.3. Hooking the Machine to Machine application with the APIGo to the settings page of your API. ClickMachine to Machine Applicationstab and:Authorize your Machine to Machine application created in the previous step to use the API.Allow this Machine to Machine application to use all the permission specified above from this API.0.4. Create Regular Web ApplicationThis application is the primary application our edX platoform is going to use
to authenticate users.For theAllowed Callback URLsuse something similar to thishttp://*.devstack.site:18000/auth/complete/tahoe-idp/or configure yours.For theAllowed Logout URLsuse something similar to thishttp://localhost:18000/or configure yours.NOTEThe Client ID and Secret of this application are going to be used in the
edx-platform Admin settings.0.5. Configure the OrganizationEach organization is going to be mapped to a single edx-platform organization.The Auth0 organization ID (Similar toorg_1Ab2Cd3) should be saved intoadminconfig in Site Configuration.Save the organization ID to create a connection later.0.6. Configure the ConnectionGo to your tenant'sAuthentication > Databasesection, and create a custom
connection for your organization.Connection name must becon-{org_id}(For examplecon-1Ab2Cd3).Save the connection ID inIDP_CONNECTION_IDtheadminconfig in Site Configuration.SetRequires Usernameto true and its maximum length to 30 to match current edX setup.In the Applications tab of your connection; Allow yourRegular Web ApplicationandMachine to Machine.Go back to the settings page of the organization you just created, clickConnection, then:Enable the connection you created above.Make sure to "Enable Auto-Membership"You should be all set now.1. Install1.1. ProductionTo use this library in production, add the following to you Ansible deployment:EDXAPP_EXTRA_REQUIREMENTS:-name:'git+https://github.com/appsembler/tahoe-idp.git#egg=tahoe-idp'1.2. DevstackWe can achieve this using two ways. Both of these methods work in Sultan and
normal Docker setup:1.2.1. A quick setup (not persistent).cd/path/to/devstack
makelms-shell
pipinstallgit+https://github.com/appsembler/tahoe-idp1.2.2. SultanIn your sultan in configurations file (configs/.configs.<username>), append
the repo path toEDXAPP_EXTRA_REQUIREMENTS:EDXAPP_EXTRA_REQUIREMENTS="...,https://github.com/appsembler/tahoe-idp.git,..."Then on your host machine run the following command:sultaninstancereconfigureNOTEUsing this method requires you to manually installpython-jose==3.2.0in LMS shell$ make lms-shell
$ pip install python-jose==3.2.0  # version 3.3.0 won't work on python 3.52. Configure the edX appThis package is following edx-platform plugin architecture. Checkplugins#0b4072bdocumentation for more info on plugins.In youredxapp-envs/lms.yml:EDXAPP_EXTRA_REQUIREMENTS:-name:"tahoe-idp"FEATURES:...ENABLE_TAHOE_IDP:true...THIRD_PARTY_AUTH_BACKENDS:["tahoe_idp.backend.TahoeIdpOAuth2"]TAHOE_IDP_CONFIGS:DOMAIN:<domain>API_CLIENT_ID:<client id>API_CLIENT_SECRET:<client secret>...Settings DescriptionTHIRD_PARTY_AUTH_BACKENDS: Tell Django to use this backend when attempting to authenticate a user.FEATURES: edX platform features settingsENABLE_TAHOE_IDP: A switch to enable/disable this plugin. We will use this value if and only ifENABLE_TAHOE_IDPis not defined in Site Configurations.TAHOE_IDP_CONFIGSA parent node of Auth0 settings. If not configured while the plugin is enabled, we will raise an error.DOMAIN: Your Auth0 Domain assigned to you when creating the tenant, or your configuredCustom Domain.API_CLIENT_ID: The client ID of your Auth0Machine to Machineapp. Fetched fromAuth0 Site > Applications > Applications > Your Machine to Machine App > Client IDAPI_CLIENT_SECRET: The client Secret of your Auth0Machine to Machineapp. Fetched fromAuth0 Site > Applications > Applications > Your Machine to Machine App > Client SecretNow runmake dev.up, orsultan devstack upif you're using Sultan.NOTEYou might need to restart your devstack at this point usingmake lms-restart3. Admin Panel ConfigurationsAt this stage, you were able to hook the library with Open edX, to finalize
the setup, you need to add some additional configurations in your LMS admin
panel.In your browser, head tohttp://localhost:18000/adminGo toTHIRD-PARTY AUTHENTICATION > Provider Configuration (OAuth).ClickAdd Provider Configuration.CheckEnabled.For theNamefield, we're going to call itAuth0.CheckSkip registration form(This library will handle this).CheckSkip email verification(Auth0 will handle this).CheckVisible.Choosetahoe-idpin theBackend Namefield.Insert your Auth0Regular Web Application'sClient IDandClient Secret.InOther Settings, insert the following:{"SCOPE":["openid profile email"]}NOTEUsing these scopes will make sure edX Platform can read the user's email
and profile from Auth0.4. Auth0's Django tutorialThe implementation in this project was based on the Auth0's Django tutorial here:https://auth0.com/docs/quickstart/webapp/django/01-login#configure-auth0