Package: trac-oidc
DescriptionA plugin to support authentication totracusing theOpenID
Connectprotocol.  Currently this probably only works withGoogle’sOpenID Provider.This plugin was written as a partial replacement for theTracAuthOpenId, since Google has (as of mid-June, 2015)discontinued
supportfor authentication usingOpenID 2.0.
Google’sextensionfor mappingOpenID 2.0identifiers toOpenID
Connectidentifiers is used, so sites which previously usedTracAuthOpenIdfor authentication against Googleshouldbe able
to switch to usingtrac-oidcwithout losing track of user’s
settings and permissions.This plugin is tested with trac versions 0.11, 0.12, 1.0, and 1.1.The distribution may be downloaded fromPyPI.
Development takes place atgithub.UsageObtain OAuth 2.0 CredentialsYou must obtainOAuth 2.0 credentialsfrom Google before you can
use this plugin.Go to theGoogle Developers Console.Select a project, or create a new one.In the sidebar on the left, expandAPIs & auth.
Next, clickAPIs.
Select theEnabled APIslink in the API section to see a list
of all your enabled APIs.Optional, but recommended:
Make sure that theGoogle+ APIis on the list of enabled APIs.
If you have not enabled it, select the API from the list of APIs,
then select the Enable API button for the API.  (The Google+ API is
used to retrieve the user’s real name on initial sign in.)In the sidebar on the left, selectCredentials.If you haven’t done so already, create your project’s
OAuth 2.0 credentials by clickingCreate new Client ID,
and providing the information needed to create the credentials.Theredirect URIused by this plugin is the base url for your trac
followed by/trac_oidc/redirect. I.e. if the top of your trac
is athttp://example.org/mytrac, then theredirect URIwill
behttp://example.org/mytrac/trac_oidc/redirect.  If your trac
is available under multiple hostnames, or under bothhttp:andhttps:schemes, then you may need to configure multipleredirect URIs.When all looks copacetic, click theDownload JSONbutton (on
theCredentialspage) to download a JSON file containing the
required client secrets.  Save this file to somewhere where trac
can read it.  By default, the plugin looks for this file under the
nameclient_secret.jsonin theconfsubdirectory of the
trac environment, however this can be configured.  (Since the file
contains sensitive information, consider setting the file
permissions so that not just anybody can read it.)Install the PluginThe plugin is available fromPyPI, so it may be installed,
e.g., usingpip:pip install trac-oidcConfigurationIn yourtrac.ini:[components]

# You must enable the trac_oidc plugin
trac_oidc.* = enabled

# Optional: You probably want to disable the stock login module
trac.web.auth.loginmodule = disabled

[trac_oidc]

# Optional: Specify the path to the client secrets JSON file.
# The default is ``client_secret.json``.  Relative paths are
# interpreted relative to the ``conf`` subdirectory of the trac
# environment (i.e. alongside ``trac.ini``.)
client_secret_file = /path/to/client_secret.json

[openid]

# Optional: This only matters if you would like to migrate
# users created by the TracAuthOpenId_ plugin to this one.
# In that case, the OpenID realm must be set to the same value
# that was used by TracAuthOpenId (where it is called the *trust root*)
# for the identity URLs to be comparable.
#
# If this is set, then the OpenID realm will include just the hostname,
# otherwise the realm will include the full base path of the trac.
# E.g. if you trac is is ``http://example.org:8080/mytrac``, then the realm
# will be ``http://example.org:8080/`` if ``absolute_trust_root`` is set
# and ``http://example.org:8080/mytrac`` if ``absolute_trust_root`` is
# not set.
#
# The default is ``true``.
#
absolute_trust_root = falseMigration from TracAuthOpenIdIf you usedonlyGoogle as the authentication provider withTracAuthOpenId, then you should be able to disableTracAuthOpenId, configure and enabletrac-oidc, and thingsshouldjust work — users should keep their sessions (i.e. they will
retain their settings and permissions.)NoteMake sure not to change the setting ofabsolute_trust_rootfrom
whatever you were using withTracAuthOpenId.If you were using multiple authentication providers withTracAuthOpenId,
it should be possible to run bothTracAuthOpenId(with Google disabled),
andtrac-oidctogether.  I have not tried this, however, and some tuning
will probably be required.To DoPossible improvements.Generalize to work with more providersThough, currently, only authentication via Google’s OP is supported,
it should be straightforward to generalize the plugin to work with otherOpenID Connectproviders, and other authentication services based onOAuth 2.0(e.g. Twitter, Facebook.)Integrate with AccountManagerPluginI’m not sure exactly what’s involved, but it would be nice if theAccountManagerPlugincould be used to administer associations between
OIDC subject identifiers and authenticated sessions, etc.AuthorsJeff DairikiHistory0.1.5 (2015-07-16)If the stocktrac.web.auth.LoginModuleis disabled, then handle
requests for/logintoo (because no one else is going to.)0.1.4 (2015-06-24)FeaturesTests now run under trac 1.1.50.1.3 (2015-06-23)Behavioral ChangesIn the “logged in as %(user)s” message (in themetanavmenu),useris now always set to thesession id(also referred to as theauthname) of the logged-in user.  Previously the real name of the
user was shown instead, when it was available.  This now matches the
behavior of the stockLoginModulecomponent.Bugs FixedTheLogoutlink should now work again.  It was broken for trac >= 1.0.2.Large RefactorLots of code cleanup, including splitting of logic into several
components/classes, include:AuthCookieManager: for managing the trac authentication cookieUserDatabase: for mapping betweenOpenID identitiesand tracauthnames.SessionHelper: for searching and managing authenticated sessionsAuthenticator: for handling theOpenID Connectflow0.1.2 (2015-06-20)FeaturesThe plugin should now work with trac 0.11.Bugs Fixed[trac > 1.0.2] FixedLogoutlink so that it works under trac >
1.0.2.  Recent tracs use a logout form rather than a link (for CSRF
protection.)TestingAdded a functional test.  Run tests with trac version 0.11, 0.12 and
latest (1.0).RefactorRenamedtrac_oidc.pluginmodule totrac_oidc.trac_oidc.
Trac’s default log format string includes"[%(module)s]"—[trac_oidc]is much more informative than[plugin].0.1.1 (2015-06-18)Initial release.  There is no 0.1 (I botched the upload to PyPI).