This plugins implements an OpenID Connect autorization server for Galette. This allows registered members in a Galette instance to log into third party websites, which implement OpenID Connect or OAuth2 protocols, such as:
-
any path served by Apache, which may be protected using mod_auth_openidc,
-
and so on!
This plugin is mainly a derivative work from the great original Galette OAuth2 plugin written by Manuel Hervouet.
This project uses league/oauth2-server, nl.idaas/openid-server,
symfony/yaml and hassankhan/config packages.
To automatically download these packages:
cd plugin-openidc
composer installcd plugin-openidc/config
openssl genrsa -out private.key 2048
openssl rsa -in private.key -pubout -out public.key
chmod 660 *.key
Generate an encryption key, which will be used to encrypt tokens:
vendor/bin/generate-defuse-keyThis will result in an hexadecimal string.
Rename config/config.yml.dist to config/config.yml and edit according to your third party application settings:
global:
password: abc123
encryption_key: def0123456789abcdef # put here the defused key generated above
galette_flarum:
title: 'Forum Flarum'
redirect_logout: 'http://192.168.1.99/flarum/public'
options: teamonly
galette_nc:
title: 'Nextcloud'
redirect_logout: 'http://192.168.1.99/nextcloud'
options: uptodate
galette_xxxxx:Each third party client identifier must be prefixed by galette_, other prefixes will be rejected by the server.
The corresponding Flarum configuration:
The corresponding NextCloud configuration:
- teamonly : only staff members can login
- uptodate : only uptodate members can login
Edit a member : In info_adh field you can add a line with #GROUPS:group1;group2#
Example :
#GROUPS:accouting;home#