✨(oidc) people as an identity provider #638
Draft
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
qbey
force-pushed
the
qbey/people-as-identity-provider
branch
2 times, most recently
from
799ef24 to
3a2f5a4
Compare
qbey
force-pushed
the
qbey/people-as-identity-provider
branch
6 times, most recently
from
254f735 to
8bf6095
Compare
I know, in 2025 we should not consider first name and last name but to allow to use the project as an identity provider, we need to send those data. For code preservation, we keep the "name" field as a generated field so the code continues to consider only a "name".
This allows to use `people` as an identity provider using OIDC and local users. This commit is partial, because it does not manage a way to create "local" users and the login page is the admin one, which can't be used for non staff users or login with email.
This configures local environment to test login through people: - Keycloak configuration of the IdP (people) - Add Keycloak Application in people The only user who can login for now is "admin".
qbey
force-pushed
the
qbey/people-as-identity-provider
branch
from
8bf6095 to
f1f2bf4
Compare
To have a better user experience, we want the login page to in the frontend.
Allow to access the `/o` URLs related to the OIDC authentication when using people as an indentity provider.
Few fixes to allow the keycloak dev stack to use people as an Identity Provider. This requires the update of the bitnami keycloak chart we use.
This is making too much noise when developing using the tilt stack...
qbey
force-pushed
the
qbey/people-as-identity-provider
branch
from
f1f2bf4 to
a065570
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Purpose
We want the people user database to also be an Identity Provider.
Ref:
Proposal
This is the very first step toward this goal:
given_nameandusual_nameinstead ofnamefor ProConnect => Split full name in the user model :(acrto refuse higher level thaneidas1when requested by ProConnect (comes from the SP)login_hintfor the login page (and don't allow email field edition?)