Skip to content

Latest commit

 

History

History
152 lines (109 loc) · 6.47 KB

openid-auth.md

File metadata and controls

152 lines (109 loc) · 6.47 KB

Configuring OpenID authentication

The purpose of this guide is to demonstrate the process of configuring an OpenID application as an authentication and authorization source for code-server.

More information regarding how OpenID Connect works can be found here:

Prerequisites

Auth0 OpenID Connect application setup

Creating the application

  1. Navigate to the application management section of your Auth0 dashboard at https://manage.auth0.com/dashboard/us/{{auth0_account_name}}/applications
  2. Click the Create Application button in the top right of the page.
  3. Either provide a name for this application or use the default, then select Regular Web Application as the application type and click the blue Create button.

Gather the client ID

  1. Make note of the Client ID value. This value will be used in the code-server openid-client-id configuration variable.

Update the application URLs

  1. Update the Allowed Callback URL and Allowed Logout URLs fields so that they point to the correct code-server endpoint.

Example Auth0 code-server configuration

NOTE: The openid-issuer-base-url should be set to the value of the Domain field of the Okta application.

bind-addr: 127.0.0.1:8080
cert: false

auth: openid
openid-issuer-base-url: "https://cdr.auth0.com"
openid-client-id: "yg3IIz2alcikRqjqOsnRJABn8Uthfrtv"
openid-base-url: "http://localhost:8080"
openid-secret: "{prerequisites_openid-secret_value}"

Okta OpenID Connect application setup

Creating the application

  1. Navigate to the Add Application page of your Okta dashboard at https://{{okta_account_name}}-admin.okta.com/admin/apps/add-app
  2. Click the Create New App button located in the upper right of the page.
  3. Set the Platform to Web and Sign on method to OpenID Connect. Then click Create

Update the application

  1. Update the Application name field with the desired name for this application.
  2. Update the Login redirect URIs and Logout redirect URIs (Optional) fields so that they point to the correct code-server endpoint then click Save
  3. To update the Allowed grant types start by navigating to the General Settings section and clicking the Edit link in the top right corner of the section card.
  4. Once in the edit view, locate the Allowed grant types checkbox list and make sure the boxes for Implicit (Hybrid) and Allow ID Token with implicit grant type are checked, then scroll to the bottom of the page and click Save.
  5. Lastly, ensure a user is assigned to this application by navigating to the Assignments tab, clicking on Assign, then selecting Assign to People.

Gather the client ID

  1. Make note of the Client ID value. This value will be used in the code-server openid-client-id configuration variable.

Example code-server configuration

NOTE: The openid-issuer-base-url should be set to the value of the Okta domain field of the Okta application.

bind-addr: 127.0.0.1:8080
cert: false

auth: openid
openid-issuer-base-url: "https://cdr.okta.com"
openid-client-id: "0oal8azjyekLwJXan5d6"
openid-base-url: "http://localhost:8080"
openid-secret: "{prerequisites_openid-secret_value}"

Keycloak OpenID Connect client setup

Creating the client

  1. Once logged into the Keycloak instance, navigate to the Clients page by clicking the Clients link in the navigation menu on the left side of the page.
  2. Begin the client creation process by clicking the Create button located in the top right corner of the client list.
  3. Fill out the client creation fields then click Save - Client ID**: This is the value that will later be populated in openid-client-id. This value is entirely up the the user or process creating the client. - Client Protocol: This value should be set to openid-connect - Root URL: This field should be populated with the code-server base URL.

Update the client name

  1. Once the Save button in the Add Client window has been clicked, the client will be created and the page will be redirected to the client settings view. From inside that view proceed to name the newly create client by populating the Name field.
  2. Enable implicit flow by changing Implicit Flow Enabled from OFF to ON.
  3. Scroll to the bottom of the page and click Save.

Example code-server configuration

NOTE: The openid-issuer-base-url will depend on the Keycloak realm. In the example below the realm is called master.

NOTE: The openid-client-id value should be set to the value given to the Client ID when the client was first created.

bind-addr: 127.0.0.1:8080
cert: false

auth: openid
openid-issuer-base-url: "https://keycloak.local/auth/realms/master/.well-known/openid-configuration"
openid-client-id: "example-code-server"
openid-base-url: "http://localhost:8080"
openid-secret: "{prerequisites_openid-secret_value}"