I would love to be able to configure the used claim for the resulting username in the database. By default, this is the email claim. On my setup, emails and usernames are modifiable by users. That's why I use the sub claim as the username in other apps. For example, Grafana offers the name_attribute_path config value for their OAuth configuration. In alf.io I'd love a corresponding openid.usernameClaim config value.
500 error without any logs (OpenID values are not properly set)
If above error is fixed, the OIDC provider (Keycloak) will most likely return an error since the requested scopes are actual claims that don't exist as scopes.
Expected behavior
Be redirected to Keycloak, being able to login, and be returned to the admin page.
Desktop (please complete the following information):
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
Describe the bug There are several issues with the current OpenID Implementation. I'm using Keycloak v17.0.2 as OIDC provider:
The values read from
application.properties
do not match the values described in the documentation. These are the actual values read fromapplication.properties
: https://github.com/alfio-event/alf.io/blob/2.0-M4-2204/src/main/java/alfio/manager/openid/OpenIdConfiguration.java#L81-L93 And these are the values described in the documentation: https://github.com/alfio-event/alf.io/blob/2.0-M4-2204/website/content/en/docs/Configuration/OpenID/_index.mdThe docs don't mention that you need to enable the
openid
Spring profile.The docs mention that organization fields should be specified as
organization1/SPONSOR
, however the parsing code actually expects 3 parts, separated by/
: https://github.com/alfio-event/alf.io/blob/2.0-M4-2204/src/main/java/alfio/manager/openid/AdminOpenIdAuthenticationManager.java#L147-L148 A workaround is to instead specify the organization as/organization1/SPONSOR
but I don't think this is intended.Alf.io expects a client scope per claim specified in the
.properties
file. This is usually not how scopes and claims are used. Relevant code: https://github.com/alfio-event/alf.io/blob/2.0-M4-2204/src/main/java/alfio/manager/openid/AdminOpenIdAuthenticationManager.java#L122-L128 Instead, users should be able to specify requested scopes in theapplication.properties
file likeopenid.scopes=openid,email,myprofile
. For example, check out how Grafana implements Generic OAuth: https://grafana.com/docs/grafana/latest/auth/generic-oauth/ The workaround is to create a dummy client scope per used claim in Keycloak.I would love to be able to configure the used claim for the resulting username in the database. By default, this is the
email
claim. On my setup, emails and usernames are modifiable by users. That's why I use thesub
claim as the username in other apps. For example, Grafana offers thename_attribute_path
config value for their OAuth configuration. In alf.io I'd love a correspondingopenid.usernameClaim
config value.To Reproduce Steps to reproduce the behavior:
openid
Spring profileExpected behavior Be redirected to Keycloak, being able to login, and be returned to the admin page.
Desktop (please complete the following information):