Currently, authencticator supports binding to LDAP to check a username and password. It provides clients with OAuth2-compliant endpoints to authenticate users. The point of this extension is to support additional types of Identity Provider systems (IdPs); specifically, IdPs backed by OAuth2 provider servers.
The primary use cases for this feature include:
Supporting the custom IdP for the CII tenant, being developed as an OAuth2 provider server
Support for login with InCommon, for example, via the Custos project.
Support for login with other major OAuth providers, such as Github.
A full write-up on the background and design for this feature is included in this google doc
Tasks in this Issue:
[x] Design and extend the custom configs jsonschema to support OAuth IdP extensions.
[x] Implement an OAuth2ProviderExtension class with basic utilities for interacting with an OAuth2 provider server.
[x] Implement GET /v3/oauth2/extensions/oa2/callback as the OAuth2ProviderExtCallback controller
[x] Update WebappTokenAndRedirect in controllers.py to check for OAuth2 extension config.
[x] Make any updates to create_clients_for_tenant() and associated call chain.
[x] Update the TenantConfigResource to allow any tenant to be selected, including tenants with custom OA2 IdPs.
[x] Configure a github tenant and test with callbacks for localhost, developm staging and production.
joestubbs
commented
2 years ago
Currently, authencticator supports binding to LDAP to check a username and password. It provides clients with OAuth2-compliant endpoints to authenticate users. The point of this extension is to support additional types of Identity Provider systems (IdPs); specifically, IdPs backed by OAuth2 provider servers.
The primary use cases for this feature include:
A full write-up on the background and design for this feature is included in this google doc
Tasks in this Issue: