| Both sides previous revision Previous revision Next revision | Previous revision |
| en:2.0:single_sign_on:oidc_mediawiki [2026/09/08 17:10] – [TL;DR; - Quick Overview] kainhofer | en:2.0:single_sign_on:oidc_mediawiki [2026/09/08 17:58] (current) – [Caveats and Things to Consider] kainhofer |
|---|
| * Copy both the ClientID and the Client Secret from Admidios client config to the MediaWiki config file. | * Copy both the ClientID and the Client Secret from Admidios client config to the MediaWiki config file. |
| * Enter the redirect URL of Mediawiki in Admidio: 'https://[[YOUR_MEDIAWIKI]]/index.php/Special:PluggableAuthLogin'. | * Enter the redirect URL of Mediawiki in Admidio: 'https://[[YOUR_MEDIAWIKI]]/index.php/Special:PluggableAuthLogin'. |
| * Many open source OIDC clients do not support encryption (PKCE, which is a security mechanism that prevents attackers from obtaining access unless their application started the initial login). By default, PKCE is required by Admidio, so in this case make sure that the requirement checkbox is turned off. Otherwise you will get an error. | |
| * Optionally select (both in Admidio and the RP) which **profile fields should be mapped** to OpenID claims (attributes) and sent to the client, and configure which **group memberships** should be transmitted. | * Optionally select (both in Admidio and the RP) which **profile fields should be mapped** to OpenID claims (attributes) and sent to the client, and configure which **group memberships** should be transmitted. |
| |
| 'clientsecret' => 'RkMS+6tlpQQ5yow5PlQQTFRcOMC0XCU/', | 'clientsecret' => 'RkMS+6tlpQQ5yow5PlQQTFRcOMC0XCU/', |
| 'scope' => ['openid', 'email', 'profile', 'address', 'phone', 'groups', 'custom'], | 'scope' => ['openid', 'email', 'profile', 'address', 'phone', 'groups', 'custom'], |
| 'authMethods' => ['client_secret_post'] | 'authMethods' => ['client_secret_post'], |
| | 'codeChallengeMethod' => 'S256' |
| ], | ], |
| 'groupsyncs' => [ | 'groupsyncs' => [ |
| This is a typical configuration of the MediaWiki OpenID client in Admidio: | This is a typical configuration of the MediaWiki OpenID client in Admidio: |
| {{ :en:2.0:sso:sso_oidc_mediawiki_02_client.png?direct&600 |}} | {{ :en:2.0:sso:sso_oidc_mediawiki_02_client.png?direct&600 |}} |
| | {{ :en:2.0:sso:sso_oidc_mediawiki_02_client2.png?direct&600 |}} |
| |
| The clientID and the client secret in the Admidio client page and MediaWiki's ''LocalSettings.php'' have to match exactly. Similarly, the scopes should coincide, otherwise not all desired profile fields will be transmitted. To make use of the group mapping in MediaWiki, make sure to include the 'groups' scope in Admidio and Mediawiki, and map the 'Roles - roles' Profile Field to an OIDC claim. | The clientID and the client secret in the Admidio client page and MediaWiki's ''LocalSettings.php'' have to match exactly. Similarly, the scopes should coincide, otherwise not all desired profile fields will be transmitted. To make use of the group mapping in MediaWiki, make sure to include the 'groups' scope in Admidio and Mediawiki, and map the 'Roles - roles' Profile Field to an OIDC claim. |
| ==== Caveats and Things to Consider ==== | ==== Caveats and Things to Consider ==== |
| |
| * MediaWiki allows **admin login** through OpenID by assigning the **group 'sysop'** in the group mapping. The 'groups' scope must be included in both Admidio's as well as MediaWiki's config, and Admidio's role must be included as an OIDC claim. | * MediaWiki allows **admin login** through OpenID by assigning the **group 'sysop'** in the group mapping. The 'groups' scope must be included in both Admidio's as well as MediaWiki's config, and Admidio's role must be included as an OIDC claim.<code php>[..., |
| | 'groupsyncs' => [ |
| | [ |
| | 'type' => 'syncall', |
| | // List of locally managed groups by default contain 'sysop', |
| | // so administrators would never sync from Admidio -> clear it! |
| | 'locallyManaged' => [], |
| | 'groupAttributeName' => 'groups', |
| | ]] |
| | </code>{{ :en:2.0:sso:sso_oidc_mediawiki_02_client3_sysop.png?400 |}} |
| * By default, MediaWiki will use basic http authentication for its calls to the authorization and token endpoints, which means that no special characters (in particular colons) are allowed. Unfortunately, the client ID will be used as username, which typically contains a colon in 'https://...'. The OpenID specification states that the colon is the separator between username and passphrase (client secret), so Admidio will incorrectly assume 'https' to be the username and everything else is the client secret... The two possible solutions are to (1) either not use the full URL, but any other unique identifier without a colon as clientID, or (2) switch MediaWiki to the 'client_secret_post' authMethod in the MediaWiki's ''LocalSettings.php'' configuration file (see the example above, which already contains this fix). | * By default, MediaWiki will use basic http authentication for its calls to the authorization and token endpoints, which means that no special characters (in particular colons) are allowed. Unfortunately, the client ID will be used as username, which typically contains a colon in 'https://...'. The OpenID specification states that the colon is the separator between username and passphrase (client secret), so Admidio will incorrectly assume 'https' to be the username and everything else is the client secret... The two possible solutions are to (1) either not use the full URL, but any other unique identifier without a colon as clientID, or (2) switch MediaWiki to the 'client_secret_post' authMethod in the MediaWiki's ''LocalSettings.php'' configuration file (see the example above, which already contains this fix). |
| |
