| Both sides previous revision Previous revision Next revision | Previous revision |
| en:2.0:single_sign_on:oidc_moodle [2026/09/08 18:04] – [Prerequisites] kainhofer | en:2.0:single_sign_on:oidc_moodle [2026/09/08 19:12] (current) – [Setting up the Client (RP) in Admidio] kainhofer |
|---|
| ===== Quick Overview ===== | ===== Quick Overview ===== |
| |
| Setting up a client (OpenID "Relying Party" - short RP) to use Admidio's user accounts for logging in consists of two steps: (1) The client (RP, Moodle in our case) needs to be set up with the data about the OpenID Provider (OP). One has to manually paste the Admidio endpoint URLs of the OpenID provider into the client's configuration. Admidio provides copy buttons in the preferences screen, so this is rather straightforward. (2) Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration. | Setting up a client (OpenID "Relying Party" = "RP") to use Admidio's user accounts for log-in consists of two steps: |
| | - The client (RP, Moodle in our case) needs to be set up with the data about the OpenID Provider (OP). One has to manually paste the Admidio endpoint URLs of the OpenID provider into the client's configuration. Admidio provides copy buttons in the preferences screen, so this is rather straightforward. |
| | - Admidio needs to be told about the client. In particular, the entity ID and the redirect URL must be given, and a custom-generated (random) secret must be copied to the client configuration. |
| |
| The concrete steps are: | The concrete steps are: |
| * At the **Relying Party (RP)** - Moodle in our case - **install the extension** to support OpenID login. | * At the **Relying Party (RP)** - Moodlein our case - **install the extension** to support OpenID login. |
| * Configure it with Admidio's **endpoint URLs** for authentication, token and userinfo, and enter the EntityID. Auto-discover is currently not supported by the Moodle plugin. | * Configure it with Admidio's **endpoint URLs** for authentication, token and userinfo, and enter the EntityID. Auto-discover is currently not supported by the Moodle plugin. |
| * Also, choose which scopes (groups of profile fields) should be requested from Admidio ("openid" is required; Since the OpenID Moodle plugin does not support groups mapping, the "groups" scope is not relevant and has no use, but other profile fields might be useful. | * Also, choose which scopes (groups of profile fields) should be requested from Admidio ("openid" is required; Since the OpenID Moodle plugin does not support groups mapping, the "groups" scope is not relevant and has no use, but other profile fields might be useful.). |
| * In **Admidio**, **create a new OpenID client**. | * In **Admidio**, **create a new OpenID client**. |
| * Choose an easily understood **label for the client** (only used in Admidio's list of clients, but has no technical use) | * Choose an easily understood **label for the client** (only used in Admidio's list of clients, but has no technical use) |
| * Enter the **ClientID from the RP**, Copy the created Client Secret (you will later need to paste it into the Moodle configuration), and enter the **Redirect URI** for the RP. The latter can be found on the plugin's configuration page in Moodle. | * Enter the **ClientID from the RP**, copy the created Client Secret (you will later need to paste it indo DokuWiki's configuration), and enter the **Redirect URI** for the RP. Typically the latter can be found either on the RP's configuration page or in the documentation. |
| * In Admidio, map the user ID, username, email and fullname to fields that are included in the OpenID login response (so-called "claims") and enter the corresponding claim names in Moodle. | * Moodle's OIDC clients does not support encryption (PKCE, which is a security mechanism that prevents attackers from obtaining access unless their application started the initial login). By default, PKCE is required by Admidio, so make sure that the requirement checkbox is turned off. Otherwise you will get an error. |
| | * In Admidio, map the user ID, username, email and fullname to fields that are included in the OpenID login response (so-called "claims") and enter the corresponding claim names in Moodle. |
| | |
| |
| |
| * The **Client Name** is the label of the client in Admidio's client list, it can be anything you like. | * The **Client Name** is the label of the client in Admidio's client list, it can be anything you like. |
| * The **"Client ID"** and **"Client Secret"** in Admidio and Moodle have to match exactly. The ID is typically the client's URL, although some clients allow any unique identifier. The Client Secret should a random string and will serve like a password. Admidio will create one and allow it to be copied to the client. Afterwards it is only stored as a hash in the database and not be recovered any more. However, one can create a new Client Secret in Admidio and copy that to the client's configuration. | * The **"Client ID"** and **"Client Secret"** in Admidio and Moodle have to match exactly. The ID is typically the client's URL, although some clients allow any unique identifier. The Client Secret should a random string and will serve like a password. Admidio will create one and allow it to be copied to the client. Afterwards it is only stored as a hash in the database and not be recovered any more. However, one can create a new Client Secret in Admidio and copy that to the client's configuration. |
| | * Moodle's OIDC plugin does not support PKCE, so it must be disabled for the OIDC client in Admidio to prevent errors. |
| * Enter the **scopes** you desire in the Moodle config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it). If group support is desired, the "groups" scope must be included (and the corresponding groups claim mapped, and group support selected in the Moodle config). | * Enter the **scopes** you desire in the Moodle config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it). If group support is desired, the "groups" scope must be included (and the corresponding groups claim mapped, and group support selected in the Moodle config). |
| |
| Now save the Identity Provider Settings in Moodle and return to the general OpenID connect settings of the plugin (''https://[YOUR_MOODLE]/admin/category.php?category=oidcfolder''). | Now save the Identity Provider Settings in Moodle and return to the general OpenID connect settings of the plugin (''https://[YOUR_MOODLE]/admin/category.php?category=oidcfolder''). |
| |
| * Moodle will display its **Redirect URL** in the "Basic settings" section that must be entered in Admidio's settings. Enter this URL in Admidio.{{ :en:2.0:sso:sso_moodle_oidc_04_plugin_settings.png?direct&800 |}} | * Moodle will display its **Redirect URL** in the "Basic settings" section that must be entered in Admidio's settings. Enter this URL in Admidio.{{ :en:2.0:sso:sso_moodle_oidc_04_plugin_settings.png?direct&600 |}}{{ :en:2.0:sso:sso_moodle_oidc_04_plugin_settings_redirecturl.png?600 |}} |
| * Most of the other options can be used for fine-tuning, but in most cases do not need to be changed. | * Most of the other options can be used for fine-tuning, but in most cases do not need to be changed. |
| |
| |
| |
| | ==== Configuring Single-Log-Out ==== |
| |
| | {{ :en:2.0:sso:sso_moodle_oidc_11_plugin_singlelogout.png?400 |}} |
| ===== Setup completed, test Single-Sign-On ===== | ===== Setup completed, test Single-Sign-On ===== |
| |
