OpenID Connect is an authentication layer on top of OAuth 2.0, an authorization framework. The standard is controlled by the OpenID Foundation.
New in Tiki23. The library used is https://packagist.org/packages/steverhoades/oauth2-openid-connect-client
To enable OpenID Connect
Select Tiki and OpenID Connect from tiki-admin.php?page=login -> General preferences -> Authentication method.
Visit the OpenID Connect tab and fill the preferences page.
Tiki uses OpenID Connect with Authorization Code, after a successful login, the user is redirected to Tiki Login page, and a code is passed as query argument. Tiki will contact the OpenID auth endpoint to exchange the code for the Access Tokens.
The redirect URL should point to tiki-login.php.
OKTA OpenID Connect (example)
To use OKTA services you need to create an account at https://www.okta.com. Okta offer trial accountant once your email validated you will be redirected to your Okta Dashboard.
<SERVER_DOMAIN>: https://my.okta.com
| pref | value | |
| Issuer URL | <SERVER_DOMAIN>/oauth2/default | |
| Provider URL Authorization | <SERVER_DOMAIN>/oauth2/default/v1/authorize | |
| Provider URL user access token | <SERVER_DOMAIN>/oauth2/default/v1/token | |
| JKWS URL | <SERVER_DOMAIN>/oauth2/default/v1/keys | |
Keycloak OpenID Connect (example)
<SERVER_DOMAIN>: https://my.server.com
Realm: master
| pref | value | |
| Issuer URL | <SERVER_DOMAIN>/auth/realms/master | |
| Provider URL Authorization | <SERVER_DOMAIN>/auth/realms/master/protocol/openid-connect/auth | |
| Provider URL user access token | <SERVER_DOMAIN>/auth/realms/master/protocol/openid-connect/token | |
| JKWS URL | <SERVER_DOMAIN>/auth/realms/master/protocol/openid-connect/certs | |
Client ID and Client Secret are provided by the service.
How user is linked
After a successful login and access token retrieved, Tiki will use the user email to match against the existing users.
How user is created
If no user is matched and the preference "Create user if not registered in Tiki" is enabled, Tiki will use the prefered_username or the name, returned in the access_token, to create a new user and login the user right after.
If the username or name, are already in use, Tiki will return an error.
Alias: OIDC