I'm working on a project (Catalyst ephemeral testing environment prototype) where we'd like to authenticate with idp.wikimedia.org using OpenID Connect. I see from https://idp.wikimedia.org/oidc/.well-known/openid-configuration that it is enabled.
Please configure a client that we can use for this effort. The redirect URL can initially be set to "https://catalyst-auth.wmcloud.org", however this will change (probably relatively soon).
Thank you!
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| P:idp:services add Catalyst OIDC service | operations/puppet | production | +6 -0 |
Change 973287 had a related patch set uploaded (by Slyngshede; author: Slyngshede):
[operations/puppet@production] P:idp:services add Cicalese OIDC service
I'm creating a new client ID for the service, naming it "catalyst". I'll email the secret when the new service has been reviewed.
@CCicalese_WMF We also have idp.wmcloud.org, it depends a little on the target audience for the service.
Could you provide a little more info on who will be using the service, so we can better determine where it should go?
idp.wmcloud.org would be fine as well. I was not aware of its existence. The Catalyst prototype is being developed on WMCS, so perhaps that is more appropriate. As long as we can authenticate with a Wikimedia developer account using OpenID Connect and query the groups that the user is a member of, we should be good. That appears to be the case for both IdPs. There appear to be more attributes available from idp.wmcloud.org, but both seem to provide the group information we need initially.
Do you need us to limit which groups can authenticate or is the service, or is it open to everyone with a developer account?
I was thinking about the redirect URL. If you could please set it to https://catalyst-auth.wmcloud.org, that's probably a better guess about what we will eventually want it to be. I've updated the task description to reflect that.
catalyst: id: 5 service_class: 'OidcRegisteredService' service_id: 'https://catalyst-auth\.wmcloud\.org(/.*)?' profile_format: 'FLAT'
The Cloud-Services project tag is not intended to have any tasks. Please check the list on https://phabricator.wikimedia.org/project/profile/832/ and replace it with a more specific project tag to this task. Thanks!
I've configured the client to idp.wmcloud.org. The client ID is catalyst and the client secret is in P53310.
Change 973287 abandoned by Slyngshede:
[operations/puppet@production] P:idp:services add Catalyst OIDC service
Reason:
This is handled by Cloud