Add OIDC login via social-auth #2550

jkachel · 2025-02-24T21:43:10Z

What are the relevant tickets?

Closes mitodl/hq#6586

Description (What does it do?)

Configures the authentication pipeline to work with OIDC (Keycloak) based authentication.

A Keycloak instance is necessary for testing this. See the README-keycloak.md for setup instructions. (It is not the same as it is elsewhere! Hopefully it's better/easier to follow.) The sample instance that exists elsewhere has been migrated here to make testing easier. Or, you can also use a different Keycloak instance, including one that is part of some other app (like Learn or Unified Ecommerce).

When completed and enabled, users will be given the option of logging in via email or Keycloak:

Email login works as it did. Users can sign up, run forgot password, sign in via email, etc. all as before.
Keycloak login will bounce the user over to Keycloak to authenticate, and then they will return to MITx Online. If the user's account doesn't exist, it will be created. Users will not have to verify their email addresses in MITx Online. Users will have to complete the MITx Online-specific profile loading process when they try to do certain operations (enroll, etc.).

We don't have design for this but the choice screen just gives you a couple buttons to direct the user.

This does not depend on APISIX at all. However, if this is sitting behind a correctly configured APISIX instance and the user's already logged in, the user should just get bounced straight back from Keycloak. But the app will not pick up an existing APISIX session.

Screenshots (if appropriate):

Login interstitial:

How can this be tested?

Set EXPOSE_OIDC_LOGIN to True in your .env.
Configure the OIDC settings appropriately. See the README-keycloak.md for instructions.
Follow the instructions for configuring the provided Keycloak instance or configure the app to use an external one. See the notes in README-keycloak.md if you're going to use a separate Keycloak instance on the same machine.
Go to the app, and click Login.
You should see the interstitial above.
Clicking Sign In with Email should take you to the normal sign-in workflow - this should work as expected, with no changes.
Clicking Sign In with Keycloak should redirect you to Keycloak to sign in. Upon returning to the app, you should be logged in. If your account didn't exist in MITx Online before, it should be created.
Clicking Log Out should redirect you into Keycloak for logout.

Additional Context

This doesn't tackle grabbing an APISIX session. Different middleware is needed for this.

gitguardian · 2025-02-24T21:43:15Z

⚠️ GitGuardian has uncovered 8 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
13777604	Triggered	Generic High Entropy Secret	`366ab54`	config/keycloak/realms/default-realm.json	View secret
13777605	Triggered	Generic High Entropy Secret	`366ab54`	config/keycloak/realms/default-realm.json	View secret
13777606	Triggered	Generic Private Key	`366ab54`	config/keycloak/tls/tls.key	View secret
13777607	Triggered	Generic High Entropy Secret	`366ab54`	config/keycloak/realms/default-realm.json	View secret
13777608	Triggered	Generic High Entropy Secret	`366ab54`	config/keycloak/realms/default-realm.json	View secret
13777609	Triggered	Generic Password	`366ab54`	config/keycloak/realms/default-realm.json	View secret
13777610	Triggered	Generic High Entropy Secret	`366ab54`	config/keycloak/realms/default-realm.json	View secret
10259317	Triggered	Generic Password	`366ab54`	docker-compose.yml	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secrets safely. Learn here the best practices.
Revoke and rotate these secrets.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

rhysyngsun

Code review

users/models.py

users/management/commands/promote_user.py

frontend/public/src/containers/pages/login/LoginPages.js

authentication/pipeline/user.py

rhysyngsun

Code looks good, I need to do a bit of setup locally to be able to test

rhysyngsun · 2025-03-14T19:20:02Z

authentication/views.py

+        ).first()
+
+        if not user_social_auth_record:
+            return False


This should probably be None.

resolved in 647bf32

rhysyngsun

Once again I got sidetracked with learn stuff, but here's one small issue I hit working on getting this branch running.

rhysyngsun · 2025-03-17T20:23:18Z

docker-compose.yml

+      - ${KEYCLOAK_PORT}:${KEYCLOAK_PORT}
+      - ${KEYCLOAK_SSL_PORT}:${KEYCLOAK_SSL_PORT}


Could you give these default values too? docker compose is requiring them even if I'm not using the keycloak file since it invalidates the config.

resolved in 95dec4a

- Adding in Keycloak instance stuff (mostly copied from UE/Learn but with some reworked documentation) - Added ol_open_id_connect backend, from Learn, but also captures the global_id (Keycloak ID) - Added global_id to the user model - Started in on situating the user for non-API-driven login requests - Added an interstitial to the login screen to allow the user to choose email or keycloak This is not particularly usable because OIDC needs feature-flagging. We don't want users trying to log in via Keycloak right yet. (It's also not done. Users get created, that's about it.) The existing custom parts of the pipeline check to make sure their backend is the one they expect before doing things, so the strategy is to add in basically the existing Python Social Auth pipeline things that would normally be there, but wrapping them so they only run if we're authenticating via OIDC. This should allow the existing email-based flow to work while also allowing OIDC to function alongside it.

- Fixed an issue with the global_id field; using _create_user should also fill it if it's a non-OIDC user - Added the promote_user command from UE - Added EXPOSE_OIDC_LOGIN; if this is not set, the OIDC workflow won't be shown on login (but isn't disabled) - Worked out bugs in the pipeline and now should create the user correctly (i.e. set is_active = True) when logging in via OIDC - Updating logout to bounce through Keycloak - Updated frontend to hide the first interstitial step if OIDC is disabled - Tested with external Keycloak - Added more docs for external Keycloak, override sample, and updates to the regular docs

for more information, see https://pre-commit.ci

…ne step

…at/lint fixes

- On logout, users without a social-auth (meaning local only) were getting redirected to Keycloak erroneously; the URL building process failed here so this just results in an error; now check to see if they're actually a social auth user and redirect appropriately - Remove choice option for login - if we're doing OIDC, then no email login at all; the buttons in the header both send you to keycloak - Updated some comments for is_active flag in User (we'll need to make some changes after fully rolling to SSO auth)

…d and tighten up the length of it Once users are migrated to Keycloak, we should probably add the unique back on global_id (and/or change it to a UUIDField).

for more information, see https://pre-commit.ci

rhysyngsun

LGTM

jkachel marked this pull request as ready for review February 26, 2025 21:48

jkachel added Needs Review product:mitx-online labels Feb 26, 2025

rhysyngsun self-assigned this Mar 3, 2025

rhysyngsun requested changes Mar 3, 2025

View reviewed changes

users/models.py Outdated Show resolved Hide resolved

users/management/commands/promote_user.py Outdated Show resolved Hide resolved

frontend/public/src/containers/pages/login/LoginPages.js Outdated Show resolved Hide resolved

authentication/pipeline/user.py Outdated Show resolved Hide resolved

rhysyngsun added Waiting on Author and removed Needs Review labels Mar 3, 2025

jkachel force-pushed the jkachel/add-social-auth-keycloak branch from bd5b54f to d78e643 Compare March 5, 2025 20:48

jkachel requested a review from rhysyngsun March 6, 2025 16:06

rhysyngsun reviewed Mar 14, 2025

View reviewed changes

rhysyngsun requested changes Mar 17, 2025

View reviewed changes

jkachel force-pushed the jkachel/add-social-auth-keycloak branch from 56be789 to a3e705d Compare March 18, 2025 15:56

jkachel and others added 15 commits March 25, 2025 14:02

[pre-commit.ci] auto fixes from pre-commit.com hooks

adeced1

for more information, see https://pre-commit.ci

Update app.json, fix user factory, fix issue with get_username pipeli…

a32914f

…ne step

Cleaning up a code path, adding tests for oidc user creation, JS form…

7ec52a8

…at/lint fixes

add oidc url to the settings type

bc581b3

Removing some debug logging

e04ab2d

Fix flow error

5ccb2db

fix flow errors

0b08363

Refactor promote_user to use subparsers, de-unique the global_id fiel…

a2a9c37

…d and tighten up the length of it Once users are migrated to Keycloak, we should probably add the unique back on global_id (and/or change it to a UUIDField).

Set global_id to empty string

35a0ff8

Add defaults to ports for Keycloak container

7e0da94

[pre-commit.ci] auto fixes from pre-commit.com hooks

0f29ebe

for more information, see https://pre-commit.ci

Fix return for keycloak logout URL

7ad86b8

jkachel force-pushed the jkachel/add-social-auth-keycloak branch from 647bf32 to 7ad86b8 Compare March 25, 2025 19:02

rhysyngsun approved these changes Mar 26, 2025

View reviewed changes

jkachel merged commit 53b1880 into main Mar 26, 2025
7 checks passed

jkachel deleted the jkachel/add-social-auth-keycloak branch March 26, 2025 17:07

odlbot mentioned this pull request Mar 28, 2025

Release 0.113.2 #2576

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add OIDC login via social-auth #2550

Add OIDC login via social-auth #2550

jkachel commented Feb 24, 2025 •

edited

Loading

gitguardian bot commented Feb 24, 2025 •

edited

Loading

rhysyngsun left a comment

rhysyngsun left a comment

rhysyngsun Mar 14, 2025

jkachel Mar 18, 2025

rhysyngsun left a comment

rhysyngsun Mar 17, 2025

jkachel Mar 18, 2025

rhysyngsun left a comment

		- ${KEYCLOAK_PORT}:${KEYCLOAK_PORT}
		- ${KEYCLOAK_SSL_PORT}:${KEYCLOAK_SSL_PORT}

Add OIDC login via social-auth #2550

Add OIDC login via social-auth #2550

Conversation

jkachel commented Feb 24, 2025 • edited Loading

What are the relevant tickets?

Description (What does it do?)

Screenshots (if appropriate):

How can this be tested?

Additional Context

gitguardian bot commented Feb 24, 2025 • edited Loading

⚠️ GitGuardian has uncovered 8 secrets following the scan of your pull request.

rhysyngsun left a comment

Choose a reason for hiding this comment

rhysyngsun left a comment

Choose a reason for hiding this comment

rhysyngsun Mar 14, 2025

Choose a reason for hiding this comment

jkachel Mar 18, 2025

Choose a reason for hiding this comment

rhysyngsun left a comment

Choose a reason for hiding this comment

rhysyngsun Mar 17, 2025

Choose a reason for hiding this comment

jkachel Mar 18, 2025

Choose a reason for hiding this comment

rhysyngsun left a comment

Choose a reason for hiding this comment

jkachel commented Feb 24, 2025 •

edited

Loading

gitguardian bot commented Feb 24, 2025 •

edited

Loading