Skip to content

Fix OIDC algorithm #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
G-Pereira wants to merge 4 commits into
base: oidc-rp
Choose a base branch
from
Open

Fix OIDC algorithm #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0834240
Fix OIDC algorithm
G-Pereira May 13, 2026
78f4032
Add JWKS endpoint
G-Pereira May 13, 2026
d17661e
OIDC documentation regarding JWKS endpoint
G-Pereira May 13, 2026
dc30239
Typo
G-Pereira May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docs/POST_INSTALL_STEPS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -275,9 +275,11 @@ MemberMatters can be configured to use your OIDC-enabled Identity provider. You
- OIDC_OP_AUTHORIZATION_ENDPOINT (`MM_OIDC_OP_AUTHORIZATION_ENDPOINT`)
- OIDC_OP_TOKEN_ENDPOINT (`MM_OIDC_OP_TOKEN_ENDPOINT`)
- OIDC_OP_USER_ENDPOINT (`MM_OIDC_OP_USER_ENDPOINT`)
- OIDC_OP_JWKS_ENDPOINT (`MM_OIDC_OP_JWKS_ENDPOINT`)

Optionally set the following to override default functionality:
- MM_OIDC_CREATE_USER: Default value is `True`. Set to `False` if you prefer that your MemberMatters admin create or import new users manually before the account can authenticate using OIDC
- MM_OIDC_TOKEN_EXPIRY: Default value is 3600. Override to extend or shorten the validity window of the user's authentication token (time in seconds).
- MM_OIDC_RP_SIGN_ALGO: Default value is "RS256". Override to use another sign algorithm.

Finally, enable the `ENABLE_OIDC_RP` toggle in the Django constance config panel. Now, when presented with the login screen a user would click "Login with OAuth" to authenticate via OIDC.
2 changes: 2 additions & 0 deletions memberportal/membermatters/settings.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,13 +37,15 @@

### mozilla-django-oidc config
# get these from your IDP
OIDC_RP_SIGN_ALGO = os.environ.get("MM_OIDC_SIGN_ALGO", "RS256")
OIDC_RP_CLIENT_ID = os.environ.get("MM_OIDC_CLIENT_ID", None)
OIDC_RP_CLIENT_SECRET = os.environ.get("MM_OIDC_CLIENT_SECRET", None)
OIDC_OP_AUTHORIZATION_ENDPOINT = os.environ.get(
"MM_OIDC_OP_AUTHORIZATION_ENDPOINT", None
)
OIDC_OP_TOKEN_ENDPOINT = os.environ.get("MM_OIDC_OP_TOKEN_ENDPOINT", None)
OIDC_OP_USER_ENDPOINT = os.environ.get("MM_OIDC_OP_USER_ENDPOINT", None)
OIDC_OP_JWKS_ENDPOINT = os.environ.get("MM_OIDC_OP_JWKS_ENDPOINT", None)
# Set the following to False if you want your MM admin to create a user & profile (matches on email address) instead of creating from the Idp
OIDC_CREATE_USER = os.environ.get("MM_OIDC_CREATE_USER", True)
# Extend token validity window, default is 15 minutes
Expand Down