Added OIDC login

.env

@@ -33,6 +33,27 @@ MERCURE_JWT_SECRET="!ChangeThisMercureHubJWTSecretKey!"
 CORS_ALLOW_ORIGIN='^https?://(localhost|127\.0\.0\.1)(:[0-9]+)?$'
 ###< nelmio/cors-bundle ###
 
+# Set this to a non-empty value in .env.local to disable the OIDC service.
+# DOCKER_OIDC_DISABLE=""
+
 DEFAULT_LOCALE=en
 
 SITE_TITLE="RPA Process Overview"
+DEFAULT_URI=https://rpa-process-overview.local.itkdev.dk/
+
+# https://github.com/itk-dev/openid-connect-bundle
+# "admin" open id connect configuration variables (values provided by the OIDC IdP)
+# For production, these must be overridden in .env.local.
+ADMIN_OIDC_ALLOW_HTTP=true
+ADMIN_OIDC_METADATA_URL=http://idp.rpa-process-overview.local.itkdev.dk/.well-known/openid-configuration
+ADMIN_OIDC_CLIENT_ID=client-id
+ADMIN_OIDC_CLIENT_SECRET=client-secret
+ADMIN_OIDC_REDIRECT_URI=https://rpa-process-overview.local.itkdev.dk/
+ADMIN_OIDC_LEEWAY=30
+ADMIN_OIDC_ROLE_MAP='{
+  "overview-manager": ["ROLE_OVERVIEW_MANAGER"]
+}'
+
+# cli redirect url
+OIDC_CLI_LOGIN_ROUTE=app_default
+###< itk-dev/openid-connect-bundle ###

CHANGELOG.md

@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+* [PR-10](https://github.com/itk-dev/rpa-process-overview/pull/10)
+  Added OIDC login
 * [PR-9](https://github.com/itk-dev/rpa-process-overview/pull/9)
   Tailwind classes in twig and svelte files
 * [PR-8](https://github.com/itk-dev/rpa-process-overview/pull/8)

README.md

@@ -73,10 +73,42 @@ curl -H "Origin: http://127.0.0.1:3000/ProcessOverview?page=3" \
 
 ## User management
 
-We have a number of commands for managing users. Run
+[Symfony supports OpenID Connect](https://symfony.com/doc/current/security/access_token.html#using-openid-connect-oidc),
+but our IdP does not play well with that. Therefore, we use our own battle-tested [OpenId Connect
+Bundle](https://github.com/itk-dev/openid-connect-bundle) for OIDC login.
 
-``` shell
-task console -- list app:user
+The bundle is configured with some environment variables:
+
+``` dotenv
+# .env.local
+ADMIN_OIDC_ALLOW_HTTP=false
+# Get these from your IdP provider
+ADMIN_OIDC_METADATA_URL=https://…/.well-known/openid-configuration
+ADMIN_OIDC_CLIENT_ID=…
+ADMIN_OIDC_CLIENT_SECRET=…
+
+ADMIN_OIDC_REDIRECT_URI=https://rpa-process-overview.example.com/
+
+ADMIN_OIDC_ROLE_MAP='{
+  "overview-manager": ["ROLE_OVERVIEW_MANAGER"]
+}'
 ```
 
-to see the list of user related commands.
+For local testing of OIDC login, we use [OpenId Connect Server Mock](https://github.com/Soluto/oidc-server-mock) (cf.
+[`docker-compose.oidc.yml`](docker-compose.oidc.yml)) and the mock is running on
+<https://idp.rpa-process-overview.local.itkdev.dk/>.
+
+The mock provides these users (cf. [`docker-compose.oidc.yml`](docker-compose.oidc.yml)):
+
+| Username         | Password         | Roles            |
+|------------------|------------------|------------------|
+| admin            | admin            | administrator    |
+| overview-manager | overview-manager | overview-manager |
+| user             | user             | user             |
+
+> [!TIP]
+> Set `DOCKER_OIDC_DISABLE` to a non-empty value in `.env.local` to disable the OIDC service, e.g.
+>
+> ``` dotend
+> # .env.local
+> DOCKER_OIDC_DISABLE=true

composer.json

@@ -11,6 +11,7 @@
         "doctrine/doctrine-migrations-bundle": "^3.4.2",
         "doctrine/orm": "^3.5.2",
         "easycorp/easyadmin-bundle": "^4.25.1",
+        "itk-dev/openid-connect-bundle": "^4.0",
         "league/uri-components": "^7.5.1",
         "runtime/frankenphp-symfony": "^0.2.0",
         "stof/doctrine-extensions-bundle": "^1.14",