Skip to content
Menu
OpenD Documentation
Version 0.1
Sign in

Set up reader sign-in with OIDC

Readers sign in through any OpenID Connect provider. OpenD matches them to the readers you registered by verified email.

  1. Register a web application with your identity provider, with the redirect URI $PUBLIC_URL/auth/callback.
  2. Set the provider details on the web service. 
    OIDC_ISSUER=https://login.example.com
OIDC_CLIENT_ID=...
OIDC_CLIENT_SECRET=...
# OIDC_SCOPES=openid email profile   (the default)
# OIDC_DISPLAY_NAME=Acme SSO          ("Sign in with Acme SSO" on the sign-in page)
  3. Register each reader by email, in their organization.

    See Manage organizations, entitlements and readers.

  4. Restart the web service and sign in at $PUBLIC_URL/auth/login.

    The sign-in page lists every configured provider: Sign in with GitHub (see Let readers sign in with GitHub), Sign in with your OIDC provider, and, with OPEND_DEV_LOGIN outside production, Demo readers. With exactly one provider and no demo readers it goes straight to that provider. The OIDC flow starts at /auth/oidc.

Results

How sign-in works:

  • The flow is the authorization code flow with PKCE, state and nonce.
  • A reader already linked to the provider's issuer and subject is signed in. Otherwise, a verified email that matches a registered reader links that reader to the subject on first sign-in. An unverified email never matches.
  • Anyone else sees "No access" and is not signed in.
  • The session is a signed, HttpOnly cookie holding only the reader id, valid for 12 hours. Entitlements are re-read through a short cache that is cleared as soon as an admin changes them.
  • A reader whose organization has no entitlements yet sees "No access yet".
  • Pages show the reader's name and Sign out in the header, and in the menu on narrow screens. Signing out is a form post carrying the session's CSRF token; opening /auth/logout only asks.
  • On a private site every page sends signed-out visitors to the sign-in page, which returns them to the page afterwards. On a public site they read the public view and can sign in from the header. The return address is always a path on the same site. See Make a site public or private.