Skip to content

Dual login buttons: one-click IdP login via kc_idp_hint #63

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
thusser wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

Dual login buttons: one-click IdP login via kc_idp_hint #63

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions modules/context_processors.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,11 @@ def sidebar_modules(request):
# which takes precedence over this processor when both provide it.
"ejabberd_enabled": getattr(settings, "EJABBERD_ENABLED", False),
"keycloak_login_enabled": bool(getattr(settings, "PYOBS_AUTH", {}).get("SERVER_URL")),
# IdP hint/label for the one-click IdP login button - see PYOBS_AUTH in settings.py.
# The template additionally gates on keycloak_login_enabled, so IDP_HINT without
# SERVER_URL (Keycloak disabled) degrades to no buttons rather than dead links.
"keycloak_idp_hint": getattr(settings, "PYOBS_AUTH", {}).get("IDP_HINT", ""),
"keycloak_idp_label": getattr(settings, "PYOBS_AUTH", {}).get("IDP_LABEL", ""),
"git_enabled": getattr(settings, "PYOBS_CONFIG_GIT_ENABLED", False),
"acl_matrix_enabled": getattr(settings, "PYOBS_CONFIG_ACL_MATRIX_ENABLED", False),
"web_admin_version": _web_admin_version(),
Expand Down
5 changes: 5 additions & 0 deletions pyobs_web_admin/settings.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,11 @@
"CLIENT_SECRET": "",
"REDIRECT_URI": "",
"POST_LOGOUT_REDIRECT_URI": "",
# Optional one-click IdP login: IDP_HINT is passed to Keycloak as kc_idp_hint (skips its
# login/IdP-selection page, going straight to that identity provider, e.g. GWDG SSO);
# IDP_LABEL is the button label on the login page. Both are deployment-specific.
"IDP_HINT": "",
"IDP_LABEL": "",
"USER_RESOLVER": "pyobs_web_admin.authentication.keycloak.resolve_user",
}

Expand Down
2 changes: 1 addition & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ dependencies = [
"gunicorn>=26.0.0",
"packaging>=24.0",
"psutil>=6.0",
"pyobs-auth>=2.0.0.dev7",
"pyobs-auth>=2.0.0.dev8",
"pyyaml>=6.0",
"requests>=2.32",
"ruamel.yaml>=0.18",
Expand Down
12 changes: 10 additions & 2 deletions templates/registration/login.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,9 +48,17 @@ <h5 class="mt-2 mb-0 fw-semibold">pyobs Web Admin</h5>
</button>
</form>

{% if keycloak_login_enabled %}
{% if keycloak_idp_hint and keycloak_login_enabled %}
<hr class="my-4">
<a href="{% url 'pyobs_auth:login' %}?next={{ next }}" class="btn btn-outline-secondary w-100">
<a href="{% url 'pyobs_auth:login' %}?next={{ next|urlencode }}" class="btn btn-primary w-100">
<i class="bi bi-shield-lock me-1"></i>Log in with {{ keycloak_idp_label|default:"Keycloak" }}
</a>
<a href="{% url 'pyobs_auth:login' %}?idp_hint=&next={{ next|urlencode }}" class="btn btn-outline-secondary w-100">
<i class="bi bi-person me-1"></i>Log in with local Keycloak account
</a>
{% elif keycloak_login_enabled %}
<hr class="my-4">
<a href="{% url 'pyobs_auth:login' %}?next={{ next|urlencode }}" class="btn btn-outline-secondary w-100">
<i class="bi bi-shield-lock me-1"></i>Log in with Keycloak
</a>
{% endif %}
Expand Down