OpenID Connect Enrollment: Hatlas Keycloak #13357

New issue

Closed

opened 2026-05-21 08:20:44 +00:00 by smoliicek · 9 comments

smoliicek commented

2026-05-21 08:20:44 +00:00

Member

oidc-enroll

To help us register your application in our OIDC service, we need some
information from you:

Note: all the default values provided here are based on the default choice/
implementation of flask-oidc. If you do not use this library you may have to
refer to the documentation of your library.

Some generic information first:

What is the application main URL? https://auth.hatlas.mwinters.net/
Who will be the main contact for the application, or will this be core
infrastructure? @mwinters - mwinters AT fedoraproject DOT org; @smoliicek - smoliicek AT fedoraproject DOT org
What privacy policy will be applicable to the application, or will this be
the standard Fedora privacy policy? Standard Fedora privacy policy

Some more OIDC specific information then:

Which redirect URI(s) will the application use?
- https://auth.hatlas.mwinters.net/realms/hatlas/broker/fas/endpoint
Does the application need the user names, or will an application-specific
pseudonym suffice?
- Yes, we need usernames
Which authorization flow does the application use?
- authorization_code
Which token authentication method does the application use?
- client_secret_post
Which response type does the application rely on?
- Code

Notes:
We also need a OIDC claim for user groups, so we can map the FDWG groups (fdwg,
fdwg-maintainers) to groups present on the Keycloak instance.

### oidc-enroll To help us register your application in our OIDC service, we need some information from you: Note: all the default values provided here are based on the default choice/ implementation of flask-oidc. If you do not use this library you may have to refer to the documentation of your library. Some generic information first: - What is the application main URL? https://auth.hatlas.mwinters.net/ - Who will be the main contact for the application, or will this be core infrastructure? @mwinters - mwinters AT fedoraproject DOT org; @smoliicek - smoliicek AT fedoraproject DOT org - What privacy policy will be applicable to the application, or will this be the standard Fedora privacy policy? Standard Fedora privacy policy Some more OIDC specific information then: - Which redirect URI(s) will the application use? - ``https://auth.hatlas.mwinters.net/realms/hatlas/broker/fas/endpoint`` - Does the application need the user names, or will an application-specific pseudonym suffice? - Yes, we need usernames - Which authorization flow does the application use? - `authorization_code` - Which token authentication method does the application use? - `client_secret_post` - Which response type does the application rely on? - `Code` Notes: We also need a OIDC claim for user groups, so we can map the FDWG groups (fdwg, fdwg-maintainers) to groups present on the Keycloak instance.

Rows
Columns