71 lines
2.0 KiB
ReStructuredText
71 lines
2.0 KiB
ReStructuredText
Google
|
|
======
|
|
|
|
|image0|
|
|
|
|
Presentation
|
|
------------
|
|
|
|
Do you we have to present `Google <http://www.google.com>`__? The good
|
|
news is that Google is a standard OpenID Provider, and so you can easily
|
|
delegate the authentication of LL::NG to Google:
|
|
https://developers.google.com/identity/protocols/OpenIDConnect
|
|
|
|
|
|
.. attention::
|
|
|
|
Google does not support logout through OpenID Connect. If
|
|
you close your session on LL::NG side, your Google session will still be
|
|
open.
|
|
|
|
Register on Google
|
|
------------------
|
|
|
|
You need a Google developer account to access to
|
|
https://console.developers.google.com/
|
|
|
|
Here you can go in API Manager and get new credentials (``client_id``
|
|
and ``client_secret``).
|
|
|
|
You need to provide the callback URLs, for example
|
|
https://auth.domain.com/?openidconnectcallback=1.
|
|
|
|
Declare Google in your LL::NG server
|
|
------------------------------------
|
|
|
|
Go in Manager and create a new OpenID Connect provider. You can call it
|
|
``google`` for example.
|
|
|
|
Click on ``Metadata``, and use the OpenID Connect configuration URL to
|
|
load them: https://accounts.google.com/.well-known/openid-configuration.
|
|
|
|
You can also load the JWKS data from the URL
|
|
https://www.googleapis.com/oauth2/v3/certs. But as Google rotate their
|
|
keys, we will also configure a refresh interval on JKWS data.
|
|
|
|
Go in ``Exported attributes`` to choose which attributes you want to
|
|
collect. Google supports these claims:
|
|
|
|
- email
|
|
- email_verified
|
|
- family_name
|
|
- given_name
|
|
- locale
|
|
- name
|
|
- picture
|
|
- sub
|
|
|
|
Now go in ``Options``:
|
|
|
|
- In ``Configuration``, register the ``client_id`` and
|
|
``client_secret`` given by Google. Set also the configuration URI
|
|
with https://accounts.google.com/.well-known/openid-configuration,
|
|
and JWKS refresh, for example every day: 86400.
|
|
- In ``Protocol``, adapt the ``scope`` to the exported attributes you
|
|
want. You can for example use ``openid profile email``.
|
|
- In ``Display``, you can set the name and the logo
|
|
|
|
.. |image0| image:: /applications/google_logo.png
|
|
:class: align-center
|
|
|