Allow OAuth with European commission account

[D063520]

The first step is to get the oAuth credentials, i.e.

$wgOAuth2Client['client']['id'] = ''; // The client ID assigned to you by the provider
$wgOAuth2Client['client']['secret'] = ''; // The client secret assigned to you by the provider

$wgOAuth2Client['configuration']['authorize_endpoint'] = ''; // Authorization URL
$wgOAuth2Client['configuration']['access_token_endpoint'] = ''; // Token URL
$wgOAuth2Client['configuration']['api_endpoint'] = ''; // URL to fetch user JSON
$wgOAuth2Client['configuration']['redirect_uri'] = ''; // URL for OAuth2 server to redirect to

$wgOAuth2Client['configuration']['username'] = 'username'; // JSON path to username
$wgOAuth2Client['configuration']['email'] = 'email'; // JSON path to email

$wgOAuth2Client['configuration']['scopes'] = 'openid email profile'; //Permissions

The Redirect URI for your wiki should be:

https://linkedopendata.eu/wiki/Special:OAuth2Client/callback

[madewild]

Form partially filled, just need a bit of time to finalize...

[madewild]

Just got this response: The provided URL has been registered in EU Login PROD.
@raphdom what should we do now?

[D063520]

cool!

[raphdom]

We need to implement it on the server side. We don't have a normal session based website, only the API to communicate with the Dennis services. Or it is about to connect the wikidata using eulogin? I can help with data if I have access to the servers...

[D063520]

We want to allow users to connect to the mediawiki instance using eulogin ...
https://www.mediawiki.org/wiki/Extension:OAuth2_Client
as described in the very first entry of the issue I would need the information above ....
PS: why do we need to implement a server, I though the Eu has a server for OAuth, so we need only to configure the client

[madewild]

We're still stuck on that?

[D063520]

yes .... let's move it for after the demos and so on ... is this ok?

[madewild]

Sure, not urgent but when more users will start editing it will become more pressing...

[madewild]

@weisest you mentioned we have several sites in PHP integrated in EULogin...
Our understanding is that the OAuth2 client for PHP has no support for PKCE yet (cf. thephpleague/oauth2-client#837), which is required by DIGIT
So is there a workaround to avoid PKCE? @raphdom how comes all Drupal sites (PHP) have EULogin integration?

[weisest]

Sorry for the naive question but what is OAuth2? EULogin is working with an API and is technology agnostic. It's used also in the Newsroom. Maybe @alainvd knows more how it was done?

[D063520]

hi, OAuth2 is the protocol (standard) used for the login. It is a very complex protocol not a simple API call (multiple back and forth). So generally there is a client (library) to put it in place. Depending on the programming language there is a Php client, javascript client and so on ..... so we were wondering how other EU websites that also are written in Php are doing it since the standard client for Php does not have all the functionality that is needed (DIGIT is using something fancy, non so common)

[alainvd]

EU Login does provide support for Open ID Connect since v6
More info is available here: https://webgate.ec.europa.eu/CITnet/confluence/pages/viewpage.action?pageId=738132209

I know that @raphdom tried to integrate it with Amazon Cognito but so far I think it has not been a successful journey.

[D063520]

salut Alain, are you saying with Open ID it should be easier? no PKCE?
I found this extention
https://www.mediawiki.org/wiki/Extension:OpenID_Connect
so we could try this way.
@alainvd did you use Open ID in a website already?

[alainvd]

Hi Denis,
Sorry but I never implemented the EU Login OpenID so far.
We are currently using a regular CAS client as our PHP applications are monolithic.

[D063520]

ok, the pointer to:

https://github.com/apereo/phpCAS

is already good. @alainvd So you would be able to help if we need to configure the client properly? Because then we could try to substitute this client https://github.com/thephpleague/oauth2-client with the phpCAS one in the wikimedia extension. Sounds easier than adapt the https://github.com/thephpleague/oauth2-client to the PKCE thing ; )

[alainvd]

Well I can't really comment as it depends on how they integrate the identification / authentication in their application.
If there is an abstraction layer, it is fine. Otherwise it might be complicated.

[D063520]

Yes sure ... this we would take care ... but you could share a minimal example with the https://github.com/apereo/phpCAS client?

[alainvd]

I found this extension on the wkimedia library: https://github.com/CWRUChielLab/CASAuth
Seems like a good starting point.

[D063520]

cool! perfect! in the mediawiki universe there is a plugin for everything! then I will try out this one .... could you help me with this:

https://github.com/CWRUChielLab/CASAuth/blob/master/CASAuthSettings.php.template

for oAuth Max made a request, filled some forms an so on. Could you check with him how to get the corresponding credentials for CASAuth.

[alainvd]

I replied by email with the settings we are using.

[D063520]

thank you! I saw it .... it will take 1-2 weeks until I find the time to do it, but looks like I have everything I need, merci!

[alainvd]

Good good. Let me know or Raph if you need anything else :)

[raphdom]

Indeed it will be more easy to use the integration with CAS directly instead of open id.

[madewild]

working now, well done @raphdom

[jzakotnik]

Does anyone know, what the link below contains? We evaluate an OAuth2 connection to EU Login, but it is not clear to me if this is available or not?

EU Login does provide support for Open ID Connect since v6 More info is available here: https://webgate.ec.europa.eu/CITnet/confluence/pages/viewpage.action?pageId=738132209

I know that @raphdom tried to integrate it with Amazon Cognito but so far I think it has not been a successful journey.

[madewild]

@raphdom can you share some (public) details about our EU Login integration?

[raphdom]

Hello @jzakotnik.
EULogin support OpenID with PKCE, but you need to do a registration first to after do the integration with your platform/website/app.
To know more details you can contact directly the mailbox from the responsible team inside the EC:
EU-LOGIN-EXTERNAL-SUPPORT@ec.europa.eu

[jzakotnik]

Thanks @raphdom for answering, this really helps in our case. In particular we look for integration with OpSys, so I guess we need authentication via OpenID, but then also respective authorization in OpSys.