Add OIDC login via social-auth #2550

jkachel · 2025-02-24T21:43:10Z

What are the relevant tickets?

Closes mitodl/hq#6586

Description (What does it do?)

Configures the authentication pipeline to work with OIDC (Keycloak) based authentication.

A Keycloak instance is necessary for testing this. See the README-keycloak.md for setup instructions. (It is not the same as it is elsewhere! Hopefully it's better/easier to follow.) The sample instance that exists elsewhere has been migrated here to make testing easier. Or, you can also use a different Keycloak instance, including one that is part of some other app (like Learn or Unified Ecommerce).

When completed and enabled, users will be given the option of logging in via email or Keycloak:

Email login works as it did. Users can sign up, run forgot password, sign in via email, etc. all as before.
Keycloak login will bounce the user over to Keycloak to authenticate, and then they will return to MITx Online. If the user's account doesn't exist, it will be created. Users will not have to verify their email addresses in MITx Online. Users will have to complete the MITx Online-specific profile loading process when they try to do certain operations (enroll, etc.).

We don't have design for this but the choice screen just gives you a couple buttons to direct the user.

This does not depend on APISIX at all. However, if this is sitting behind a correctly configured APISIX instance and the user's already logged in, the user should just get bounced straight back from Keycloak. But the app will not pick up an existing APISIX session.

Screenshots (if appropriate):

Login interstitial:

How can this be tested?

Set EXPOSE_OIDC_LOGIN to True in your .env.
Configure the OIDC settings appropriately. See the README-keycloak.md for instructions.
Follow the instructions for configuring the provided Keycloak instance or configure the app to use an external one. See the notes in README-keycloak.md if you're going to use a separate Keycloak instance on the same machine.
Go to the app, and click Login.
You should see the interstitial above.
Clicking Sign In with Email should take you to the normal sign-in workflow - this should work as expected, with no changes.
Clicking Sign In with Keycloak should redirect you to Keycloak to sign in. Upon returning to the app, you should be logged in. If your account didn't exist in MITx Online before, it should be created.
Clicking Log Out should redirect you into Keycloak for logout.

Additional Context

This doesn't tackle grabbing an APISIX session. Different middleware is needed for this.

- Adding in Keycloak instance stuff (mostly copied from UE/Learn but with some reworked documentation) - Added ol_open_id_connect backend, from Learn, but also captures the global_id (Keycloak ID) - Added global_id to the user model - Started in on situating the user for non-API-driven login requests - Added an interstitial to the login screen to allow the user to choose email or keycloak This is not particularly usable because OIDC needs feature-flagging. We don't want users trying to log in via Keycloak right yet. (It's also not done. Users get created, that's about it.) The existing custom parts of the pipeline check to make sure their backend is the one they expect before doing things, so the strategy is to add in basically the existing Python Social Auth pipeline things that would normally be there, but wrapping them so they only run if we're authenticating via OIDC. This should allow the existing email-based flow to work while also allowing OIDC to function alongside it.

gitguardian · 2025-02-24T21:43:15Z

⚠️ GitGuardian has uncovered 8 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
13777604	Triggered	Generic High Entropy Secret	`b4226da`	config/keycloak/realms/default-realm.json	View secret
13777605	Triggered	Generic High Entropy Secret	`b4226da`	config/keycloak/realms/default-realm.json	View secret
13777606	Triggered	Generic Private Key	`b4226da`	config/keycloak/tls/tls.key.default	View secret
13777607	Triggered	Generic High Entropy Secret	`b4226da`	config/keycloak/realms/default-realm.json	View secret
13777608	Triggered	Generic High Entropy Secret	`b4226da`	config/keycloak/realms/default-realm.json	View secret
13777609	Triggered	Generic Password	`b4226da`	config/keycloak/realms/default-realm.json	View secret
13777610	Triggered	Generic High Entropy Secret	`b4226da`	config/keycloak/realms/default-realm.json	View secret
10259317	Triggered	Generic Password	`b4226da`	docker-compose.yml	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secrets safely. Learn here the best practices.
Revoke and rotate these secrets.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

- Fixed an issue with the global_id field; using _create_user should also fill it if it's a non-OIDC user - Added the promote_user command from UE - Added EXPOSE_OIDC_LOGIN; if this is not set, the OIDC workflow won't be shown on login (but isn't disabled) - Worked out bugs in the pipeline and now should create the user correctly (i.e. set is_active = True) when logging in via OIDC - Updating logout to bounce through Keycloak - Updated frontend to hide the first interstitial step if OIDC is disabled - Tested with external Keycloak - Added more docs for external Keycloak, override sample, and updates to the regular docs

for more information, see https://pre-commit.ci

…ne step

…at/lint fixes

…mitxonline into jkachel/add-social-auth-keycloak

rhysyngsun

Code review

rhysyngsun · 2025-02-28T19:34:47Z

users/models.py

+        fields = {
+            **extra_fields,
+            "email": email,
+            "global_id": extra_fields.get("global_id", uuid.uuid4()),


Shouldn't be setting a default global_id, this is generated by Keycloak so we can't create a reasonable default for it.

rhysyngsun · 2025-03-03T20:17:00Z

users/management/commands/promote_user.py

+        parser.add_argument(
+            "email",
+            type=str,
+            help="The email of the user to promote/demote.",
+        )
+
+        parser.add_argument(
+            "--promote",
+            action="store_true",
+            help="Promote the user to staff.",
+        )
+
+        parser.add_argument(
+            "--demote",
+            action="store_true",
+            help="Demote the user from staff.",
+        )
+
+        parser.add_argument(
+            "--superuser",
+            action="store_true",
+            help="Promote the user to superuser.",
+        )


I would suggest structuring this using subparsers because it'll handle some of the validation you're doing below automatically. I recently did this in open-discussions for a similar type of command and it simplifies things substantially: https://github.com/mitodl/open-discussions/blob/master/authentication/management/commands/validate_user_emails.py#L30

rhysyngsun · 2025-03-03T20:29:53Z

frontend/public/src/containers/pages/login/LoginPages.js

@@ -26,7 +27,8 @@ const ForgotPasswordPages = () => (

 const LoginPages = () => (
  <Switch>
-    <Route exact path={routes.login.begin} component={LoginEmailPage} />
+    <Route exact path={routes.login.begin} component={LoginChoicePage} />


I don't know that we want to present UI to the user to choose which way to login, but it should instead be feature flagged as still being LoginEmailPage unless the flag is enabled. If the flag is enabled then the "Login" button should send them directly to Keycloak to login.

rhysyngsun · 2025-03-03T20:36:54Z

authentication/pipeline/user.py

+        # the backend should be setting the is_active flag to True (and it seems
+        # to be doing that!) but it isn't so we need to set it to active here.


Once we switchover completely to keycloak, we can set the default on the User model to True and remove this code.

jkachel and others added 5 commits February 25, 2025 15:56

[pre-commit.ci] auto fixes from pre-commit.com hooks

89ea083

for more information, see https://pre-commit.ci

Update app.json, fix user factory, fix issue with get_username pipeli…

a3678ff

…ne step

Cleaning up a code path, adding tests for oidc user creation, JS form…

f05fbbb

…at/lint fixes

add oidc url to the settings type

3f20970

jkachel marked this pull request as ready for review February 26, 2025 21:48

jkachel added Needs Review product:mitx-online labels Feb 26, 2025

jkachel added 3 commits February 27, 2025 11:29

Merge branch 'main' into jkachel/add-social-auth-keycloak

81aba3e

Removing some debug logging

1316fa7

Merge branch 'jkachel/add-social-auth-keycloak' of github.com:mitodl/…

bd5b54f

…mitxonline into jkachel/add-social-auth-keycloak

rhysyngsun self-assigned this Mar 3, 2025

rhysyngsun requested changes Mar 3, 2025

View reviewed changes

rhysyngsun added Waiting on Author and removed Needs Review labels Mar 3, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add OIDC login via social-auth #2550

Add OIDC login via social-auth #2550

jkachel commented Feb 24, 2025 •

edited

Loading

gitguardian bot commented Feb 24, 2025 •

edited

Loading

rhysyngsun left a comment

rhysyngsun Feb 28, 2025

rhysyngsun Mar 3, 2025

rhysyngsun Mar 3, 2025

rhysyngsun Mar 3, 2025

		# the backend should be setting the is_active flag to True (and it seems
		# to be doing that!) but it isn't so we need to set it to active here.

Add OIDC login via social-auth #2550

Are you sure you want to change the base?

Add OIDC login via social-auth #2550

Conversation

jkachel commented Feb 24, 2025 • edited Loading

What are the relevant tickets?

Description (What does it do?)

Screenshots (if appropriate):

How can this be tested?

Additional Context

gitguardian bot commented Feb 24, 2025 • edited Loading

⚠️ GitGuardian has uncovered 8 secrets following the scan of your pull request.

rhysyngsun left a comment

Choose a reason for hiding this comment

rhysyngsun Feb 28, 2025

Choose a reason for hiding this comment

rhysyngsun Mar 3, 2025

Choose a reason for hiding this comment

rhysyngsun Mar 3, 2025

Choose a reason for hiding this comment

rhysyngsun Mar 3, 2025

Choose a reason for hiding this comment

jkachel commented Feb 24, 2025 •

edited

Loading

gitguardian bot commented Feb 24, 2025 •

edited

Loading