UK IDAC OIDC integration

Science Independent Data Access Centers
1

Hi,

We have been getting ready to use the central authorization/authentication for the UK IDAC. Our setup uses keycloak with GitHub as IDP. I believe we would need client secret and configuration. Currently we have only the test environment (we will ask for production in due course). These are our details:

Please, let us know if we need to provide any further details.

Thanks,

Eduardo Toledo

2

Thanks. @frossie and team are working on a new system to make this process less cumbersome, might be a few days.

3

Yup this is entirely my fault - I am holding OIDC requests so that we can test the new system for granting them next week. On the plus side, after that change it won’t need busy engineering effort to grant/approve them, so the turnaround will be much quicker.

4

Hi Eduardo,

I’ve sent you a DM with a link. Let me know if there are any issues.

Knut

5

Thanks a lot Knut,

We are undergoing some maintenance in our infrastructure this week, so I will not try the link until later in the week. I will let you know if I find any issues.

Best wishes,

Eduardo

6

Sounds good.

7

Hi,

When I initially requested the client id and client secret for our autentication system, I aks for the redirect uri: https://aai-test.lsst.ac.uk/ but after finally setup the client on keycloak the final redirect uri is: https://aai-test.lsst.ac.uk/realms/lsst/broker/rubin-idp/endpoint So, we reach the authentication portal (Welcome To The CILogon OpenID Connect Authorization Service) but we have the following error:

{"detail":[{"msg":"Invalid return URI for client 3851fee6f8a10d8a366abf1ef57e629f.clients.data.lsst.cloud in OpenID Connect request: ``https://aai-test.lsst.ac.uk/realms/lsst/broker/rubin-idp/endpoint","type":"return_uri_mismatch","loc":["query","return_uri``"]}]}

Could you please modify the uri at your end and let us know when it is done so we can test it.

Thanks and best wishes,

Eduardo

8

Check your inbox for the new client details.