website/integrations-all: convert authentik configuration to wizard (#13144)
* init * 6 more * tana... * quick reformat * welp only time for one change * wip * wip * wip * wip * wip * wip * wip * wip * Revert "wip" This reverts commit e71f0d22e3f093350e8d12eaad5e5c0f9d38253c. * wip * wip * wip * wip * wip * wip * wip * wip * wip * a
This commit is contained in:
Dominic R
@ -11,73 +11,62 @@ support_level: community
|
||||
>
|
||||
> -- https://en.wikipedia.org/wiki/Drupal
|
||||
|
||||
:::note
|
||||
There are many different modules for Drupal that allow you to set up SSO using
|
||||
different authentication methods. This tutorial uses the
|
||||
[OpenID Connect / OAuth client](https://www.drupal.org/project/openid_connect)
|
||||
module.
|
||||
:::
|
||||
|
||||
## Preparation
|
||||
|
||||
The following placeholders are used in this guide:
|
||||
|
||||
- `drupal.company` is the FQDN of Drupal installation.
|
||||
- `authentik.company` is the FQDN of authentik installation.
|
||||
- `drupal.company` is the FQDN of the Drupal installation.
|
||||
- `authentik.company` is the FQDN of the authentik installation.
|
||||
|
||||
:::note
|
||||
This documentation lists only the settings that you need to change from their
|
||||
default values. Be aware that any changes other than those explicitly mentioned
|
||||
in this guide could cause issues accessing your application.
|
||||
This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.
|
||||
:::
|
||||
|
||||
:::note
|
||||
There are many different modules for Drupal that allow you to set up SSO using different authentication methods. This tutorial uses the [OpenID Connect / OAuth client](https://www.drupal.org/project/openid_connect) module.
|
||||
:::
|
||||
|
||||
## authentik configuration
|
||||
|
||||
### Provider
|
||||
To support the integration of Drupal with authentik, you need to create an application/provider pair in authentik.
|
||||
|
||||
1. Go to Applications -> Providers
|
||||
https://authentik.company/if/admin/#/core/providers
|
||||
2. Create an OAuth2/OpenID Provider
|
||||
3. Set the Authentication flow to default-authentication-flow
|
||||
4. The Authorisation flow can be either default-provider-authorization-implicit-consent
|
||||
or default-provider-authorization-explicit-consent
|
||||
5. Set the Client type to "Confidential"
|
||||
6. Note the Cliend ID and Client Secret
|
||||
7. Set the Redirect URIs/Origins to your Drupal site
|
||||
https://drupal.company/openid-connect/generic
|
||||
8. Leave everything else as-is
|
||||
### Create an application and provider in authentik
|
||||
|
||||
### Application
|
||||
1. Log in to authentik as an admin, and open the authentik Admin interface.
|
||||
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can create only an application, without a provider, by clicking **Create**.)
|
||||
|
||||
1. Go to Applications -> Applications
|
||||
https://authentik.company/if/admin/#/core/applications
|
||||
2. Create an application e.g. "Drupal" and set the Provider field to the provider
|
||||
created above
|
||||
- **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. The **slug** will be used in URLs and should match the `drupal-slug` placeholder defined earlier.
|
||||
- **Choose a Provider type**: select **OAuth2/OpenID Provider** as the provider type.
|
||||
- **Configure the Provider**: provide a name (or accept the auto-provided name), and configure the following required settings:
|
||||
- Add the following **Redirect URI**: <kbd>https://<em>drupal.company</em>/openid-connect/generic</kbd>
|
||||
- **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/flows-stages/bindings/) (policy, group, or user) to manage the listing and access to applications on a user's **My applications** page.
|
||||
|
||||
3. Click **Submit** to save the new application and provider.
|
||||
4. Note the **Client ID** and **Client Secret** for later use.
|
||||
|
||||
## Drupal configuration
|
||||
|
||||
1. From the Admin Toolbar or admin page at https://drupal.company/admin go to
|
||||
**Configuration -> Web Services -> OpenID Connect** or directly at https://drupal.company/admin/config/services/openid-connect.
|
||||
2. Input the Client ID and Secret you noted above.
|
||||
3. Fill out the following endpoints:
|
||||
|
||||
- **Authorization endpoint**: <kbd>https://<em>authentik.company</em>/application/o/authorize/</kbd>
|
||||
- **Token endpoint**: <kbd>https://<em>authentik.company</em>/application/o/token/</kbd>
|
||||
- **UserInfo endpoint**: <kbd>https://<em>authentik.company</em>/application/o/userinfo/</kbd>
|
||||
|
||||
4. If your User Registration settings (**Admin -> Configuration -> People -> Account Settings** or
|
||||
https://drupal.company/admin/config/people/accounts) does not allow new users, check the "Override registration
|
||||
settings" checkbox to enable new accounts to be created. If you do not check this and log in as an unknown user, you
|
||||
will get a message saying you've successfully logged in but your account is blocked and needs to be approved by
|
||||
an administrator. Individual accounts can be unblocked at **Admin -> People** or https://drupal.company/admin/people.
|
||||
1. From the Admin Toolbar or admin page at <kbd>https://<em>drupal.company</em>/admin</kbd>, navigate to **Configuration** > **Web Services** > **OpenID Connect** (or directly at <kbd>https://<em>drupal.company</em>/admin/config/services/openid-connect</kbd>)
|
||||
2. Configure the following settings:
|
||||
- Set the **Client ID** and **Client Secret** to the values noted from authentik
|
||||
- Configure the endpoints:
|
||||
- **Authorization endpoint**: <kbd>https://<em>authentik.company</em>/application/o/authorize/</kbd>
|
||||
- **Token endpoint**: <kbd>https://<em>authentik.company</em>/application/o/token/</kbd>
|
||||
- **UserInfo endpoint**: <kbd>https://<em>authentik.company</em>/application/o/userinfo/</kbd>
|
||||
3. Under **Admin** > **Configuration** > **People** > **Account Settings** (or <kbd>https://<em>drupal.company</em>/admin/config/people/accounts</kbd>):
|
||||
- If new user registration is disabled, check **Override registration settings** to enable new account creation
|
||||
- Note: Without this setting, new users will receive a message that their account is blocked pending administrator approval
|
||||
4. Enable the OpenID button on the user login form
|
||||
|
||||
:::info
|
||||
If you are developing Drupal locally with DDEV and authentik is also running
|
||||
locally, use `host.docker.internal:9000` as the hostname for the Token and UserInfo endpoints.
|
||||
::: 5. Enable the OpenID button on the user login form.
|
||||
If you are developing Drupal locally with DDEV and authentik is also running locally, use `host.docker.internal:9000` as the hostname for the Token and UserInfo endpoints.
|
||||
:::
|
||||
|
||||
## Configuration verification
|
||||
|
||||
To confirm that authentik is properly configured with Drupal, log out from the
|
||||
Admin Toolbar link under your username, or go directly to
|
||||
https://drupal.company/user/logout, and log back in via authentik at https://drupal.company/user/login.
|
||||
TODO
|
||||
|
||||
## Additional Resources
|
||||
|
||||
- [Drupal OpenID Connect Module Documentation](https://www.drupal.org/project/openid_connect)
|
||||
- [Drupal User Account Settings Documentation](https://www.drupal.org/docs/user_guide/en/user-registration.html)
|
||||
|
||||
Reference in New Issue
Block a user