Differences

This shows you the differences between two versions of the page.

--- en:2.0:single_sign_on:oidc_dokuwiki [2026/09/08 16:59] – [Quick Overview] kainhofer
+++ en:2.0:single_sign_on:oidc_dokuwiki [2026/09/10 14:09] (current) – [Quick Overview] kainhofer
@@ Line 14: / Line 14: @@
 Basically, one needs to enable OpenID Connect (OIDC). The Issuer URL should in most cases be left blank, which means Admidio's public URL will be used as issuer URL.
-The page https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the automatic discovery URL, and the individual settings in case a client does not support auto-configuration via metadata.
+The page https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the automatic discovery URL, and the individual settings for clients that do not support auto-configuration via metadata.
 ===== Quick Overview =====
@@ Line 28: / Line 28: @@
   * In **Admidio**, **create a new OpenID client**.
     * Choose an easily understood **label for the client** (only used in Admidio's list of clients, but has no technical use)
-    * Enter the **ClientID from the RP**, Copy the created Client Secret (you will later need to paste it indo DokuWiki's configuration), and enter the **Redirect URI** for the RP. Typically the latter can be found either on the RP's configuration page or in the documentation.
+    * Enter the **ClientID from the RP**, copy the created Client Secret (you will later need to paste it into DokuWiki's configuration), and enter the **Redirect URI** for the RP. Typically the latter can be found either on the RP's configuration page or in the documentation.
     * Many open source OIDC clients do not support encryption (PKCE, which is a security mechanism that prevents attackers from obtaining access unless their application started the initial login). By default, PKCE is required by Admidio, so in this case make sure that the requirement checkbox is turned off. Otherwise you will get an error.
   * Optionally select (both in Admidio and the RP) which **profile fields should be mapped** to OpenID claims (attributes) and sent to the client, and configure which **group memberships** should be transmitted.
@@ Line 40: / Line 40: @@
 {{ :en:2.0:sso:sso_oidc_04-01_dw_plugin_install.png?direct&600 |}}
 After installation it can be configured in DokuWiki's Configuration Settings, near the bottom in the "Oauth" and "Oauthgeneric" sections.
+{{ :en:2.0:sso:sso_oidc_01-01a_dw_settings.png?600 |}}
-First, one has to copy over the OpenID endpoint URLs from Admidio's OpenID preferences (each URL has a copy button). You can find them here:
-{{ :en:2.0:sso:sso_oidc_01-01_setup_admidio_endpoints.png?direct&600 |}}
 ==== Setting up the Client (SP) in Admidio ====
@@ Line 52: / Line 50: @@
 {{ :en:2.0:sso:sso_oidc_01-07_clientadmin.png?direct&400 |}}
+The first step is to copy over the endpoint URLs from Admidio into the DokuWiki configuration. DokuWiki does not support automatic discovery, so the individual URLs (hidden by default in a foldable section at the top) must be copied individually:
+{{ :en:2.0:sso:sso_oidc_04-03a_dw_endpoints.png?800 |}}
+The remaining settings are individual to the DokuWiki installation:
   - The **Client Name** is the label of the client in Admidio's client list, it can be anything you like.
   - The **"Client ID"** and **"Client Secret"** in Admidio have to match exactly the **"Application UID"** and **"Application Secret"** in DokuWiki's configuration. The ID is typically the client's URL, although some clients allow any unique identifier, while others (most notably MediaWiki) require it to be the base of the OpenID endpoint (up until the 'index.php/oidc/'). The Client Secret should a random string and will serve like a password. Admidio will create one and allow it to be copied to the client. Afterwards it is only stored as a hash in the database and not be recovered any more. However, one can create a new Client Secret in Admidio and copy that to the client's configuration.