...
NOTE: FAST Members can access fully functional examples w/ localhost client ID on gitlab.
Your domain You will need valid HTTPSNeed a callback URL (usually handled by one of the solutions below.to know your callback URL (depending on your software stack this might be predetermined, check documentation for your libraries!)
If doing a reverse proxy to localhost on for example port 8080 it’s critical to firewall that port!
Need to contact IST for a client key via a ticket
NEW: OpenID Connect
ISS-General 2FA https://uwaterloo.atlassian.net/servicedesk/customer/portal/2/group/413/create/1660
set summery: “OIDC: add new web client“
set select topic you require assistance with: “Duo 2FA support”
set Additional comments:
Code Block ## NOTE: you first need to know your callback URI ## The django module uses /oidc/duo/callback/ ## Apache uses /secure/redirect_uri Allowedcallback URIs: - https://x.x.uwaterloo.ca/oidc/duo/callback/ - https://x-stage.x.uwaterloo.ca/oidc/duo/callback/ *group* in short format, not full DN. claims: winaccountname, group, email, name, given_name, family_name
Combining authentication with Grouper defined NEXUS groups can be a robust solution
...
During development you will find it helpful to support auth on localhost. The following configuration only supports callbacks to localhost:port/oidc/duo/callback/. We also added a handful of port numbers to keep things simple: 3000,8000,8080,8888,443,80
You can find the secret in the FAST examples gitlab repo linked above
| Code Block |
|---|
OIDC_AUTH_SERVER=https://sso-4ccc589b.sso.duosecurity.com/oidc/DIUHIIU5GLVCYFDLE7P7/ OIDC_CLIENT_ID=DIUHIIU5GLVCYFDLE7P7 OIDC_CLIENT_SECRET=TODO: ask mirko for key.. or perhaps we share it? OIDC_CALLBACK=/oidc/duo/callback/ |
...