{"id":50944319,"url":"https://github.com/driebit/zotonic_mod_sso_openidc","last_synced_at":"2026-06-17T18:07:54.733Z","repository":{"id":361136017,"uuid":"1217798137","full_name":"driebit/zotonic_mod_sso_openidc","owner":"driebit","description":null,"archived":false,"fork":false,"pushed_at":"2026-06-09T08:29:28.000Z","size":96,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-09T09:25:25.294Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Erlang","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/driebit.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-22T08:22:54.000Z","updated_at":"2026-06-09T08:27:41.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/driebit/zotonic_mod_sso_openidc","commit_stats":null,"previous_names":["driebit/zotonic_mod_sso_openidc"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/driebit/zotonic_mod_sso_openidc","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/driebit%2Fzotonic_mod_sso_openidc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/driebit%2Fzotonic_mod_sso_openidc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/driebit%2Fzotonic_mod_sso_openidc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/driebit%2Fzotonic_mod_sso_openidc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/driebit","download_url":"https://codeload.github.com/driebit/zotonic_mod_sso_openidc/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/driebit%2Fzotonic_mod_sso_openidc/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34459803,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-17T02:00:05.408Z","response_time":127,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-17T18:07:53.923Z","updated_at":"2026-06-17T18:07:54.728Z","avatar_url":"https://github.com/driebit.png","language":"Erlang","funding_links":[],"categories":[],"sub_categories":[],"readme":"# mod_sso_openidc\n\nOpenID Connect single sign-on identity support for the Zotonic framework.\n\n## Scope\n\nThis module provides Zotonic log-on Identities for OpenID Connect (OIDC) identity\nservices, to enable users to log on using an external single sign-on (SSO) account.\n\n## Configuration\n\nIn the admin there is a menu item _Auth_ \u003e _OpenID Connect Providers_.\n\nThere it is possible to configure the various identity providers.\n\nYou can use https://auth0.com for creating a test identity provider.\nThey also have a playground to get insights in the OpenID Connect flow.\n\n## Dependencies and installation\n\nFor handling of certificates, jwt tokens and other crypto tasks this module aims\nto use the latest stable release of https://github.com/erlef/oidcc\n\nCurrent release used: `v3.2` or later.\n\n### Adding oidcc to zotonic as a dependency\n\nCheck out the repository in `apps_user/` or add it as a dependency in `rebar.config`.\n\n## About OpenID Connect\n\nOpenID Connect specs are at https://openid.net/specs/openid-connect-core-1_0.html\n\nThree authentication flows exist:\n- Authorization Code Flow (uses a \"code\" in the authorization response; \"response_type\" = \"code\")\n- Implicit Flow (has an \"id_token\" and optionally \"token\" in the response; \"response_type\" = \"id_token\" or \"id_token token\")\n- Hybrid Flow (uses a combination of \"code\", and either \"id_token\" or \"token\", or both)\n\nWe use **Authorization Code Flow*** because this is the preferred path when a client secret\ncan be securily kept, in this case on our Zotonic server, see the specs in section 3.1:\n\n\u003e The Authorization Code Flow returns an Authorization Code to the Client, which\n\u003e can then exchange it for an ID Token and an Access Token directly. This provides\n\u003e the benefit of not exposing any tokens to the User Agent and possibly other\n\u003e malicious applications with access to the User Agent. The Authorization Server\n\u003e can also authenticate the Client before exchanging the Authorization Code for\n\u003e an Access Token. The Authorization Code flow is suitable for Clients that can\n\u003e securely maintain a Client Secret between themselves and the Authorization Server.\n\nSection 3.1.1 lists the process:\n\n1. Client prepares an Authentication Request containing the desired request parameters.\n2. Client sends the request to the Authorization Server.\n3. Authorization Server Authenticates the End-User.\n4. Authorization Server obtains End-User Consent/Authorization.\n5. Authorization Server sends the End-User back to the Client with an Authorization Code.\n6. Client requests a response using the Authorization Code at the Token Endpoint.\n7. Client receives a response that contains an ID Token and Access Token in the response body.\n8. Client validates the ID token and retrieves the End-User's Subject Identifier.\n\n## Technical background\n\n### Integration into the Zotonic login/signup process\n\n1. `mod_authentication` observes `observe_auth_validated` notifications, sent by the\n   `do_auth_user/2` function in `mod_identity_oidc_or`. This function sets up an\n   `auth_validated` record, containing the following fields:\n   - `service` - `mod_sso_openidc`\n   - `service_uid` - ProviderName:SubjectID (openid `sub` claim, user id unique per provider)\n   - `service_props` - Contents of the token holding the authentication claims\n   - `props` - Zotonic Person properties derived from the claims\n2. The module `mod_authentication` looks up the user identity (`service_uid`) in the `identity` table\n3. if not found, the module tries a signup by sending a `signup` notification, with the\n   `email` claim as email identity in the `signup_props` field.\n\n### Authentication claims\n\nThis module expects to extract the following claims from the authentication\ntoken returned by the ID Provider and maps them to Zotonic `auth_validated`\nnotification fields:\n\n- `sub` =\u003e `service_uid`\n- `email` =\u003e `props.email`\n- `given_name` =\u003e `props.name_first`\n- `family_name` =\u003e `props.name_surname`\n- `name` =\u003e `props.title`\n\n### Implementation\n\n```mermaid\ngraph LR;\nmod(mod_identity_oidc)\noidcc(oidcc library)\nidp(Identity Provider)\nredirect(Redirect controller)\nreturn(Return controller)\ntype(Identity type)\nconfig(Configuration)\nmod -- provides --\u003e redirect\nmod -- provides --\u003e return\nmod -- provides --\u003e identity\nidentity -- refers to --\u003e type\ntype -- has a --\u003e config\nconfig -- refers to --\u003e idp\nredirect -- redirects to --\u003e idp\nidp -- redirects to --\u003e return\noidcc -- has --\u003e registry\nregistry -- holds list of --\u003e idp\n```\n\n## Notes on Identities\n\n- The SSO identities are stored in an identity with type `mod_sso_openidc` and key\n  `myprovider$subject` where _myprovider_ is the name given to the OpenIDC configuration\n  used, and _subject_ is the unique id of the user at the provider.\n- The module `mod_admin_identity` automatically creates email identities if an email\n  address is added to a `person` or `institution` resource.\n- Validation of uniqueness of email address with signup should only fail on\n  verified email addresses\n- Signup via SSO should imply a verified email address (if the login claims\n  returned contain an email address).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdriebit%2Fzotonic_mod_sso_openidc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdriebit%2Fzotonic_mod_sso_openidc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdriebit%2Fzotonic_mod_sso_openidc/lists"}