fedora-infrastructure

#8991 Please add OpenID clients to Ipsilon IdP (osci/jenkins)
Closed: Fixed by kevin. Opened by astepano.

Closed: Fixed
Reopen Issue

Hello.

We are running apps:

https://osci-jenkins-stage.ci.fedoraproject.org/
https://osci-jenkins.ci.fedoraproject.org/ (not deployed yet)

Please add 2 entries for new apps:

osci-jenkins client_name="osci-jenkins"
osci-jenkins client_secret="XXX <long random string>"
osci-jenkins redirect_uris=["https://osci-jenkins.ci.fedoraproject.org/securityRealm/finishLogin"]
osci-jenkins client_uri="https://osci-jenkins.ci.fedoraproject.org/"
osci-jenkins ipsilon_internal={"type":"static","client_id":"fedocal","trusted":true}
osci-jenkins contacts=["ci@lists.fedoraproject.org", "admin@fedoraproject.org"]
osci-jenkins client_id=null
osci-jenkins policy_uri="https://fedoraproject.org/wiki/Legal:PrivacyPolicy"
osci-jenkins grant_types="authorization_code"
osci-jenkins response_types="code"
osci-jenkins application_type="web"
osci-jenkins subject_type="pairwise"
osci-jenkins logo_uri=null
osci-jenkins tos_uri=null
osci-jenkins jwks_uri=null
osci-jenkins jwks=null
osci-jenkins sector_identifier_uri=null
osci-jenkins request_uris=[]
osci-jenkins require_auth_time=null
osci-jenkins token_endpoint_auth_method="client_secret_post"
osci-jenkins id_token_signed_response_alg="RS256"
osci-jenkins request_object_signing_alg="none"
osci-jenkins initiate_login_uri=null
osci-jenkins default_max_age=null
osci-jenkins default_acr_values=null
osci-jenkins client_secret_expires_at=0
osci-jenkins-stage client_name="osci-jenkins-stage"
osci-jenkins-stage client_secret="XXX <long random string>"
osci-jenkins-stage redirect_uris=["https://osci-jenkins-stage.ci.fedoraproject.org/securityRealm/finishLogin"]
osci-jenkins-stage client_uri="https://osci-jenkins-stage.ci.fedoraproject.org/"
osci-jenkins-stage ipsilon_internal={"type":"static","client_id":"fedocal","trusted":true}
osci-jenkins-stage contacts=["ci@lists.fedoraproject.org", "admin@fedoraproject.org"]
osci-jenkins-stage client_id=null
osci-jenkins-stage policy_uri="https://fedoraproject.org/wiki/Legal:PrivacyPolicy"
osci-jenkins-stage grant_types="authorization_code"
osci-jenkins-stage response_types="code"
osci-jenkins-stage application_type="web"
osci-jenkins-stage subject_type="pairwise"
osci-jenkins-stage logo_uri=null
osci-jenkins-stage tos_uri=null
osci-jenkins-stage jwks_uri=null
osci-jenkins-stage jwks=null
osci-jenkins-stage sector_identifier_uri=null
osci-jenkins-stage request_uris=[]
osci-jenkins-stage require_auth_time=null
osci-jenkins-stage token_endpoint_auth_method="client_secret_post"
osci-jenkins-stage id_token_signed_response_alg="RS256"
osci-jenkins-stage request_object_signing_alg="none"
osci-jenkins-stage initiate_login_uri=null
osci-jenkins-stage default_max_age=null
osci-jenkins-stage default_acr_values=null
osci-jenkins-stage client_secret_expires_at=0

Please email me 2x client_secret encrypted with:

http://keys.gnupg.net/pks/lookup?op=vindex&fingerprint=on&search=0xFFDFB4A69A82842F
https://pgp.mit.edu/pks/lookup?op=get&search=0xFFDFB4A69A82842F

The ref document is : https://fedora-infra-docs.readthedocs.io/en/latest/sysadmin-guide/sops/ipsilon.html#create-openid-connect-secrets-for-apps

May I ask to provide next data for OIC provider: authorization_endpoint and token_endpoint urls too? Something like: https://[dns-name]/openid/token/ and https://[dns-name]/openid/authorize/ but, for Ipsilon.
Edited by astepano

Please note that Ipsilon supports OpenID Connect configuration document: https://id.fedoraproject.org/.well-known/openid-configuration

It will provide you with the endpoint URLs.

Metadata Update from @mohanboddu:
- Issue priority set to: Waiting on Assignee (was: Needs Review)
- Issue tagged with: groomed, medium-gain, medium-trouble

Hello, could you please take a look at this ticket? I added config example in the ticket body.

Hello.
I am ready to send the PR (please point to wher) or I can apply necessary update in batcave.
However , the ansible repo doesn't have OpenID clients.
Please, take a look, this seems very quick fix issue.

Done. Secrets emails encrypted.

Note that stg is down right now due to our datacenter move. Prod should be ready to go.

Metadata Update from @kevin:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

medium-gain medium-trouble

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.