Part of story #14714: be an OpenID Connect provider To test you need an access token with the 'openid' scope AND the 'email' scope (if the usage of PKCE is forced, add the mandatory parameters): 1. In the project admin create an OAuth2 app (note the ID and the given secret) 2. Access the authorize page at the URL https://tuleap.example.com/oauth2/authorize?client_id=<client_id>&scope=openid%20email&response_type=code&redirect_uri=<redirect_uri> 3. Quickly retrieve (it is valid only 1 minute) the authorization code from the URL 4. Exchange the authorization code for an access token and an ID token: shell> curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' \ --user '<client_id>:<client_secret>' \ --data 'grant_type=authorization_code&redirect_uri=<redirect_uri>&code=<authorization_code>' \ https://tuleap.example.com/oauth2/token 5. Access the UserInfo endpoint with the given Access token: shell> curl -H 'Authorization: Bearer <access_token>' https://tuleap.example.com/oauth2/userinfo 6. The response will be a JSON object containing the "sub", "email" and "email_verified" keys Change-Id: Ib552388d09acf52323522e2b2548024bfaf3d1d0

+536 −84

Author

Joris MASSON (jmasson) 2020-04-09 12:44

Committer

Joris MASSON (jmasson) 2020-04-09 17:42

Hash 80d70b188ffe4fd893927d43945af5266e91ad52

Parent 58e76d1a26fe7040909718a774a9468101d252fb

Reference git #tuleap/stable/80d70b188ffe4fd893927d43945af5266e91ad52