Review LemonLDAP details and validate there are no implementation dependencies
Categories
(Enterprise Products :: General, task, P1)
Tracking
(Not tracked)
People
(Reporter: bsmth, Assigned: tritchie)
References
(Blocks 1 open bug)
Details
User Story
As an enterprise developer, I would like to confirm that the LemonLDAP (OIDC) config is working as expected.
|
Reporter | |
Updated•2 months ago
|
I did a quick test with LemonLDAP. Console expects an email field in the id token. LemonLDAP doesn't include email by default. I got it working by setting IDTokenForceClaims which forces all claims (including email) to be included in the ID token.
We may want to update console to check userinfo endpoint if the id token doesn't include email.
It's fairly easy to get the console to work with lemonldap but I am seeing errors when logging in with the client, investigating.
|
|
Reporter | |
Updated•1 month ago
|
The client issue I was running into was not related to LemonLDAP, I was running a local build of the client against an older build of console which did not support POST on the policies endpoint.
LemonLDAP should work once we address the issue with the id token not having an email by default.
Created a new ticket for userinfo subrequest https://bugzilla.mozilla.org/show_bug.cgi?id=2053768
/sso/logout post was also failing https://bugzilla.mozilla.org/show_bug.cgi?id=2053804
Two subtickets merged, closing this as fixed
|
|
Reporter | |
Comment 7•19 days ago
|
||
I'm going to mark qe-verify- for QA to skip manual testing on this one, do you agree, Todd?
Agreed, sorry for the late reply here, I'd agreed in slack earlier
Description
•