102 lines
4.0 KiB
Markdown
102 lines
4.0 KiB
Markdown
# Pocket ID settings for the Hilden deployment
|
|
|
|
There is one OIDC provider (`https://login.hilden.de`) and two relevant Pocket ID OIDC clients. SessionGuard v0.5.2 with this hotfix uses confidential Authorization Code clients with PKCE S256 and RP-initiated logout.
|
|
|
|
## Client 1: Guacamole Director
|
|
|
|
Use these settings in Pocket ID:
|
|
|
|
- Name: `Guacamole Director`
|
|
- Public Client: **OFF**
|
|
- PKCE: **ON**
|
|
- Client secret: **keep the existing secret**
|
|
- Client start URL: `https://director.hilden.de`
|
|
- Require re-authentication: **OFF** unless you intentionally want a fresh Pocket ID authentication on every authorization
|
|
- Skip consent screen: optional; it does not affect PKCE or logout
|
|
- Federated Client Credentials: **not required** for SessionGuard's browser login; remove them unless another workload intentionally uses them
|
|
|
|
Callback URLs:
|
|
|
|
- `https://director.hilden.de/oidc/callback`
|
|
- `https://gts01.hilden.de:9091/oidc/callback`
|
|
- `https://gts02.hilden.de:9091/oidc/callback`
|
|
- `https://gts03.hilden.de:9091/oidc/callback`
|
|
|
|
Logout Callback URLs (Pocket ID allow-list for `post_logout_redirect_uri`):
|
|
|
|
- `https://director.hilden.de/`
|
|
- `https://gts01.hilden.de:9091/`
|
|
- `https://gts02.hilden.de:9091/`
|
|
- `https://gts03.hilden.de:9091/`
|
|
|
|
The SessionGuard instance must use the callback/logout pair for the hostname through which that instance is opened. Example for the Director URL:
|
|
|
|
```json
|
|
"oidc": {
|
|
"issuer": "https://login.hilden.de",
|
|
"client_id": "307fde28-7d87-4671-9c7a-201d2332a617",
|
|
"client_secret": "SET-BY-SESSIONGUARD_OIDC_CLIENT_SECRET",
|
|
"redirect_url": "https://director.hilden.de/oidc/callback",
|
|
"logout_redirect_url": "https://director.hilden.de/",
|
|
"admin_groups": [],
|
|
"secure_cookie": true
|
|
}
|
|
```
|
|
|
|
For a directly opened agent UI, use its exact pair instead, e.g. `https://gts01.hilden.de:9091/oidc/callback` and `https://gts01.hilden.de:9091/`.
|
|
|
|
## Client 2: Guacamole (portal)
|
|
|
|
Use these settings in Pocket ID:
|
|
|
|
- Name: `Guacamole`
|
|
- Public Client: **OFF**
|
|
- PKCE: **ON**
|
|
- Client secret: **keep the existing secret**
|
|
- Client start URL: `https://portal.hilden.de`
|
|
- Require re-authentication: **OFF** unless explicitly desired
|
|
- Skip consent screen: optional
|
|
- Federated Client Credentials: **not required** for SessionGuard's browser login
|
|
|
|
Callback URL used by SessionGuard:
|
|
|
|
- `https://portal.hilden.de/_sessionguard/auth/oidc/callback`
|
|
|
|
Logout Callback URL:
|
|
|
|
- `https://portal.hilden.de/`
|
|
|
|
SessionGuard configuration:
|
|
|
|
```json
|
|
"access_auth": {
|
|
"enabled": true,
|
|
"issuer": "https://login.hilden.de",
|
|
"client_id": "170f9724-2d12-45c4-8e6f-e1e559be4f72",
|
|
"client_secret": "SET-BY-SESSIONGUARD_ACCESS_OIDC_CLIENT_SECRET",
|
|
"redirect_url": "https://portal.hilden.de/_sessionguard/auth/oidc/callback",
|
|
"logout_redirect_url": "https://portal.hilden.de/",
|
|
"cookie_name": "sg_access_session",
|
|
"cookie_domain": "",
|
|
"secure_cookie": true,
|
|
"session_hours": 8,
|
|
"username_claim": "preferred_username",
|
|
"allowed_groups": [],
|
|
"allowed_hosts": ["portal.hilden.de"]
|
|
}
|
|
```
|
|
|
|
If `https://guacauth.hilden.info/portals/guacamole/oauth2/callback` is no longer used by a separate native Guacamole OIDC integration, remove it from Pocket ID. Keep it only if that second integration is still actually in use.
|
|
|
|
## Logout behavior in this hotfix
|
|
|
|
Both SessionGuard flows discover Pocket ID's `end_session_endpoint`. On logout SessionGuard clears its local session and redirects the browser to Pocket ID with:
|
|
|
|
- `client_id`
|
|
- `id_token_hint` when a successful SessionGuard login supplied one
|
|
- the configured and registered `post_logout_redirect_uri`
|
|
|
|
For the Director/Admin/Agent flow the hotfix retains the ID token server-side for the lifetime of the local browser session so it can be supplied as `id_token_hint` without placing the raw ID token in a browser cookie.
|
|
|
|
The existing SessionGuard `/auth/backchannel-logout` handler is separate from the browser post-logout redirect. Do not enter that endpoint as the normal browser Logout Callback URL unless your Pocket ID version/integration explicitly provides a dedicated back-channel logout setting and calls it as such.
|