@ -16,29 +16,41 @@ First, you will need to select an OpenID provider if you do not have one already
## Setup OpenID provder
## Setup OpenID provder
First, we will need to configure an Applicaton (i.e. Relying Party in OpenID-speak) in the OpenID provider. This application allows the **FastAPI** client that logs in to the OpenID Connect provider:
First, we will need to configure an Applicaton (i.e. Relying Party in OpenID-speak) in the OpenID provider. This application allows the **FastAPI** client that logs in to the OpenID Connect provider:
Then, we will select an authorization server to verify user identities and issue tokens for secure authentication and authorization of login requests:
Then, we will select an authorization server to verify user identities and issue tokens for secure authentication and authorization of login requests:
!!! check "Step 2 - Configure authorization server to return a custom claim"
/// check | Step 2 - Configure authorization server to return a custom claim
* Select/create a custom authorization server for the abovementioned application
* Select/create a custom authorization server for the abovementioned application
* Create a custom claim with the name "`groups`".
* Create a custom claim with the name "`groups`".
* Map the values to the groups of which the authenticated user is member of
* Map the values to the groups of which the authenticated user is member of
* *Write down issuer URL*
* *Write down issuer URL*
* *Write down audience*
* *Write down audience*
///
Finally, we will need to create a user and a group named "`Foo`" to
Finally, we will need to create a user and a group named "`Foo`" to
!!! check "Step 3 - Create a user and group"
/// check | Step 3 - Create a user and group
* Create a group called "`Foo`"
* Create a group called "`Foo`"
* Create a user
* Create a user
* Assign the "`Foo`"` group to the user
* Assign the "`Foo`"` group to the user
* Assign the application of step 1 to the user
* Assign the application of step 1 to the user
* *Write down user/password as you will need to authenticate with it later*
* *Write down user/password as you will need to authenticate with it later*
///
## Configure your **FastAPI** Application
## Configure your **FastAPI** Application
We assume a running pip environment with **FastAPI** installed (see [here](../../index.md#installation)).
We assume a running pip environment with **FastAPI** installed (see [here](../../index.md#installation)).
@ -46,19 +58,26 @@ We assume a running pip environment with **FastAPI** installed (see [here](../..
This example contains a `AccessTokenValidator` that validates the JWT access tokens using the jwks url that is part of the oidc well known configuration. It requires a Python JavaScript Object Signing and Encryprion (JOSE) library, a HTTP client to fetch keysets and some cache utilities.
This example contains a `AccessTokenValidator` that validates the JWT access tokens using the jwks url that is part of the oidc well known configuration. It requires a Python JavaScript Object Signing and Encryprion (JOSE) library, a HTTP client to fetch keysets and some cache utilities.