mirror of
https://github.com/discourse/discourse.git
synced 2026-08-09 21:45:25 +08:00
30d8364f0aAdds support for mTLS for OIDC auth in the discourse-openid-connect plugin. If the SiteSettings `openid_connect_mtls_client_cert` and `openid_connect_mtls_client_key` are set, then tell OmniAuth to use auth_scheme `tls_client_auth` and pass the cert and key to the connection ssl options. OmniAuth will skip sending the client_secret in favor of the cert. Optionally, SiteSetting `openid_connect_mtls_client_key_passcode` can be provided to decrypt the private key. Related to dev topic t/185887
28 lines
3.4 KiB
YAML
Vendored
28 lines
3.4 KiB
YAML
Vendored
en:
|
|
site_settings:
|
|
openid_connect_enabled: Enable OpenID Connect authentication. Customize user interface text <a href='%{base_path}/admin/customize/site_texts?q=js.login.oidc'>here</a>
|
|
openid_connect_discovery_document: "OpenID Connect discovery document URL. Normally located at 'https://your.domain/.well-known/openid-configuration'"
|
|
openid_connect_client_id: "OpenID Connect client ID"
|
|
openid_connect_client_secret: "OpenID Connect client secret"
|
|
openid_connect_authorize_scope: "The scopes sent to the authorize endpoint. This must include 'openid'."
|
|
openid_connect_rp_initiated_logout: "Redirect the user to end_session_endpoint after logout. Must be supported by your identity provider and included in the discovery document."
|
|
openid_connect_rp_initiated_logout_redirect: "(optional) The post_logout_redirect_uri which will be passed to the logout endpoint. If provided, it must be registered with the identity provider."
|
|
openid_connect_rp_initiated_logout_include_client_id: "(optional) Append the client_id (openid_connect_client_id setting) as a query parameter to the logout endpoint"
|
|
openid_connect_token_scope: "The scopes sent when requesting the token endpoint. The official specification does not require this."
|
|
openid_connect_error_redirects: "If the callback error_reason contains the first parameter, the user will be redirected to the URL in the second parameter"
|
|
openid_connect_allow_association_change: "Allow users to disconnect and reconnect their Discourse accounts from the OpenID Connect provider"
|
|
openid_connect_verbose_logging: "Log detailed openid-connect authentication information to `/logs`. Keep this disabled during normal use."
|
|
openid_connect_authorize_parameters: "URL parameters which will be included in the redirect from /auth/oidc to the IDP's authorize endpoint"
|
|
openid_connect_overrides_email: "On every login, override the user's email using the openid-connect value. Works the same as the {{setting:auth_overrides_email}} setting, but is specific to OpenID Connect logins."
|
|
openid_connect_claims: "Explicitly define the claims for use with providers that don't pass data back based on scopes. (JSON)"
|
|
openid_connect_groups_claim: "The name of the claim in the OIDC token that contains the user's groups as an array of strings. Leave blank to disable group syncing."
|
|
openid_connect_user_field_mappings: "Map OIDC claims onto Discourse user fields. Each entry pairs an OIDC claim name with the numeric ID of a Discourse user field."
|
|
openid_connect_match_by_email: "Use email address to match OpenID Connect authentications to existing Discourse user accounts."
|
|
openid_connect_use_pkce: "Enable Proof Key for Code Exchange (PKCE) for OpenID Connect authentication."
|
|
openid_connect_mtls_client_cert: "X.509 client certificate for mTLS client authentication with the OIDC provider. To enable mTLS, {{setting:openid_connect_mtls_client_key}} must also be set."
|
|
openid_connect_mtls_client_key: "X.509 private key for the mTLS client certificate. To enable mTLS, {{setting:openid_connect_mtls_client_cert}} must also be set."
|
|
openid_connect_mtls_client_key_passcode: "Passphrase for the mTLS private key (optional)"
|
|
login:
|
|
omniauth_error:
|
|
openid_connect_discovery_error: Unable to fetch configuration from identity provider. Please try again.
|
|
openid_connect_mtls_error: There is a problem with the mTLS client certificate configuration. Please contact an administrator.
|
