OpenID Connect with Moodle 3.4

OpenID Connect with Moodle 3.4

by Marc Scheper -
Number of replies: 9
I'm trying to install the openid connect plugin on a new moodle 3.4 installation

Used a git clone to /auth/oidc/ but i don't get a notification that there is a new plugin available?

Average of ratings: -
In reply to Marc Scheper

Re: OpenID Connect with Moodle 3.4

by Ken Task -
Picture of Particularly helpful Moodlers

Check ownerships/permissions on the git cloned directory and files contained therein.

Also ... 3.4 has customoath2 which can do openid.   That's part of 3.4 core.  Could you use that instead of an addon?

'spirit of sharing', Ken



In reply to Ken Task

Re: OpenID Connect with Moodle 3.4

by Helen Foster -
Picture of Core developers Picture of Documentation writers Picture of Moodle HQ Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers Picture of Translators

Hi Marc,

As Ken mentions, there is no need to install the OpenID Connect plugin on your Moodle 3.4 site, since the functionality is available as standard. Please see the documentation OAuth 2 authentication for details.

In reply to Helen Foster

Re: OpenID Connect with Moodle 3.4

by Ijaz Hussain -

Hi Helen

Is moodle have any future plan to add user sync functionality to OAuth2 plugin? Particularly Microsoft Azure sync like Openid Connect example. 

In reply to Ken Task

Re: OpenID Connect with Moodle 3.4

by Ijaz Hussain -

Hi

Our current production environment have moodle 3.2 but we are going to upgrade shortly to moodle 3.4 to move our current authentication from CAS to oatuth2.

I have tested moodle 3.4 and OAuth2 with Microsoft Azure in my test environment its Woking excellent, It’s also  create new user account on fly beautifully but we want Sync users account instead of  account creation on first login.

My question, Do i need to install OPENID CONNECT PLUGIN just for user account sync from MS Azure to moodle along with core moodle plugin OAuth2? or any other suggestion please. 


In reply to Ijaz Hussain

Re: OpenID Connect with Moodle 3.4

by Ken Task -
Picture of Particularly helpful Moodlers

Can't answer your question from personal/handson experience (don't run Windows anything), but do have a suggestion ...

Production server currently auth using CAS ... if you desire that current users keep their ID number (which is key for all work they have done on that system), think I'd take a look at mdl_user table on production and compare with the test system.

Do have experience with an entity that is/has changed from manual/email to first custom oauth2 vs CA's Siteminder.   Custom Oauth2 did have the ability to 'merge' accounts ... ie, if the Oauth2 login found and existing user, user was prompted if they would like to 'merge' account - use the current ID in the system.   Required a confirmation message sent to user and user had 30 minutes to confirm.   If user did not, account was in limbo.  And there was no way for the admin level user to 'confirm' the account for the user.

So ... bottom line ... compare/find out what will change for existing users.

Will take a guess in saying probably not a good idea to mix auth plugins/blocks to get sync ... you might be better off using csv initially to convert existing users in mass.

Actually, might be better off manipulating the DB mdl_user table directly - initially.

'spirit of sharing', Ken


In reply to Ken Task

Re: OpenID Connect with Moodle 3.4

by Ijaz Hussain -

Hi Ken

Thank for your details reply, I couldn't figure out if i want use oAuth2 plugin in moodle 3.4 and don't want to create moodle account  on first login but instead i want Sync users from MS Azure before their first login, What plugin i should use for sync users? 

Thanks again


In reply to Ijaz Hussain

Re: OpenID Connect with Moodle 3.4

by Ken Task -
Picture of Particularly helpful Moodlers

Then suggest you decide what you want to do - within what is possible in core code. 

There is no user sync for Oauth2 Google nor Oauth2 Custom and I would imagine no user sync for Facebook etc.   The only way those would work is when the openid service is restricted to a domain of some sort ... other wise you'd be getting *all* of Google/Facebook, etc.. ... don't think they would allow that, would they?

MS Azure isn't a directory service ... like LDAP.   Maybe that's what you need to investigate as it does have sync.

'spirit of sharing', Ken