Allow OIDC auth providers to be customized more easily

Author: fbacall

app/views/devise/sessions/_omniauth_options.html.erb

@@ -2,12 +2,11 @@
   <% Devise.omniauth_configs.each do |provider, config| -%>
     <%= link_to(omniauth_authorize_path(resource_name, provider), method: :post,
                 class: config.options[:logo] ? '' : 'btn btn-default') do %>
-      <% if config.options[:logo] %>
+      <% if config.options[:logo].present? %>
         <%= image_tag(config.options[:logo], class: "omniauth-logo omniauth-#{provider}") -%>
       <% else %>
         <%= t('authentication.omniauth.log_in_with',
-            provider: t("authentication.omniauth.providers.#{provider}",
-                      default: provider.to_s.titleize)) -%>
+            provider: config.options[:label] || t("authentication.omniauth.providers.#{provider}", default: provider.to_s.titleize)) -%>
       <% end %>
     <% end -%>
   <% end -%>

app/views/layouts/_login_menu.html.erb

@@ -5,7 +5,8 @@
   <ul class="dropdown-menu dropdown-menu-right">
     <% Devise.omniauth_configs.each do |provider, config| -%>
       <li class="dropdown-item">
-        <%= link_to "Log in with #{t("authentication.omniauth.providers.#{provider}", default: provider.to_s.titleize)}",
+        <%= link_to t('authentication.omniauth.log_in_with',
+              provider: config.options[:label] || t("authentication.omniauth.providers.#{provider}", default: provider.to_s.titleize)),
                     omniauth_authorize_path('user', provider), method: :post %>
       </li>
     <% end %>

config/initializers/omniauth/aaf.rb

@@ -4,7 +4,7 @@
     logo: 'ls-login.png',
     name: :elixir_aai,
     scope: [:openid, :email, :profile],
-    response_type: 'code',
+    response_type: :code,
     issuer: 'https://login.aai.lifescience-ri.eu/oidc/',
     discovery: true,
     client_options: {

config/initializers/omniauth/ls_login.rb

@@ -0,0 +1,19 @@
+# OpenID Connect configuration
+unless Rails.application.config.secrets.dig(:oidc, :client_id).blank?
+  Devise.omniauth :openid_connect, {
+    name: :oidc,
+    label: Rails.application.config.secrets.oidc[:label],
+    logo: Rails.application.config.secrets.oidc[:logo],
+    issuer: Rails.application.config.secrets.oidc[:issuer],
+    strategy_class: OmniAuth::Strategies::OpenIDConnect,
+    scope: [:openid, :email, :profile],
+    response_type: :code,
+    discovery: true,
+    client_options: {
+      identifier: Rails.application.config.secrets.oidc[:client_id],
+      secret: Rails.application.config.secrets.oidc[:secret],
+      redirect_uri: Rails.application.config.secrets.oidc[:redirect_uri].presence ||
+        "#{TeSS::Config.base_url.chomp('/')}/users/auth/oidc/callback"
+    }
+  }
+end

config/initializers/omniauth/oidc.rb

@@ -0,0 +1,19 @@
+# Secondary OpenID Connect configuration
+unless Rails.application.config.secrets.dig(:oidc2, :client_id).blank?
+  Devise.omniauth :openid_connect, {
+    name: :oidc2,
+    label: Rails.application.config.secrets.oidc2[:label],
+    logo: Rails.application.config.secrets.oidc2[:logo],
+    issuer: Rails.application.config.secrets.oidc2[:issuer],
+    strategy_class: OmniAuth::Strategies::OpenIDConnect,
+    scope: [:openid, :email, :profile],
+    response_type: :code,
+    discovery: true,
+    client_options: {
+      identifier: Rails.application.config.secrets.oidc2[:client_id],
+      secret: Rails.application.config.secrets.oidc2[:secret],
+      redirect_uri: Rails.application.config.secrets.oidc2[:redirect_uri].presence ||
+        "#{TeSS::Config.base_url.chomp('/')}/users/auth/oidc2/callback"
+    }
+  }
+end

config/initializers/omniauth/oidc2.rb

@@ -734,8 +734,8 @@ en:
       description: ''
       providers:
         elixir_aai: LS Login
-        oidc: AAF (Australia)
-        oidc2: Tuakiri (NZ)
+        oidc: OpenID Connect
+        oidc2: Alternative OpenID Connect
       log_in_with: 'Log in with %{provider}'
   ingestion:
     categories:

config/initializers/omniauth/tuakiri.rb

@@ -17,23 +17,21 @@ external_api_keys: &external_api_keys
   recaptcha:
     sitekey:
     secret:
-  elixir_aai:
+  elixir_aai: # LS-Login authentication config
     client_id: # client id
     secret: # secret
-  oidc:
-    label:             # service label
+  oidc: # OpenID Connect authentication config
+    label:             # name of auth provider to display to users e.g. AAF (Australia)
+    logo:              # optional path to logo to display to users under app/assets/images e.g. dresa/aaf_service_223x54.png
     client_id:         # client id
     secret:            # secret
-    redirect_uri:      # redirect_uri e.g. https://<host address>/users/auth/oidc/callback
     issuer:            # issuer uri e.g. https://central.test.aaf.edu.au
-    host:              # host e.g. central.text.aaf.edu.au
-  oidc2:
-    label:             # service label
+  oidc2: # Secondary OpenID Connect authentication config
+    label:             # name of auth provider to display to users e.g. Tuakiri (NZ)
+    logo:              # optional path to logo to display to users under app/assets/images
     client_id:         # client id
     secret:            # secret
-    redirect_uri:      # redirect_uri e.g. https://<host address>/users/auth/oidc/callback
     issuer:            # issuer uri e.g. https://openidconnect.test.tuakiri.ac.nz
-    host:              # host e.g. central.text.aaf.edu.au
   bioportal_api_key:
   fairsharing:
     username: