OIDC example using openid-client and @apostrophecms/passport-bridge version 1.5.0-beta.1

dashboard/index.js

@@ -30,6 +30,7 @@ export default {
       }
     },
     'site-page': {},
-    '@apostrophecms/vite': {}
+    '@apostrophecms/vite': {},
+    '@apostrophecms/passport-bridge': {}
   }
 };

dashboard/modules/@apostrophecms/passport-bridge/index.js

@@ -0,0 +1,79 @@
+import * as client from 'openid-client';
+import {
+  Strategy
+} from 'openid-client/passport'
+
+export default {
+  options: {
+    create: {
+      role: 'guest'
+    },
+    strategies: [
+      {
+        async factory(params, fn) {
+          const issuer = new URL(process.env.OIDC_ISSUER);
+          const config = await client.discovery(
+            issuer,
+            process.env.OIDC_CLIENT_ID,
+            process.env.OIDC_CLIENT_SECRET
+          );
+          const {
+            // injected into params by passport-bridge
+            callbackURL
+          } = params;
+          const s = new Strategy({
+            config,
+            scope: 'openid email',
+            callbackURL
+          }, (tokens, callback) => {
+            const claims = tokens.claims();
+
+            // oidc provides:
+
+            // sid
+            // name: 'Tom Boutell',
+            // preferred_username: 'tomtest1',
+            // given_name: 'Tom',
+            // family_name: 'Boutell',
+            // email: 'tom+tomtest1@apostrophecms.com'
+
+            // But oauth providers provide (and passport-bridge expects, by default):
+
+            // id
+            // displayname
+            // username
+            // firstName
+            // lastName
+            // "emails" or "email"
+
+            const profile = {
+              id: claims.sid,
+              displayName: claims.name,
+              firstName: claims.given_name,
+              lastName: claims.family_name,
+              email: claims.email,
+              username: claims.preferred_username
+            };
+
+            return fn(null, tokens.access_token, tokens.refresh_token, profile, callback);
+          });
+          // The strategy sets it to the hostname, override so we can predict the URLs
+          s.name = 'oidc';
+          return s;
+        },
+        // Required when using a factory function
+        name: 'oidc',
+        // These would show up in "params" above, we chose to use environment
+        // variables instead
+        options: {},
+        // Use the user's email address as their identity
+        match: 'email',
+        // Strategy-specific options that must be passed to the authenticate middleware.
+        // See the documentation of the strategy module you are using
+        authenticate: {
+          scope: [ 'openid', 'email' ]
+        }
+      }
+    ]
+  }
+}

package.json

@@ -31,6 +31,7 @@
     "@apostrophecms-pro/multisite-dashboard": "^1.4.0",
     "@apostrophecms-pro/palette": "^4.3.2",
     "@apostrophecms/favicon": "^1.1.2",
+    "@apostrophecms/passport-bridge": "1.5.0-beta.1",
     "@apostrophecms/vite": "^1.0.0",
     "@opentelemetry/auto-instrumentations-node": "^0.46.1",
     "@opentelemetry/exporter-jaeger": "^1.26.0",
@@ -41,6 +42,7 @@
     "apostrophe": "^4.9.0",
     "glob": "^10.4.5",
     "normalize.css": "^8.0.1",
+    "openid-client": "^6.6.2",
     "swiper": "^11.1.3"
   },
   "devDependencies": {

sites/modules/@apostrophecms/home-page/views/page.html

@@ -7,10 +7,16 @@
 
 {% block main %}
   <section class="page-home">
+    <h1>User Info</h1>
+    <ul>
+    {% for name, value in data.user %}
+      <li>{{ name }}: {{ value }}</li>
+    {% endfor %}
+    </ul>
     {% if data.theme === 'demo' %}
       {% include 'theme-demo:welcome.html' %}
     {% endif %}
 
     {% area data.page, 'main' %}
   </section>
-{% endblock %}
+{% endblock %}