Wiki.js - OpenID Connect (OIDC)

Scenario

Wiki.js is a robust and versatile open-source Wiki software that empowers users to create and manage content with ease. This use case details the process of setting up integration between Wiki.js and Integrity Access, leveraging the powerful capabilities of OpenID Connect (OIDC). This integration ensures streamlined access management, enhancing security and authentication processes.

This scenario will use the following:

• FortifiedID Integrity-access installed with OpenID Connect (OIDC) with the login method/methods of your choice and a LDAP connection to retrieve user information such as email-address.
• Wiki.js
• Active directory as LDAP source

Prerequisite

• Good knowledge of the FortifiedID Integrity Access product.
• FortifiedID Integrity Access current version installed with OpenID Connect (OIDC) with the login method/methods of your choice and a LDAP connection to retrieve user information such as email-address.
• Host (DNS) name of the Integrity service.
• A trusted certificate for the https communication against FortifiedID Integrity Access.
• Active directory / LDAP source with the users.
  Users will need a configured email-address.
• In this guide, we are focusing on deploying Wiki.js using Docker containers. This method is efficient for running both Wiki.js and a PostgreSQL database within isolated environments. However, if Docker is not your tool of choice, you can explore other installation methods that may better suit your setup requirements.

Configuration / Installation steps

Remember that this use case does not describe the installation of the products.
Products are expected to be installed in advance.

FortifiedID Integrity Access

If you don't already have an installation of FortifiedID Integrity Access with OpenID Connect (OIDC) you can use one of the use case with OpenID Connect (OIDC) and the login method of your choice for example UID/PWD (OIDC).

Add a Relying Party (RP)

Add the following Relying Party (RP) configuration to the "rps" part of both the "OIDCModule" module and the "OIDCAuthCodeFlow" authenticator in the Fortified Integrity Access configuration.

                {
                    "client_id": "wikijsid",
                    "client_secret": "insecure_wiki_secret",
                    "redirect_uri": [
                        "<will be replace with the Callback URL / Redirect URI from wiki.js >"
                    ],
                    "post_logout_redirect_uris": [
                        ""
                    ],
                    "id_token_claims": {
                        "secret_id": "{{{session.id}}}",
                        "iss": "https://demo.fortifiedid.se/oidc/tenant1",
                        "aud": "{{{exports.client_id}}}",
                        "sub": "{{{item.mail}}}",
                        "nonce": "{{{request.nonce}}}",
                        "family_name": "{{{item.family_name}}}",
                        "given_name": "{{{item.given_name}}}",
                        "name": "{{{item.name}}}",
                        "email": "{{{item.mail}}}"
                    },
                    "access_token_claims": {
                        "secret_id": "{{{session.id}}}",
                        "subject": "{{{item.mail}}}",
                        "name": "{{{item.name}}}",
                        "family_name": "{{{item.family_name}}}",
                        "given_name": "{{{item.given_name}}}",
                        "email": "{{{item.mail}}}"
                    },
                    "pipe_id": "oidc_pre_pipe"
                }

Required claims

Make user that the required claims are provided via the "oidc_pre_pipe".
If necessary, change to the values in your environment.

• "sub": "{{{item.mail}}}", - the users email address
• "family_name": "{{{item.family_name}}}", - the users lastname
• "given_name": "{{{item.given_name}}}", - the users first name
• "name": "{{{item.name}}}", - the users displayname
• "email": "{{{item.mail}}}" - the users email address

Get information from .well-known/openid-configuration link

Use a web browser to surf to the FortifiedID Integrity Access OP using this link
https://<address to access>/oidc/<tenant name>/.well-known/openid-configuration

• Replace <address to access> with the address to your FortifiedID Integrity Access server.
• Replace <tenant name> with the tenant name in your FortifiedID Integrity Access configuration.

Example: https://demo.fortifiedid.se/oidc/tenant1/.well-known/openid-configuration

The following information from the "https://<address to access>/oidc/<tenant name>/.well-known/openid-configuration" will be used in the Wiki.js configuration in the steps below.

• issuer
• authorization_endpoint
• token_endpoint
• userinfo_endpoint

Wiki.js installation and configuration

Create docker-compose file

Note ! - Skip this step if you have used another method to install Wiki.js

To run Wiki.js with Docker Compose, follow these steps:

1. Create a new directory for your Wiki.js setup and change to that directory:

mkdir wikijs
cd wikijs

2. Create a docker-compose.yml file in this directory using the editor of your choice, in this example nano is used:

nano docker-compose.yml

3. Paste the following content into the docker-compose.yml file:

version: '3'
services:
  db:
    image: postgres:11-alpine
    environment:
      POSTGRES_DB: wiki
      POSTGRES_USER: wikijs
      POSTGRES_PASSWORD: your_secure_password
    volumes:
      - db-data:/var/lib/postgresql/data

  wiki:
    image: requarks/wiki:latest
    depends_on:
      - db
    environment:
      DB_TYPE: postgres
      DB_HOST: db
      DB_PORT: 5432
      DB_USER: wikijs
      DB_PASS: your_secure_password
      DB_NAME: wiki
    ports:
      - "80:3000"
    volumes:
      - wiki-data:/wiki/data/content

volumes:
  db-data:
  wiki-data:

4. Save and close the file.
5. Run the following command to start Wiki.js and its database containers:

docker-compose up -d

This command will download the necessary images and start the containers in detached mode.

6. Once the containers are up and running, open your web browser and navigate to http://localhost (or your server's IP address if running on a remote machine).
7. You should see the Wiki.js setup wizard. Follow the on-screen instructions to complete the initial installation steps.

Configuring Wiki.js with FortifiedID as an OpenID Connect Provider

This guide will help you configure Wiki.js to use FortifiedID Integrity Access as an OpenID Connect 1.0 provider.

Steps

1. Login to Wiki.js as an Administrator.

2. Navigate to Modules > Authentication.

3. Select + Add Strategy.

4. Choose Generic OpenID Connect / OAuth2.

5. Enter the following values:

   • Display Name: FortifiedID-Integrity OpenID Connect
   • Client ID: wikijsid
   • Client Secret: insecure_wiki_secret
   • Authorization Endpoint URL: https://<address to access>/<url path>/authn/<oidc id>
     Example:https://demo.fortifiedid.se/access/authn/oidc
   • Token Endpoint URL: https://<address to access>/oidc/<tenant name>/token-endpoint
     Example: https://demo.fortifiedid.se/oidc/tenant1/token-endpoint
   • User Info Endpoint URL: https://<address to access>/oidc/<tenant name>/userinfo-endpoint
     Example: https://demo.fortifiedid.se/oidc/tenant1/userinfo-endpoint
   • Issuer URL: https://<address to access>/oidc/<tenant name>
     Example: https://demo.fortifiedid.se/oidc/tenant1
   • Email Claim: email
   • Display Name Claim: name
   • Map Groups: Disabled
   • Groups Claim: groups

   For testing purposes, apply the following settings only.
   Do not use this in production

   • Allow self-registration: Enabled
   • Assign to group: Select both Guest and Administrator

6. Callback URL / Redirect URI:

   • Copy the Callback URL / Redirect URI provided by Wiki.js.
     This will be used in the FortifiedID Integrity Access configuration.

7. Click Apply to save the configuration.

Your Wiki.js instance is now configured to authenticate users using FortifiedID as an OpenID Connect provider.

Update the FortifiedID Integrity Access Configuration with Callback URL / Redirect URI

In the FortifiedID Integrity Access configuration, replace "<will be replace with the Callback URL / Redirect URI from wiki.js >" with the "Callback URL / Redirect URI" from Wiki.js configuration.

Example:

"redirect_uri": [
    "http://wikijs.fortifiedid.se/login/494a2bfa-b79c-4c71-ad76-e542ed7fe2b2/callback"
],

Testing the use case

1. Browse to https://<wikijs_dns_name> and select Logga in med Fortified ID
2. You should be redirected to the OP (Integrity Access)
3. Authenticate with the method of your choice
4. You should be redirected back to Wiki.js and you should now be logged in.