CI Logon

The CILogon provides a standards-compliant OpenID Connect (OAuth 2.0) interface https://www.cilogon.org/oidc

Client Registration

Register your app at https://cilogon.org/oauth2/register

Check "org.cilogon.userinfo" in the scopes section/.

Take a note of the callback url that you submitted (e.g. https://myhostname/valid/redirect_uri).

Record the client identifier and client Secret.

You will receive an email from CILogon once your app is approved.

Update pegr configuration

Go to the pegr configuration file, e.g. /usr/local/pegr/pegr-config.properties, and set

sso.url=<HOST>/sso
sos.type=Header
sso.principle=OIDC_CLAIM_eppn

Install mod_auth_openidc on Apache HTTPD 2.x

$ sudo dnf install epel-release
$ sudo dnf install mod_auth_openidc
$ sudo systemctl restart httpd

Update https configurations

Create file /etc/httpd/openidc.d/openidc.conf.

#LoadModule auth_openidc_module modules/mod_auth_openidc.so
OIDCProviderMetadataURL https://cilogon.org/.well-known/openid-configuration
OIDCScope "openid email profile org.cilogon.userinfo"


OIDCClientID "cilogon:/client_id/XXXXXXXXXXXXXXXXXXXX"
OIDCClientSecret "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
OIDCCryptoPassphrase "XXXXXXXXXXXXXXXXXX"

# For debugging/seeing session info. Can be removed for production:
OIDCInfoHook iat access_token access_token_expires id_token userinfo refresh_token session

OIDCRedirectURI https://MYHOSTNAME/valid/redirect_uri

<Location /valid>
  AuthType openid-connect
  Require valid-user
</Location>

<Location /sso>
  AuthType openid-connect
  Require valid-user
</Location>

<Location /pegr>
  AuthType openid-connect
  Require valid-user
  OIDCUnAuthAction pass
</Location>

Remember to replace the OIDCClientID, OIDCClientSecret, OIDCCryptoPassphrase, and MYHOSTNAME.