FR: Support multiple usages of the same strategy in config about ueberauth

[Hajto]

Can you provide a few examples?

[samip5]

Can you provide a few examples?

Take any of the strategies and try to define it multiple times, e.g. Keycloack strategy for a Keycloack instance and Authentik. It will fail.

[yordis]

@samip5 do you mind providing a code snippet with your configuration?

You should be able to do the following:

config :ueberauth, Ueberauth,
  providers: [
    keycloackone: { Ueberauth.Strategy. Keycloack, [] },
    keycloacktwo: { Ueberauth.Strategy. Keycloack, [] },] }
  ]

The key is what matters.

[Hajto]

I can confirm, I've done similar thing with Facebook. Works like a charm.

[samip5]

It may be that we are defining it weirdly in Mobilizon.
I'm not at all sure how one would define multiple config :ueberauth, Ueberauth.Strategy.Keycloak.OAuth so that it would be for the specific provider.

config :ueberauth,
       Ueberauth,
       providers: [
         keycloak: {Ueberauth.Strategy.Keycloak, [default_scope: "openid profile email"]}
       ]

config :mobilizon, :auth,
  oauth_consumer_strategies: [
    {:keycloak, "Pikaviestin.fi -tunnus"}
  ]

authentik_url = "https://login.pikaviestin.fi"

config :ueberauth, Ueberauth.Strategy.Keycloak.OAuth,
  client_id: "<snip>",
  client_secret: "<snip>",
  site: authentik_url,
  authorize_url: "#{authentik_url}/application/o/authorize/",
  token_url: "#{authentik_url}/application/o/token/",
  userinfo_url: "#{authentik_url}/application/o/userinfo/",
  token_method: :post

[Hajto]

So the proper solution would be to be able to pass provider specific info in the strategy opts?
Something like this possibly?

config :ueberauth,
       Ueberauth,
       providers: [
         keycloak: {Ueberauth.Strategy.Keycloak, [default_scope: "openid profile email", client_id: "123", client_secret: "321"]}
       ]

[Hajto]

To me it looks more of an issue with provider implementation. If it read data from source different than config, it could be done quite easily.

[samip5]

So the proper solution would be to be able to pass provider specific info in the strategy opts? Something like this possibly?

config :ueberauth,
       Ueberauth,
       providers: [
         keycloak: {Ueberauth.Strategy.Keycloak, [default_scope: "openid profile email", client_id: "123", client_secret: "321"]}
       ]

Possibly, but that wouldn't help with URLs portion of the equation.
It's very possible that the problem is the implementation in Mobilizon instead of it being an problem in ueberauth itself.

[samip5]

@samip5 do you mind providing a code snippet with your configuration?

You should be able to do the following:

config :ueberauth, Ueberauth,
  providers: [
    keycloackone: { Ueberauth.Strategy. Keycloack, [] },
    keycloacktwo: { Ueberauth.Strategy. Keycloack, [] },] }
  ]

The key is what matters.

If you set it like that, how would you set different options per provider for urls and keys?

[Hajto]

Would something like this be acceptable API format?

config :ueberauth, Ueberauth,
  providers: [
    keycloackone:
      {Ueberauth.Strategy.Keycloack,
       [
         client_id: "<snip>",
         client_secret: "<snip>",
         site: authentik_url,
         authorize_url: "#{authentik_url}/application/o/authorize/",
         token_url: "#{authentik_url}/application/o/token/",
         userinfo_url: "#{authentik_url}/application/o/userinfo/",
         token_method: :post
       ]},
    keycloacktwo:
      {Ueberauth.Strategy.Keycloack,
       [
         client_id: "<snip2>",
         client_secret: "<2snip>",
         site: authentik_ur2l,
         authorize_url: "#{authentik_url}/appasdlication/o/authorize/",
         token_url: "#{authentik_url}/applicatiasdon/o/token/",
         userinfo_url: "#{authentik_url}/applicasdation/o/userinfo/",
         token_method: :post
       ]}
  ]

I am not sure if current version of Ueberauth will allow this.
Strategy itself also needs to be changed, and it seems like Keycloak Strategy is not under the ueberauth. I can create an appropriate PR for that repo, but I cannot guarantee I can persuade owner to accept the changes.

[samip5]

I think the array [] is for scopes though originally, but otherwise that would look reasonable yes.

[paulswartz]

If the provider doesn't support this, it might be an issue with the provider. I know that I've been testing UeberauthOidcc with multiple providers against Keycloak and it works fine, so you might give that a shot if the other one isn't working.

[samip5]

If the provider doesn't support this, it might be an issue with the provider. I know that I've been testing UeberauthOidcc with multiple providers against Keycloak and it works fine, so you might give that a shot if the other one isn't working.

I think the problem might not be the provider but how it's implemented in the app in question.