# IDP

This service provides a builtin minimal OpenID Connect provider based on [LibreGraph Connect (lico)](https://github.com/libregraph/lico) for КуСфера.

It is mainly targeted at smaller installations. For larger setups it is recommended to replace IDP with an external OpenID Connect Provider.

By default, it is configured to use the КуСфера IDM service as its LDAP backend for looking up and authenticating users. Other backends like an external LDAP server can be configured via a set of [enviroment variables](https://docs.qsfera.eu/docs/dev/server/services/idp/environment-variables).

Note that translations provided by the IDP service are not maintained via КуСфера but part of the embedded  [LibreGraph Connect Identifier](https://github.com/libregraph/lico/tree/master/identifier) package.

## Configuration

### Custom Clients

By default the `idp` service generates a OIDC client configuration suitable for
using КуСфера with the standard client applications (Web, Desktop, iOS and
Android). If you need to configure additional client it is possible to inject a
custom configuration via `yaml`. This can be done by adding a section `clients`
to the `idp` section of the main configuration file (`qsfera.yaml`). This section
needs to contain configuration for all clients (including the standard clients).

For example if you want to add a (public) client for use with the oidc-agent you would
need to add this snippet to the `idp` section in `qsfera.yaml`.

```yaml
clients:
- id: web
  name: КуСфера Web App
  trusted: true
  secret: ""
  redirect_uris:
  - https://qsfera.k8s:9200/
  - https://qsfera.k8s:9200/oidc-callback.html
  - https://qsfera.k8s:9200/oidc-silent-redirect.html
  post_logout_redirect_uris: []
  origins:
  - https://qsfera.k8s:9200
  application_type: ""
- id: QsferaDesktop
  name: КуСфера Desktop Client
  trusted: false
  secret: ""
  redirect_uris:
  - http://127.0.0.1
  - http://localhost
  post_logout_redirect_uris: []
  origins: []
  application_type: native
- id: QsferaAndroid
  name: КуСфера Android App
  trusted: false
  secret: ""
  redirect_uris:
  - oc://android.qsfera.eu
  post_logout_redirect_uris:
  - oc://android.qsfera.eu
  origins: []
  application_type: native
- id: QsferaIOS
  name: КуСфера iOS App
  trusted: false
  secret: ""
  redirect_uris:
  - oc://ios.qsfera.eu
  post_logout_redirect_uris:
  - oc://ios.qsfera.eu
  origins: []
  application_type: native
- id: oidc-agent
  name: OIDC Agent
  trusted: false
  secret: ""
  redirect_uris:
  - http://127.0.0.1
  - http://localhost
  post_logout_redirect_uris: []
  origins: []
  application_type: native
```



