Configure OpenID Connect with GitHub
|
GitHub user’s must have a public email address configured for their account in order for this login flow to succeed. |
Once you have completed this configuration you may enable an OpenID Connect "Login with GitHub" button for one or more FusionAuth Applications. See GitHub - Creating an OAuth App for an additional reference.
Register a GitHub OAuth2 Application
You will first need to login to GitHub.
Once logged in, navigate to to create a new GitHub OAuth Application.
Here we have configured our application Authorization callback URL. If FusionAuth is running at https://local.fusionauth.io, this value should be https://local.fusionauth.io/oauth2/callback.
Once the application has been created, note the Client ID and the Client Secret. These will be used respectively as the Client Id value and the Client secret value in your FusionAuth OpenID Connect Identity Providers configuration.
Configure a New FusionAuth OpenID Connect Identity Provider
To create a GitHub Identity Provider return to FusionAuth and navigate to and click Add provider and select OpenID Connect from the dialog.
This will take you to the Add OpenID Connect panel, and you’ll fill out the required fields.
You will need to set Client authentication method to HTTP Basic authentication (client_secret_basic).
Client Id and Client secret values reference the previously noted GitHub OAuth Application’s Client ID and Client Secret. The Redirect URL is read only and generated for you based upon the URL of FusionAuth, this value should match the one you configured in your GitHub application.
GitHub has not implemented a well-known configuration endpoint, so you will need to disable the Discover endpoints field and specify the endpoints manually. The values for these fields are:
-
Authorization endpoint-https://github.com/login/oauth/authorize -
Token endpoint-https://github.com/login/oauth/access_token -
Userinfo endpoint-https://api.github.com/user
You will need to specify user:email as a Scope for your application.
In the following screenshot you will see that we have enabled this login provider for the Aviato application and enabled Create registration.
GitHub does not implement OpenID Connect to spec. In order to pull in some additional data for populating the user profile (GitHub shortname, Image URL, etc.) you can enable a Reconcile lambda. See this example lambda which is based on the GitHub use case. This is optional.
That’s it, now the Login with GitHub button will show up on the login page of our Aviato application.
