NAME

RT::Authen::OAuth2 Configuration

USER-CONFIGURABLE OPTIONS

$EnableOAuth2

Set this to enable the OAuth2 button on the login page.

Set($EnableOAuth2, 1);

$OAuthCreateNewUser

Set this to enable auto-creating new users based on the OAuth2 data.

Set($OAuthCreateNewUser, 1);

$OAuthNewUserOptions

Set this to enable auto-creating new users based on the OAuth2 data.

Set($OAuthNewUserOptions, {
        Privileged => 1,
    },
);

$OAuthIDP

Set this to the label of the Identity Provider endpoint you want to use. The list of IDPs is in the internal configuration option OAuthIDPs. Default is 'google'.

Set($OAuthIDP, 'google');

%MetadataMap

NOTE: This is a sub-key of $OAuthIDPs. Each IDP has a MetadataMap.

This defines a mapping from the fields returned in the user's metadata, to fields needed by this extension in RT. The EmailAddress field is required, and is used to identify the user account in the RT database. It must match with the email returned by the Identity Provider.

%OAuthIDPSecrets Client ID and Secret

REQUIRED

You must set the Client ID and Client Secret here. These are given to you by your Identity Provider. For Google, they are found in the developer console where you configure the OAuth login. Each endpoint can have its own set of secrets, so you must specify the endpoint name as found in the %OAuthIDPs internal config option.

Set(%OAuthIDPSecrets,
    'google' => {
        client_id => '...',
        client_secret => '...',
    },
    ...
);

INTERNAL CONFIGURATION DEFAULTS

$OAuthRedirect

This parameter is used by Google to define where the results are returned. Must match what is configured in the Google Developer console, and the name and path of the template components that handle the request. You should never need to change this.

This should be a full URI (see rfc6819 section 4.1.5)

Set($OAuthRedirect, RT->Config->Get('WebURL') . 'NoAuth/OAuthRedirect');

%OAuthIDPs Internal Options

These are defaults for common endpoints. They should only be modified by the RT admin with good cause; most will want to leave these as they are.

Note, not all services listed here are tested and working. They may be added as supported options in future releases, or by customer request.

See etc/OAuth_Config.pm in this extension's directory tree for a list.