diff --git a/app.json b/app.json index c6e7311f8..1e79a70ec 100644 --- a/app.json +++ b/app.json @@ -482,6 +482,10 @@ "description": "The 'name' value for the Open edX OAuth Application", "required": true }, + "OPENEDX_OAUTH_PROVIDER": { + "description": "Social auth oauth provider backend name", + "required": false + }, "OPENEDX_SERVICE_WORKER_API_TOKEN": { "description": "Active access token with staff level permissions to use with OpenEdX API client for service tasks", "required": false @@ -490,6 +494,10 @@ "description": "Username of the user whose token has been set in OPENEDX_SERVICE_WORKER_API_TOKEN", "required": false }, + "OPENEDX_SOCIAL_LOGIN_PATH": { + "description": "Open edX social auth login url", + "required": false + }, "OPENEDX_TOKEN_EXPIRES_HOURS": { "description": "The number of hours until an access token for the Open edX API expires", "required": false diff --git a/courseware/api.py b/courseware/api.py index 9fef93ac9..251ab97ed 100644 --- a/courseware/api.py +++ b/courseware/api.py @@ -52,7 +52,6 @@ OPENEDX_REGISTER_USER_PATH = "/user_api/v1/account/registration/" OPENEDX_REQUEST_DEFAULTS = dict(country="US", honor_code=True) # noqa: C408 -OPENEDX_SOCIAL_LOGIN_XPRO_PATH = "/auth/login/mitxpro-oauth2/?auth_entry=login" OPENEDX_OAUTH2_AUTHORIZE_PATH = "/oauth2/authorize" OPENEDX_OAUTH2_ACCESS_TOKEN_PATH = "/oauth2/access_token" # noqa: S105 OPENEDX_OAUTH2_SCOPES = ["read", "write"] @@ -194,7 +193,7 @@ def create_edx_user(user): username=user.username, email=user.email, name=user.name, - provider=settings.MITXPRO_OAUTH_PROVIDER, + provider=settings.OPENEDX_OAUTH_PROVIDER, access_token=access_token.token, **OPENEDX_REQUEST_DEFAULTS, ), @@ -256,7 +255,7 @@ def create_edx_auth_token(user): req_session.cookies.set_cookie(session_cookie) # Step 3 - url = edx_url(OPENEDX_SOCIAL_LOGIN_XPRO_PATH) + url = edx_url(settings.OPENEDX_SOCIAL_LOGIN_PATH) resp = req_session.get(url) resp.raise_for_status() @@ -316,7 +315,7 @@ def update_edx_user_email(user): ) req_session.cookies.set_cookie(session_cookie) - url = edx_url(OPENEDX_SOCIAL_LOGIN_XPRO_PATH) + url = edx_url(settings.OPENEDX_SOCIAL_LOGIN_PATH) resp = req_session.get(url) resp.raise_for_status() @@ -815,7 +814,7 @@ def create_oauth_application(): defaults=dict( # noqa: C408 redirect_uris=urljoin( settings.OPENEDX_BASE_REDIRECT_URL, - f"/auth/complete/{settings.MITXPRO_OAUTH_PROVIDER}/", + f"/auth/complete/{settings.OPENEDX_OAUTH_PROVIDER}/", ), client_type="confidential", authorization_grant_type="authorization-code", diff --git a/courseware/api_test.py b/courseware/api_test.py index cea22306f..190e13cfe 100644 --- a/courseware/api_test.py +++ b/courseware/api_test.py @@ -67,7 +67,7 @@ def application(settings): """Test data and settings needed for create_edx_user tests""" settings.OPENEDX_OAUTH_APP_NAME = "test_app_name" settings.OPENEDX_API_BASE_URL = "http://example.com" - settings.MITXPRO_OAUTH_PROVIDER = "test_provider" + settings.OPENEDX_OAUTH_PROVIDER = "test_provider" settings.MITXPRO_REGISTRATION_ACCESS_TOKEN = "access_token" # noqa: S105 return Application.objects.create( name=settings.OPENEDX_OAUTH_APP_NAME, @@ -174,7 +174,7 @@ def create_token_responses(settings): code = "ghi789" responses.add( responses.GET, - f"{settings.OPENEDX_API_BASE_URL}/auth/login/mitxpro-oauth2/?auth_entry=login", + f"{settings.OPENEDX_API_BASE_URL}{settings.OPENEDX_SOCIAL_LOGIN_PATH}", status=status.HTTP_200_OK, ) responses.add( @@ -243,7 +243,7 @@ def test_create_edx_user(user, settings, application, access_token_count): "username": user.username, "email": user.email, "name": user.name, - "provider": settings.MITXPRO_OAUTH_PROVIDER, + "provider": settings.OPENEDX_OAUTH_PROVIDER, "access_token": created_access_token.token, "country": "US", "honor_code": "True", @@ -350,7 +350,7 @@ def test_update_edx_user_email(settings, user): code = "ghi789" responses.add( responses.GET, - f"{settings.OPENEDX_API_BASE_URL}/auth/login/mitxpro-oauth2/?auth_entry=login", + f"{settings.OPENEDX_API_BASE_URL}{settings.OPENEDX_SOCIAL_LOGIN_PATH}", status=status.HTTP_200_OK, ) responses.add( diff --git a/docs/configure_open_edx.md b/docs/configure_open_edx.md deleted file mode 100644 index 1fef4b896..000000000 --- a/docs/configure_open_edx.md +++ /dev/null @@ -1,177 +0,0 @@ -## Configure Open edX - -In order to create user accounts in Open edX and permit authentication from xPro to Open edX, you need to configure xPro as an OAuth2 provider for Open edX. - -#### Setup Open edX Devstack - -Following steps are inspired by [edx-devstack](https://github.com/edx/devstack). - -#### Clone edx/devstack - -``` -$ mkdir openedx -$ cd openedx -$ git clone https://github.com/edx/devstack -$ cd devstack -$ git checkout open-release/maple.master -$ make requirements -$ export OPENEDX_RELEASE=maple.master -$ make dev.clone -``` - -#### Clone and checkout edx-platform (if not already). - -``` -$ cd .. -$ git clone https://github.com/mitodl/edx-platform -$ cd edx-platform -$ git checkout xpro/maple -``` - -#### Pull latest images and run provision - -``` -$ cd devstack -$ make pull -$ make dev.provision -``` - -#### Start your servers - -`make dev.up` - -#### Stop your servers - -`make stop` - -### Setup social auth - -#### Install `social-auth-mitxpro` in LMS - -There are two options for this: - -##### Install via pip - -- `pip install social-auth-mitxpro` - -##### Install from local Build - -- Checkout the [social-auth-mitxpro](https://github.com/mitodl/social-auth-mitxpro) project and build the package per the project instructions -- Copy the `social-auth-mitxpro-$VERSION.tar.gz` file into devstack's `edx-platform` directory -- In devstack, run `make lms-shell` and within that shell `pip install social-auth-mitxpro-$VERSION.tar.gz` - - To update to a new development version without having to actually bump the package version, simply `pip uninstall social-auth-mitxpro`, then install again - -#### Install `openedx-companion-auth` in LMS - -There are two options for this: - -##### Install via pip - -- `pip install openedx-companion-auth` - -##### Install from local Build - -- Checkout the [openedx-companion-auth](https://github.com/mitodl/open-edx-plugins/tree/main/src/openedx_companion_auth) project and build the package as per the project instructions -- Copy the `openedx-companion-auth-$VERSION.tar.gz` file from `dist` folder into devstack's `edx-platform` directory -- In devstack, run `make lms-shell` and within that shell `pip install openedx-companion-auth-$VERSION.tar.gz` - - To update to a new development version without having to actually bump the package version, simply `pip uninstall -y openedx-companion-auth`, then install again - -#### Configure xPro as a OAuth provider for Open edX - -In xPro: - -- go to `/admin/oauth2_provider/application/` and create a new application with these settings selected: - - - `Redirect uris`: `http://:18000/auth/complete/mitxpro-oauth2/` - - - _[OSX users]_ You will need redirect uris for both the local edX host alias and for `host.docker.internal`. This value should be: - - ```shell - http://edx.odl.local:18000/auth/complete/mitxpro-oauth2/ - http://host.docker.internal:18000/auth/complete/mitxpro-oauth2/ - ``` - - - _[Linux users]_ You will need redirect uris for both the local edX host alias and for the gateway IP of the docker-compose networking setup for xPro as found via `docker network inspect mitxpro_default` - - ```shell - http://edx.odl.local:18000/auth/complete/mitxpro-oauth2/ - http://:18000/auth/complete/mitxpro-oauth2/ - # `GATEWAY_IP` should be something like `172.19.0.1`. - ``` - - - `Client type`: "Confidential" - - `Authorization grant type`: "Authorization code" - - `Skip authorization`: checked - - Other values are arbitrary but be sure to fill them all out. Save the client id and secret for later - -In Open edX (derived from instructions [here](https://edx.readthedocs.io/projects/edx-installing-configuring-and-running/en/latest/configuration/tpa/tpa_integrate_open/tpa_oauth.html#additional-oauth2-providers-advanced)): - -- `make lms-shell` into the LMS container and ensure the following settings: - - `/edx/etc/lms.yml`: - ``` - FEATURES: - ALLOW_PUBLIC_ACCOUNT_CREATION: true - ENABLE_COMBINED_LOGIN_REGISTRATION: true - ENABLE_OAUTH2_PROVIDER: true - ENABLE_THIRD_PARTY_AUTH: true - ... - REGISTRATION_EXTRA_FIELDS: - ... - country: hidden - ... - SOCIAL_AUTH_OAUTH_SECRETS: - mitxpro-oauth2: - THIRD_PARTY_AUTH_BACKENDS: - - social_auth_mitxpro.backends.MITxProOAuth2 - ``` -- `make lms-restart` to pick up the configuration changes -- Login to django-admin, go to `http://:18000/admin/third_party_auth/oauth2providerconfig/`, and create a new config: - - Select the default example site - - The slug field **MUST** match the `Backend.name`, which for us is ` -mitxpro-oauth2` - - Client Id should be the client id from the xPro Django Oauth Toolkit Application - - Check the following checkboxes: - - Skip hinted login dialog - - Skip registration form - - Sync learner profile data - - Enable SSO id verification - - In "Other settings", put: - ``` - { - "AUTHORIZATION_URL": "http://:8053/oauth2/authorize/", - "ACCESS_TOKEN_URL": "http://:8053/oauth2/token/", - "API_ROOT": "http://:8053/" - } - ``` - - `LOCAL_XPRO_ALIAS` should be your `/etc/hosts` alias for the mitxpro app - - `EXTERNAL_XPRO_HOST` will depend on your OS, but it needs to be resolvable within the edx container - - Linux users: The gateway IP of the docker-compose networking setup for xPro as found via `docker network inspect mitxpro_default` - - OSX users: Use `host.docker.internal` - -#### Configure Open edX to support OAuth2 authentication from xPro - -- In Open edX: - - go to `/admin/oauth2_provider/application/` and verify that an application named 'edx-oauth-app' exists with these settings: - - `Redirect uris`: `http://xpro.odl.local:8053/login/_private/complete` - - `Client type`: "Confidential" - - `Authorization grant type`: "Authorization code" - - `Skip authorization`: checked - - Other values are arbitrary but be sure to fill them all out. Save the client id and secret for later -- In xPro: - - Set `OPENEDX_API_CLIENT_ID` to the client id - - Set `OPENEDX_API_CLIENT_SECRET` to the client secret - -#### Configure Logout - -- In Open edX, configure `settings.IDA_LOGOUT_URI_LIST` to be a list including the full url to `://[:]/logout` in xPro - - - For devstack, this means modifying the value in `edx-platform/lms/envs/devstack.py` to include `http://xpro.odl.local:8053/logout` - - For production, this setting can go in `lms.env.json` under the key `IDA_LOGOUT_URI_LIST` as a JSON array of with that string in it - -- xPro: - - Set `LOGOUT_REDIRECT_URL` to the full path to the edx `/logout` view. - - For local development this will be `http://:18000/logout` - -#### Configure Open edX user and token for use with xPro management commands - -- In Open edX, create a staff user and then under `/admin/oauth2_provider/accesstoken/` add access token. The value of said token needs to match the value set for the `OPENEDX_SERVICE_WORKER_API_TOKEN` key in the xPro app. diff --git a/mitxpro/management/commands/configure_instance.py b/mitxpro/management/commands/configure_instance.py index 41b45cebc..8ebabeba5 100644 --- a/mitxpro/management/commands/configure_instance.py +++ b/mitxpro/management/commands/configure_instance.py @@ -114,8 +114,8 @@ def handle(self, *args, **kwargs): # noqa: ARG002 if kwargs["platform"] == "macos": redirects = "\n".join( [ - f"http://{edx_host}/auth/complete/mitxpro-oauth2/", - f"http://host.docker.internal{edx_gateway_port}/auth/complete/mitxpro-oauth2/", + f"http://{edx_host}/auth/complete/ol-oauth2/", + f"http://host.docker.internal{edx_gateway_port}/auth/complete/ol-oauth2/", ] ) else: @@ -129,8 +129,8 @@ def handle(self, *args, **kwargs): # noqa: ARG002 redirects = "\n".join( [ - f"http://{edx_host}/auth/complete/mitxpro-oauth2/", - f"http://{kwargs['gateway']}{edx_gateway_port}/auth/complete/mitxpro-oauth2/", + f"http://{edx_host}/auth/complete/ol-oauth2/", + f"http://{kwargs['gateway']}{edx_gateway_port}/auth/complete/ol-oauth2/", ] ) diff --git a/mitxpro/settings.py b/mitxpro/settings.py index f506830a1..eecc2a812 100644 --- a/mitxpro/settings.py +++ b/mitxpro/settings.py @@ -1070,7 +1070,18 @@ MITOL_AUTHENTICATION_REPLY_TO_EMAIL = MITXPRO_REPLY_TO_ADDRESS -MITXPRO_OAUTH_PROVIDER = "mitxpro-oauth2" +OPENEDX_OAUTH_PROVIDER = get_string( + name="OPENEDX_OAUTH_PROVIDER", + default="mitxpro-oauth2", + description="Social auth oauth provider backend name", +) + +OPENEDX_SOCIAL_LOGIN_PATH = get_string( + name="OPENEDX_SOCIAL_LOGIN_PATH", + default="/auth/login/mitxpro-oauth2/?auth_entry=login", + description="Open edX social auth login url", +) + OPENEDX_OAUTH_APP_NAME = get_string( name="OPENEDX_OAUTH_APP_NAME", default="edx-oauth-app",