REDCap and Keycloak :(
Matteo Riva
Luke Stevens
Hello Matteo,
Not sure how helpful this is – I know nothing about Keycloak – just thought I’d share my experience setting up 2FA with Okta. It was appearing to return the email address of the person logging in instead of the expected username. To find out what was going on I added some additional logging code at various points in the page execution (on a test server of course). From that I was able to see precisely what data came back to REDCap from Okta, and found that the username was being returned in an attribute named “preferred_username”, not “username””. Perhaps you might get some mileage following a similar strategy?
HTH
Luke
Luke Stevens
Research Data Systems Manager
Clinical Epidemiology & Biostatistics Unit (CEBU)
Murdoch Children's Research Institute
The Royal Children's Hospital, 50 Flemington Road
Parkville, Victoria 3052 Australia
T +61 3 9345 6552
E luke.s...@mcri.edu.au
W mcri.edu.au
From: redca...@googlegroups.com <redca...@googlegroups.com>
On Behalf Of Matteo Riva
Sent: Thursday, 8 September 2022 01:17
To: redcap open <redca...@googlegroups.com>
Subject: [EXTERNAL]REDCap and Keycloak :(
CAUTION: External Email. Please be cautious with attachments and clicking links
--
You received this message because you are subscribed to the Google Groups "redcap open" group.
To unsubscribe from this group and stop receiving emails from it, send an email to
redcap_open...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/redcap_open/74b985eb-085f-4867-b387-2ffdcec8e052n%40googlegroups.com.
This e-mail and any attachments to it (the "Communication") are, unless otherwise stated, confidential, may contain copyright material and is for the use only of the intended recipient. If you receive the Communication in error, please notify the sender immediately by return e-mail, delete the Communication and the return e-mail, and do not read, copy, retransmit or otherwise deal with it. Any views expressed in the Communication are those of the individual sender only, unless expressly stated to be those of Murdoch Children’s Research Institute (MCRI) ABN 21 006 566 972 or any of its related entities. MCRI does not accept liability in connection with the integrity of or errors in the Communication, computer virus, data corruption, interference or delay arising from or in respect of the Communication.
Peter Macisaac
To view this discussion on the web visit https://groups.google.com/d/msgid/redcap_open/SY4PR01MB84394728281196B5B8D010BBDA409%40SY4PR01MB8439.ausprd01.prod.outlook.com.
Matteo Riva
Matteo Riva
Peter Macisaac
On 9 Sep 2022, at 11:42 pm, Matteo Riva <mat.ri...@gmail.com> wrote:
Hello Luke and Peter,
To view this discussion on the web visit https://groups.google.com/d/msgid/redcap_open/dc9f8da7-e8bc-4728-a883-789e4610ee4an%40googlegroups.com.
Luke Stevens
Hello Matteo,
I looked up some more detail about what I did to discover the attribute names that Okta was returning to REDCap.
This is in Authentication.php in the function authenticateOpenIDConnect() where I added the logging line:
// Get user info, if successfully logged in
if ($success) {
REDCap::logEvent('OpenID Connect Auth - success', var_export($oidc, true));
// Set username
And one of the properties contains an array named 'verifiedClaims' which contained the user info. I could see my username in an element with the key ‘preferred_username’.
REDCap gives us these options for where to get the username from:
You asked “Can you explain in detail how you changed the attribute from "preferred_username" to "username", please?” Well, I didn’t! I asked our IT dept if they could change how Okta sends the username (i.e. to use one of the dropdown’s elements) but they said no. I got the REDCap auth working by manually setting the config table value to what I needed: UPDATE `redcap`.`redcap_config` SET `value` = 'preferred_username' WHERE (`field_name` = 'openid_connect_username_attribute');
I would of course need to do that each time I save the Auth config page, because that will reset that value to username. More likely is I will write an external module that adds preferred_username as a dropdown option.
I hope that is helpful.
Luke
To view this discussion on the web visit https://groups.google.com/d/msgid/redcap_open/C95015ED-649C-4D76-9CE3-7BE2B343E02E%40macisaacinformatics.org.
Matteo Riva
Luke Stevens
Sorry I wasn’t quite clear Matteo. What I did was add the logging line to the code in my test instance so that I could inspect what Okta was returning to REDCap. I found that it was using “preferred_username” and not one of the names that REDCap has built in, so to get REDCap to look for my username as “preferred_username” I ran that update statement in my database to update the value in the redcap_config table.
I am not saying that the solution is likely to be the same for you, just that the process I followed may be helpful to you. Try adding that logging line and find out what you see. Go from there…
HTH
Luke
From: redca...@googlegroups.com <redca...@googlegroups.com>
On Behalf Of Matteo Riva
Sent: Monday, 12 September 2022 20:57
To: redcap open <redca...@googlegroups.com>
Subject: Re: [EXTERNAL]Re: [EXTERNAL]REDCap and Keycloak :(
CAUTION: External Email. Please be cautious with attachments and clicking links
Hello Luke,
Thank you again for your help.
Authentication.php file is present in REDCap VM. I searched for the key 'preferred_username' and actually there is!
Then what I did is to search for the line "UPDATE...SET value...WHERE...." and I added what you suggested.
But...unfortunately, nothing has changed at all :( Again, when I try to login in REDCap with Keycloak it generates a new user instead of login as mine. I do not really know how to move now...
I really thank you again for your kindness.
Matteo
Il giorno venerdì 9 settembre 2022 alle 23:59:03 UTC+2 luke.stevens ha scritto:
Hello Matteo,
I looked up some more detail about what I did to discover the attribute names that Okta was returning to REDCap.
This is in Authentication.php in the function authenticateOpenIDConnect() where I added the logging line:
// Get user info, if successfully logged in
if ($success) {
REDCap::logEvent('OpenID Connect Auth - success', var_export($oidc, true));
// Set username
And one of the properties contains an array named 'verifiedClaims' which contained the user info. I could see my username in an element with the key ‘preferred_username’.
REDCap gives us these options for where to get the username from:
To view this discussion on the web visit https://groups.google.com/d/msgid/redcap_open/766699a3-3bab-434a-a430-968fa7c38939n%40googlegroups.com.