add annotation about using own IDP, CA and Docker (#6454)
Daniel-Hillenbrand committed
Oct 15, 2024 at 10:45 UTC
ccf00b7d0652e5d6ea53dc785f2f32e6679a8729
1 file changed
+18
-1
docs/docs/meshcentral/openidConnectStrategy.md
+18
-1
@@ -32,6 +32,23 @@ OpenID Connect allows clients of all types, including Web-based, mobile, and Jav
32
33
That description was straight from [OpenID Connect Documentation](https://openid.net/connect/), but basically, OAuth2 is the foundation upon which OpenID Connect was built, allowing for wide ranging compatability and interconnection. OpenID Connect appends the secure user *authentication* OAuth2 is known for, with user *authorization* by allowing the request of additional *scopes* that provide additional *claims* or access to API's in an easily expandable way.
34
35
+### Annotations
36
+
37
+#### Own IDP, CA and Docker
38
+
39
+If you operate your own identity provider, your own certification authority and MeshCentral via Docker, it is necessary to provide the complete certificate chain, otherwise NodeJS (in particular the openid-client module) will refuse the connection to the IDP server.
40
+
41
+The following errors can be found in the log file:
42
+> OIDC: Discovery failed.
43
+
44
+> UNABLE_TO_GET_ISSUER_CERT_LOCALLY
45
+
46
+To solve this problem, the certificate chain in PEM format must be placed in the data directory and the following entry must be added to the docker-compose.yml file in the “environment” section:
47
+```
48
+ environment:
49
+ - NODE_EXTRA_CA_CERTS=/opt/meshcentral/meshcentral-data/chain.pem
50
+```
51
+
52
## Basic Config
53
54
### *Introduction*
@@ -651,4 +668,4 @@ https://github.com/panva/node-openid-client
668
669
https://openid.net/connect/
670
654
-> You just read `openidConnectStrategy.ms v1.0.1` by [@mstrhakr](https://github.com/mstrhakr)
\ No newline at end of file
671
+> You just read `openidConnectStrategy.ms v1.0.1` by [@mstrhakr](https://github.com/mstrhakr)