Several authlib AUTH_PROVIDERS

Administrators
1

I’m trying to connect two separate auth providers using oidc by configuring authlib. Unfortunately, my configuration works fine when just one of them is enabled. Enabling both causes internal server errors. Here is my example config:

AUTH_PROVIDERS = {
    'providerone': {
        'type': 'authlib',
        'title': 'providerone',
        'authlib_args': {
            'client_id': 'providerone-client-id',
            'client_secret': 'providerone-client-secret',
            'server_metadata_url': 'https://[providerone-domain-addr]/auth/realms/providerone/.well-known/openid-configuration',
            'client_kwargs': {'scope': 'openid email profile'}
        },
        'callback_uri': '/authlib/providerone',
        'use_id_token': False,
    },
    'providertwo': {
        'type': 'authlib',
        'title': 'providerone',
        'authlib_args': {
            'client_id': 'providertwo-client-id',
            'client_secret': 'providertwo-client-secret',
            'server_metadata_url': 'https://[providertwo-domain-addr]/auth/realms/providertwo/.well-known/openid-configuration',
            'client_kwargs': {'scope': 'openid email profile'}
        },
        'callback_uri': '/authlib/providertwo',
        'use_id_token': False,
    },
}

IDENTITY_PROVIDERS = {
    'providerone': {
        'type': 'authlib',
        'title': 'providerone IDP',
        'mapping': {
            'first_name': 'given_name',
            'last_name': 'family_name',
            'email': 'email'
        },
        'trusted_email': True,
        'synced_fields': {'first_name', 'last_name'}
    },
    'providertwo': {
        'type': 'authlib',
        'title': 'providertwo IDP',
        'mapping': {
            'first_name': 'given_name',
            'last_name': 'family_name',
            'email': 'email'
        },
        'trusted_email': True,
        'synced_fields': {'first_name', 'last_name'}
    }
}

Is it possible to have such a configuration with two separate auth providers using authlib, or am I missing something? I cannot find an error message in logs when internal server errors occur, so I have no clues what is wrong with it.

2

Internal server error without Indico styling usually indicates a syntax error in the config or another error during startup. Best to run e.g. indico shell to see if there’s such an error.

3

Thanks! That helped me a lot! I’ve had synced_fields in both IDENTITY_PROVIDERS definitions.