From abdd91ae72867fcb2a4e524b3704de51687a82b9 Mon Sep 17 00:00:00 2001
From: Christian Cueni <christian.cueni@iterativ.ch>
Date: Wed, 10 Aug 2022 09:45:02 +0200
Subject: [PATCH] Add sso params

---
 env_secrets/local_chrigu.env      | Bin 1757 -> 1805 bytes
 server/config/settings/base.py    |  11 ++++++++++-
 server/vbv_lernwelt/sso/client.py |   2 +-
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/env_secrets/local_chrigu.env b/env_secrets/local_chrigu.env
index 736091fcc5041d2e69cfc00e9326868edd14dbca..2e1036893898e20ab230f1700ba48439b916bdc1 100644
GIT binary patch
literal 1805
zcmV+o2lDs;M@dveQdv+`0JpNKPl?Kanf;b@HfwJkeb;u>Nv|ewxV#w&M!0l*hM9Er
zR)aBK{3A0&14T5LB`ciE`1!K*!~_Pghqq-{j84oIvL0%et~DCOR&A;Y|7%s*b4I{z
z%7{#{ot9L{Zz5Cz=YuEs!C1*f)PJf2wO=>_Z3PQ-)-%0Uth737T7wZ<hzKy=V|5r0
zeBTby0?epZJ?OSF<WB0Hc+4Tf>S!S=-&L&Ouvydcf$)-*Scss+YFUp@KQZVhY1<gt
zTjAQG?&$dgT0{<IXUzrYT6>zTrogG!`7$Ln$I-qy<(j!rXL0{5Aq0uZfq%@1uA_wh
zGVhaKaafdpm9Q|fpEZjmsmF-?UaL180_BOI_;;M(dY_a^;ax<k>5d&S9K?v6T#w{v
zsQ9!r`7SWNNw8wKqD;~NIs*Oy5R_|9>?F(3B>POO5rDe{uuw<uDJhzFQ0YE+_~i|{
zGT{NoHFwA6-+2nv$LP&aqWGZVB8A+Bgq+cEXSU_Ln(i$C&@XGUD64INPNnZOcLq)t
zGigX4Y$xkI<#Nm_{lMR5=PV<Etb1~TF8X8TadpM#<=6L`cXJjN*XfW8VfI=bblN&F
zR+LRl90PO-L3KaMHhHDiLI7VrdmK&Z-j3Z1EhHGU;4#h*@_P#QJbaDo672hJDn(AS
zTPK60Lo9&1lt&zYp?~wnl)}1I3h!9RM`O;{U@++GC$(c`U!1{TNukbYq>Cv<Dd4PN
zk7JN(K1FQHSa-Ky1*O5yV<#$*5V06VcB}fpaSgTZS+aE_3J~os<Qcc&cLz$o-MM|+
z9JENglMfyP)jcn5MaJF{sw@X}xmQSWZ75LKW|0xWik?+65MUsFUV*KR4jAGsw6CzQ
zO0V*+-WQ4#CjluA7U<whVzcIisBG1^av-co66jw8cuNx}6rzM2z^<<fBH!tx|8+x{
zsX-z9S5;s_bJ|=i@M>yn6<9x=3OIgJHMN8Ztt9Ox(>D)AX>q<toU763LRq0hNHc0;
z`gFXD!A^z=27e`?CkY1O;0`;kzD-pxCFtlpA)#uJc-~+33MkZTtEsE86Cr+6c!o1m
zU3wi#sI-c8KTH3FAZzg~kX@b`wxx^QLt7>B6GDafafde}i9|WL7Z|4YVEhy7aI|e>
z#8fCw0mgLbrJ<1j#YtVmgw>eTx?qx=#24%)HlcAQ4<>(24QKb1YJ4!^3GlR2aS1ff
zfI>4hoKsR;Qtr9%oA%Mo&;n-}^(Vtz|J_9~Ov5*ezuJnZC9o)H4w_34NG9$gjuVT_
z-%X#iia`}0eG^7Yvc=1*MElu}uPjB{y2(MMiTVH8`OgQ7_AMK{m}-Qk30W?Ty(XRP
z+F-=5O4-{Up!gc6X?G-~+f|NFb-f%)Br<v!Lm%R7<jvjt_dy58)N4{P@BgY)M_%mQ
zp@Q1<x(WWNIBp@~LZJaMI>&E$jEpK!+H3C8I`-Ms{~2qFC|s+z&T_rqYfi#iKq`e=
zH!oIZqjBEDp-H{xCt-l4OEFF~c4(y8zV7_e*CBAKD5gWuRB5{XI#n^23^3!?H+jtj
zXu_<ZM1=c`rPu_z65xZkIEcP7B#wKjDOl!Y2tkY-CEceN*NJR`s0r6?x{HKFD1elp
zjU4(U9|o?ZV$noA4nmtw2lLDDvQ`v3dOfMheBU&>9I1`Q2DJ8aecBj;#q<hV;^Ka+
z9{TR~V9-tAy(epvM;VpV-Qa9M^F0}pf`Sxer5bQ#s)0gP+`dx2Tvc(zW`;CygKlh&
zU4Q#`SLRsCVSLDVwe_v^(^t#F?#6>9RQ!xA{J(Txi<(T6onE$YTO*@f1fhB1wQCv9
zr1M?plZK-&W78a6rPZg7>YG{_a)9ZZS&Jwvi>59nWnrT7CX|8I_g~0mZyTPT5wp@R
z)R?)hSX=BSIz%!89-%^;IXYz90{6@2-xe>Vnu&#DExDe|3zC>0o`rqFp0hJF1TrJj
z&=7ua9F&cF9ok2Nqu^eSJEhXk9?pNQ_dExvs@8IV)d9?$orO4mYsQ9SN@xsC`1I5|
z@V)$6XCI&ZVf0(XZ%%-_^X@gfX+#E&HEmoEwV9nU=LYAlc8*uBPIVN)$3L&S)<4DT
zqK<12yVg|U<tbZuaT(382NPa$>-A^|DYcqVa(}?5zM0em8_IV3vZx4GJX70MTId<*
zs=cCPU9Nl-R6~2_YR-}yW7f=!AjL;^c#~WviS1<n!L%NYWX4Hzg$oh;28Pp<n*@DQ
zk-r2RDwbM7CNzD-sw74Cnt-uvBtipc_5z_QBCS5;b0CxS_V>3(8wFi6Nlw6V4hnWT
vlLywgA@k`x?6(QmwtJ`lu<Dw@Z2tIbeTJ2}w^kKgMdt}p4(=<Jt(2ZJ;F5cZ

literal 1757
zcmV<31|s<YM@dveQdv+`0M^Z-743HBS}xKL^)9}o6EC|S>3&Y>);*Y=XDT4MkVbEd
zW$K_iDNiw`M!+83Z_P-y-an9<kY69ENIQf!>X~RCArW7f0+Yxu27wl{rtf_9322pz
zd!vulifVLyZhNd+qoKo)ppW)w$O<HC`ii?USDZK!g0#rAloZFa$GDnepT+;2``X6P
z1!!b1OI5sP8vL}F{I-c8%5U2*R5*Wl&-D>t=g~g^ckfgciPKsdD>XIgb=yF$Tub60
zL49y|sKOhHcXP=Y6YH+D?cC;>?mjHRo7R&`EQ7dC`a@;O@*z%q1g?zv5x4dUMOOkq
z#O91K_(ha|-D=5Dje(;>>iXNU*wB3o0>=zk(>xr~fxPa3PHEFSKP<00WJXvN8U2fk
z&7yH7H$^***(`5KBfPIh0x*bb#|BR@wiGwkYiN}?iZeG(l?_J1?OFFuoBL&i(&ZS9
zHqJ29Go5ac`tH3wnl3%*!?ph>^BXFpvQzgnQ}rkI#tK}_kh1Z#sv-uA=WX^rsRK~t
zn#mcc8CL(>^gd#cB0tVTet?AnezQ^t;l&ZN!^Axf^r3n;SmRVXJDl4!(U9dKkmFXd
zKe7D+*%!r37n8Tll3=QkSsd$V^>BZFjM7+=sAEe9x=7Qa3*e+i0?D=yH<mrifyW@T
zp$*P?*ccg1O|_{UhisQAo;1p{xrRYKFCMc@nW`W3<EL&Y$_B)?1hq;iE)D175R70o
zo1LP)Uck%G2^%P}K^+Vd5*dZ5YCoPajPn(|Rzba|Y*6=39bZmLdCgqv(c5Dn|L!za
zj{7l15yH6K@7k~0MrnFGhXDBTj<ZXaqq>0$JT6UC+09D#^jkY6F@8b7vPMY|zIaYk
zWxlNZ2Crwhgl^wccKd>CQ8-bt(Sm64N+1$SHpNk410aRMLXnUu*p!)DKBPzQrXC{4
zx21?Ql#EOO!;ai}Qk|;dNT>@;VZoxJAToRB!86rUG(=B#a|#86k)8b(*(ZkQ-{9ix
zNLx={<kzaZ1Af%&)5teO!vy6T3V%Izt255p5$cMBK`LqPzh++2*r%~6*E_LGrhTA6
z9u5|oDylS^bI6d%N8upMPz23#0qe;_-s&Fe@;DU1N$c%sT)ROdVK9Qk(e1tfT83D8
zHP?>z9$RCKz2+1=vxR3&rOfvh?o5al1rFL@c8pZ7PGd$OsdsAnz?^{Z{*lDKS-OtX
z4IB~VFQ>eG#JJFzLUrL-sk6aI7_>|vZk9X;6~|mD2(s&#QQZ>=&T_U|J547VyVkH^
zfop4zmx4=!vC$?;LgaDjOk+*40nkkVO5?e$d8T~lOm9AjQvgSH)3YNvoHhypM-<MF
zbv>>(1V!L;uY-y0tJa@S#Nj6|o+}_e*aMEcDBI@YOU@-x%SLE?s~P%117J}E4}2Eu
zcH9H`n+E(rID&bt1Fml={bZfnZ#$xcrMtt{EHI%u$(Vs99lnme0qAOq(LZQ~BA;e@
zUT~o_00Mabe2Ir%mU?)vwp3$}0!Q}M*6#CJm(q13&DwCwqjyxTJ6F4*e6buC-G{mr
zndTR8P%es0&B-Q`o7oUd&!!y|GAt5Adm;`Ageq7<BMG9=e%-(?{l`tzLsb2@q?6O|
zJL?8f4zhGng;0z%FVTyNS)iUs-ei~VG6o6SdAX9p_@p($%I?_g#?3m^7*=Q)*uyW)
z_nDE8vu`*9gMO+uO~Bz9{9~9Q>@wRL$Yr(sg-?C6=3dHW)|uIS{^=i_ivCQ^QrylG
z=T*qKCXc>#i)>sI-OtSo#$QI50+CDpIl4!iK*#;v-}ACt;eM9T1i?&OZgE;mn2|BE
znK8V$xLATPQ{Am8-bVnFA?D@DtqMX|<GX3Ue7Bop2hO}L_ef8*Jk?_pChZ*{uc7=B
zoYh!=H$h#!w9?8ofq8ifR{Mk(i(tu&TYKzduLp<e1~LrrLEeTn=OjU}UA1M!l9i$t
zqqfrLGGv)zCOAM=E7w|PMXQfYWZUt<wBlJqoTPqe4AX1Cj4mSV416^_0!q!FwnY1Y
zc$tB9Wp_t-l!lBQddmSsF^|moEl<Guxlw|3``eyglO79^yMo<VJgXV49Y~L{j$57b
z%aH(;co?vt3#<XA<8|}0zI+Sb&3G7bD+hQcIKBWuP{8XHU+=$r>DmxkOY~tx0-!|o
zpX3A*Dc?k<SrrC3e&U&=z*MTYUd&uNqBfl~(-q`{AWvw-`-tD_Q9*5%cJ2*pyNz#G
ztUfQ$Fbui1^-L0~1CAS_+t#WTt^G6F+_sp$S-Y_6Wf-&~nGkG{Bg<wg!wN3rrYvON

diff --git a/server/config/settings/base.py b/server/config/settings/base.py
index 96557976..86cc8254 100644
--- a/server/config/settings/base.py
+++ b/server/config/settings/base.py
@@ -509,6 +509,14 @@ CACHES["learning_path_cache"] = {
 }
 
 # OAuth/OpenId Connect
+IT_OAUTH_TENANT_ID = env.str("IT_OAUTH_TENANT_ID", default=None)
+
+if IT_OAUTH_TENANT_ID:
+    IT_OAUTH_AUTHORIZE_PARAMS = {
+        'tenant_id': IT_OAUTH_TENANT_ID
+    }
+else:
+    IT_OAUTH_AUTHORIZE_PARAMS = {}
 
 OAUTH = {
     "client_name": env("IT_OAUTH_CLIENT_NAME", default="lernetz"),
@@ -516,10 +524,11 @@ OAUTH = {
     "client_secret": env("IT_OAUTH_CLIENT_SECRET", default=""),
     "access_token_url": env("IT_OAUTH_ACCESS_TOKEN_URL", default="https://sso.test.b.lernetz.host/auth/realms/vbv/protocol/openid-connect/token"),
     "authorize_url": env("IT_OAUTH_AUTHORIZE_URL", default="https://sso.test.b.lernetz.host/auth/realms/vbv/protocol/openid-connect/auth"),
+    "authorize_params": IT_OAUTH_AUTHORIZE_PARAMS,
     "api_base_url": env("IT_OAUTH_API_BASE_URL", default="https://sso.test.b.lernetz.host/auth/realms/vbv/protocol/openid-connect/"),
     "local_redirect_uri": env("IT_OAUTH_LOCAL_DIRECT_URI", default="http://localhost:8000/sso/callback/"),
     "client_kwargs": {
-        'scope': '',
+        'scope': env("IT_OAUTH_SCOPE", default=''),
         'token_endpoint_auth_method': 'client_secret_post',
         'token_placement': 'header',
     }
diff --git a/server/vbv_lernwelt/sso/client.py b/server/vbv_lernwelt/sso/client.py
index cfabe4c2..0170f2e3 100644
--- a/server/vbv_lernwelt/sso/client.py
+++ b/server/vbv_lernwelt/sso/client.py
@@ -23,7 +23,7 @@ oauth.register(
     access_token_url=settings.OAUTH["access_token_url"],
     access_token_params=None,
     authorize_url=settings.OAUTH["authorize_url"],
-    authorize_params=None,
+    authorize_params=settings.OAUTH["authorize_params"],
     api_base_url=settings.OAUTH["api_base_url"],
     client_kwargs=settings.OAUTH["client_kwargs"]
 )