OpenIDConnect Auth for Sentry

An SSO provider for Sentry which enables OpenID Connect Apps authentication.

This is a fork of sentry-auth-google.

Why fork, instead of adapting sentry-auth-google to work with every OpenID Connect provider?

The maintainer has different ideas with sentry-auth-google. See:

• getsentry#29
• getsentry/sentry#5650

Install

$ pip install sentry-auth-oidc

Example Setup for Google

Start by creating a project in the Google Developers Console.

In the Authorized redirect URIs add the SSO endpoint for your installation:

https://sentry.example.com/auth/sso/

Naturally other providers, that are supporting OpenID-Connect can also be used (like GitLab).

Finally, obtain the API keys and the well-known account URL and plug them into your sentry.conf.py:

OIDC_CLIENT_ID = ""

OIDC_CLIENT_SECRET = ""

OIDC_SCOPE = "openid email"

OIDC_DOMAIN = "https://accounts.google.com"  # e.g. for Google

# Optional: UserInfo claim to use as Sentry's display name.
# Defaults to "name".
OIDC_USERINFO_NAME_CLAIM = "name"

The OIDC_DOMAIN defines where the OIDC configuration is going to be pulled from. Basically it specifies the OIDC server and adds the path .well-known/openid-configuration to it. That's where different endpoint paths can be found.

Detailed information can be found in the ProviderConfig specification.

Configuration Options

You can customize the provider display name:

OIDC_PROVIDER_NAME = "My Company SSO"

The OIDC_PROVIDER_NAME controls how the provider appears in the Sentry UI. The name is also used to generate login, identity-linking, and organization authentication settings screens.

Note: The OIDC_ISSUER setting is used internally for token validation and is not displayed to users. Use OIDC_PROVIDER_NAME to customize the display name instead. If OIDC_PROVIDER_NAME is not set, the provider name falls back to the configured or discovered issuer for backwards compatibility, and then to OIDC.

Custom Icon

To add a custom icon for your OIDC provider, add custom CSS to your self-hosted Sentry deployment. The icon CSS class is based on the stable provider key, so it stays oidc even when OIDC_PROVIDER_NAME is customized.

For a quick overview, the CSS hook is:

.provider-logo.oidc {
    background-image: url('/static/your-oidc-icon.svg');
}

See Custom Provider Icon for self-hosted Sentry image examples.

If your provider doesn't support the OIDC_DOMAIN, then you have to set these required endpoints by yourself (autorization_endpoint, token_endpoint, userinfo_endpoint, issuer).

OIDC_AUTHORIZATION_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth"  # e.g. for Google

OIDC_TOKEN_ENDPOINT = "https://www.googleapis.com/oauth2/v4/token"  # e.g. for Google

OIDC_USERINFO_ENDPOINT = "https://www.googleapis.com/oauth2/v3/userinfo" # e.g. for Google

OIDC_ISSUER = "Google"

Development

FAQ

• If you are using macOS brew's openssl and you get a psycopg build error such as:

  ld: library not found for -lssl
  

  Please setup the following environment variables:

  export LDFLAGS="-L/usr/local/opt/openssl/lib"
  export CPPFLAGS="-I/usr/local/opt/openssl/include"