Solel//dev docs

Sign in with Solel

Solel is an OpenID Connect provider, so any app or service that supports OpenID Connect can let people sign in with their Solel account. An app installed on Solel with its own address doesn't need this: people sign in to Solel first, and your back end is told who they are. See Addresses.

Connect your app

An admin connects it in Settings › Apps:

  1. Under Apps that sign in with Solel, choose Connect an app.
  2. Give it a Name and its Return addresses, one per line. They must be https, apart from http on localhost.
  3. Add a Start address if people should open the app somewhere other than its first return address, and a Sign-out address if it takes back-channel logout.
  4. Turn on It runs in the browser, with no server of its own for a single-page or mobile app.
  5. Choose Who can sign in: Everyone at home, Certain people or Certain groups.
  6. Choose Add app. Copy the Client ID, and the Client secret if it has one. The secret is shown only this once.

Make a new secret… replaces a lost one.

Settings for your app

  • Issuer is https:// and Solel's own address, as set in Network and domains. Discovery is at /.well-known/openid-configuration.
  • Endpoints are /oauth/authorize, /oauth/token, /oauth/userinfo and /oauth/jwks. WebFinger works too, at /.well-known/webfinger.
  • Flow. The authorisation code flow, with response_type=code. PKCE with S256 is needed for an app with no secret, and works for any app.
  • Client authentication is client_secret_basic, client_secret_post, or none for an app with no secret.
  • ID tokens are signed with RS256.

Scopes and claims

Scope Claims
openid Needed. sub is the person's Solel id
profile name and preferred_username
email email and email_verified, when they have an address
groups groups: the ids of their groups and the groups those sit in, plus their role, like member. The owner also gets admin
offline_access Accepted. A refresh token comes with every sign-in anyway

How long things last

  • Codes last a minute, and access and ID tokens an hour.
  • Refresh tokens last 30 days and work once: each use hands back a new one.
  • Signing out. When someone signs out everywhere, changes their password, or has their account turned off, their tokens stop working. An app with a sign-out address gets a logout+jwt token with their sub at once.

From another app

An app with the signin.manage grant can do this for an admin, as does. Acting for that admin, it can list, add, change and remove sign-in apps at /api/apps/sign-in and /api/apps/sign-in/{id}, and make a new secret with POST /api/apps/sign-in/{id}/secret. GET /api/apps/sign-in/mine lists the apps the person it acts for may use. With its token alone, GET /api/apps/sign-in/people/{id} says who someone signing in is: id, username, name, role, email, emailVerified and groups.