Third party logins

The application supports login via social authentication providers using OAuth2. This allows users to log in using their existing accounts from the appropriate providers. You can use any provider supported by django-allauth, see the full list at https://docs.allauth.org/en/latest/socialaccount/providers/index.html

To enable social authentication follow these steps:

1. Register the application with the provider

Register your application with the desired social authentication provider to obtain the necessary credentials (client ID and client secret). You will also need to configure the exact domain that you will be using. The allauth docs linked above contain provider-specific setup hints.

2. Configure the application

Configure the providers you want to load via the WGER_SOCIAL_PROVIDERS environment variable, e.g. WGER_SOCIAL_PROVIDERS=google,github,gitlab, use the allauth provider IDs for the names.

3. Add the provider to the database

Add the provider to the local db with the credentials from the first step, use a Django shell (./manage.py shell) for this. To list, edit or delete entries later, use the same models, and make sure to keep the enabled providers matching the entries in the db.

from allauth.socialaccount.models import SocialApp
from django.contrib.sites.models import Site

app = SocialApp.objects.create(
    provider='google',
    name='Google',
    client_id='...',
    secret='...',
)
app.sites.add(Site.objects.get(id=1))

# To delete
SocialApp.objects.get(provider='google').delete()

# To update
app = SocialApp.objects.get(provider='google').update(client_id='...')

Each provider can be configured via the settings field, but this is usually not necessary as they all ship with sensible defaults (scopes, PKCE, etc.). If you need to configure this, just save a dictionary to the field:

app.settings = {
    'scope': ['profile', 'email', 'https://www.googleapis.com/auth/calendar.readonly'],
    'auth_params': {'access_type': 'offline'},
}
app.save()

See the allauth provider documentation for the keys each provider supports.

Generic OpenID Connect (OIDC)

Besides the named providers, allauth ships a generic openid_connect provider that works with any spec-compliant OpenID Connect server, such as Keycloak, authentik, Authelia or Zitadel. The setup is the same as above, with two differences: the app additionally needs a unique provider_id, and the server’s discovery URL goes into its settings field.

Enable the provider:

WGER_SOCIAL_PROVIDERS=openid_connect

and add the app to the database:

from allauth.socialaccount.models import SocialApp
from django.contrib.sites.models import Site

app = SocialApp.objects.create(
    provider='openid_connect',

    # unique slug, appears in the login URLs
    provider_id='keycloak',

    # label of the login button
    name='Keycloak',

    client_id='...',
    secret='...',
    settings={'server_url': 'https://idp.example.com/realms/myrealm'},
)
app.sites.add(Site.objects.get(id=1))

The server_url can either point directly to the /.well-known/openid-configuration document or to the issuer base URL, in which case the well-known suffix is appended automatically.

When registering the client at the identity provider, use the following redirect (callback) URL, with the provider_id chosen above:

https://your.wger.server/account/oidc/<provider_id>/login/callback/

To offer several OIDC servers at the same time, simply create one SocialApp entry per server, each with its own provider_id.