pas.plugins.oidc 2.0.0b2__tar.gz → 2.0.0b4__tar.gz

{pas.plugins.oidc-2.0.0b2 → pas_plugins_oidc-2.0.0b4}/CHANGES.md

@@ -9,6 +9,27 @@
 
 <!-- towncrier release notes start -->
 
+## 2.0.0b4 (2025-02-28)
+
+
+### New features:
+
+- Add backchannel logout implementation for classic ui session @mamico [#67](https://github.com/collective/pas.plugins.oidc/issues/67)
+
+## 2.0.0b3 (2025-02-03)
+
+
+### New features:
+
+- Register the adapter as needed by the @login endpoint present in plone.restapi @erral [#47](https://github.com/collective/pas.plugins.oidc/issues/47)
+- Changes to make compatible with OAM (Oracle Access Manager) @djay [#65](https://github.com/collective/pas.plugins.oidc/pull/64)
+
+
+### Internal:
+
+- Bump plone.restapi to 9.10.0 [@ericof]
+
+
 ## 2.0.0b2 (2024-12-09)
 
 

{pas.plugins.oidc-2.0.0b2 → pas_plugins_oidc-2.0.0b4}/Makefile

@@ -35,6 +35,7 @@ ifeq ($(PYTHON_VERSION_OK),0)
 endif
 
 all: build
+build: install
 
 # Add the following 'help' target to your Makefile
 # And add help text after each target name starting with '\#\#'

{pas.plugins.oidc-2.0.0b2 → pas_plugins_oidc-2.0.0b4}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.2
 Name: pas.plugins.oidc
-Version: 2.0.0b2
+Version: 2.0.0b4
 Summary: OIDC support for Plone sites
 Home-page: https://github.com/collective/pas.plugins.oidc
 Author: mamico
@@ -34,8 +34,9 @@ Requires-Dist: plone.api
 Requires-Dist: plone.app.registry
 Requires-Dist: plone.base
 Requires-Dist: plone.protect
-Requires-Dist: plone.restapi>=8.34.0
+Requires-Dist: plone.restapi>=9.10.0
 Requires-Dist: oic
+Requires-Dist: requests
 Requires-Dist: z3c.form
 Provides-Extra: test
 Requires-Dist: zope.pytestlayer; extra == "test"
@@ -52,6 +53,19 @@ Requires-Dist: zest.releaser[recommended]; extra == "test"
 Requires-Dist: zestreleaser.towncrier; extra == "test"
 Requires-Dist: pytest-mock; extra == "test"
 Requires-Dist: requests-mock; extra == "test"
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: keywords
+Dynamic: license
+Dynamic: project-url
+Dynamic: provides-extra
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
 
 
 <div align="center"><img alt="pas.plugins.oidc logo" src="https://raw.githubusercontent.com/collective/pas.plugins.oidc/main/docs/icon.png" width="70" /></div>
@@ -269,6 +283,19 @@ Currently, the Plone logout form is unchanged.
 Instead, for testing go to the logout page of the plugin: http://localhost:8080/Plone/acl_users/oidc/logout,
 this will take you to Keycloak to logout, and then return to the post-logout redirect URL.
 
+#### Backchannel SLO (experimental)
+
+OIDC Backchannel Logout is a server-to-server mechanism where the IdP notifies RPs via an HTTP POST request to terminate user sessions upon logout, ensuring secure and seamless Single Logout (SLO) without relying on the user's browser.
+See the specification [OpenID Connect Back-Channel Logout 1.0](https://openid.net/specs/openid-connect-backchannel-1_0.html).
+
+Current backchannel logout implementation, in this product, utilizes functionality introduced in plone.session >= 4.0.0 (Plone 6 and later) for server-side session invalidation (see plone.session PR [plone.session#26](https://github.com/plone/plone.session/pull/26)), and, at the moment, applies only to Plone Classic UI.
+
+To enable this functionality:
+
+1. Navigate to `.../acl_users/session/manage_secret` and enable the `Enable per-user keyring` option.
+
+2. Configure the OpenID Provider (e.g., Keycloak) to use the backchannel logout endpoint with the url: `.../acl_users/oidc/backchannel-logout`
+
 ## Technical Decisions
 
 ### Usage of sessions in the login process
@@ -410,6 +437,27 @@ The project is licensed under the GPLv2.
 
 <!-- towncrier release notes start -->
 
+## 2.0.0b4 (2025-02-28)
+
+
+### New features:
+
+- Add backchannel logout implementation for classic ui session @mamico [#67](https://github.com/collective/pas.plugins.oidc/issues/67)
+
+## 2.0.0b3 (2025-02-03)
+
+
+### New features:
+
+- Register the adapter as needed by the @login endpoint present in plone.restapi @erral [#47](https://github.com/collective/pas.plugins.oidc/issues/47)
+- Changes to make compatible with OAM (Oracle Access Manager) @djay [#65](https://github.com/collective/pas.plugins.oidc/pull/64)
+
+
+### Internal:
+
+- Bump plone.restapi to 9.10.0 [@ericof]
+
+
 ## 2.0.0b2 (2024-12-09)
 
 

{pas.plugins.oidc-2.0.0b2 → pas_plugins_oidc-2.0.0b4}/README.md

@@ -213,6 +213,19 @@ Currently, the Plone logout form is unchanged.
 Instead, for testing go to the logout page of the plugin: http://localhost:8080/Plone/acl_users/oidc/logout,
 this will take you to Keycloak to logout, and then return to the post-logout redirect URL.
 
+#### Backchannel SLO (experimental)
+
+OIDC Backchannel Logout is a server-to-server mechanism where the IdP notifies RPs via an HTTP POST request to terminate user sessions upon logout, ensuring secure and seamless Single Logout (SLO) without relying on the user's browser.
+See the specification [OpenID Connect Back-Channel Logout 1.0](https://openid.net/specs/openid-connect-backchannel-1_0.html).
+
+Current backchannel logout implementation, in this product, utilizes functionality introduced in plone.session >= 4.0.0 (Plone 6 and later) for server-side session invalidation (see plone.session PR [plone.session#26](https://github.com/plone/plone.session/pull/26)), and, at the moment, applies only to Plone Classic UI.
+
+To enable this functionality:
+
+1. Navigate to `.../acl_users/session/manage_secret` and enable the `Enable per-user keyring` option.
+
+2. Configure the OpenID Provider (e.g., Keycloak) to use the backchannel logout endpoint with the url: `.../acl_users/oidc/backchannel-logout`
+
 ## Technical Decisions
 
 ### Usage of sessions in the login process

{pas.plugins.oidc-2.0.0b2 → pas_plugins_oidc-2.0.0b4}/pyproject.toml

@@ -123,7 +123,7 @@ Zope = [
 ]
 python-dateutil = ['dateutil']
 ignore-packages = ['plone.restapi', 'plone.volto', 'zestreleaser.towncrier', 'zest.releaser', 'pytest', 'pytest-cov', 'pytest-plone', 'pytest-docker', 'pytest-vcr', 'pytest-mock', 'zope.pytestlayer', 'requests-mock', 'vcrpy']
-Plone = ['Products.CMFPlone', 'Products.CMFCore', 'Products.GenericSetup', 'Products.PluggableAuthService', 'Products.PlonePAS']
+Plone = ['Products.CMFPlone', 'Products.CMFCore', 'Products.GenericSetup', 'Products.PluggableAuthService', 'Products.PlonePAS', 'plone.keyring']
 
 ##
 # Add extra configuration options in .meta.toml:

{pas.plugins.oidc-2.0.0b2 → pas_plugins_oidc-2.0.0b4}/requirements.txt

@@ -1,2 +1,2 @@
 -c constraints.txt
--e ".[test]"
+-e .[test]

{pas.plugins.oidc-2.0.0b2 → pas_plugins_oidc-2.0.0b4}/setup.py

@@ -14,7 +14,7 @@ long_description = f"""
 
 setup(
     name="pas.plugins.oidc",
-    version="2.0.0b2",
+    version="2.0.0b4",
     description="OIDC support for Plone sites",
     long_description=long_description,
     long_description_content_type="text/markdown",
@@ -59,8 +59,9 @@ setup(
         "plone.app.registry",
         "plone.base",
         "plone.protect",
-        "plone.restapi>=8.34.0",
+        "plone.restapi>=9.10.0",
         "oic",
+        "requests",
         "z3c.form",
     ],
     extras_require={

{pas.plugins.oidc-2.0.0b2 → pas_plugins_oidc-2.0.0b4}/src/pas/plugins/oidc/browser/configure.zcml

@@ -37,4 +37,12 @@
       layer="pas.plugins.oidc.interfaces.IPasPluginsOidcLayer"
       />
 
+  <browser:page
+      name="backchannel-logout"
+      for="pas.plugins.oidc.plugins.IOIDCPlugin"
+      class=".view.BackChannelLogoutView"
+      permission="zope2.View"
+      layer="pas.plugins.oidc.interfaces.IPasPluginsOidcLayer"
+      />
+
 </configure>

{pas.plugins.oidc-2.0.0b2 → pas_plugins_oidc-2.0.0b4}/src/pas/plugins/oidc/browser/view.py

@@ -1,3 +1,4 @@
+from oic.oic.message import BackChannelLogoutRequest
 from oic.oic.message import EndSessionRequest
 from oic.oic.message import IdToken
 from pas.plugins.oidc import _
@@ -6,9 +7,11 @@ from pas.plugins.oidc import utils
 from pas.plugins.oidc.plugins import OAuth2ConnectionException
 from pas.plugins.oidc.session import Session
 from plone import api
+from plone.keyring.interfaces import IKeyManager
 from Products.Five.browser import BrowserView
 from urllib.parse import quote
 from zExceptions import Unauthorized
+from zope.component import getUtility
 
 
 class RequireLoginView(BrowserView):
@@ -143,3 +146,32 @@ class CallbackView(BrowserView):
             self.request.response.redirect(return_url)
         else:
             raise Unauthorized()
+
+
+class BackChannelLogoutView(BrowserView):
+    def __call__(self):
+        if not self.request.method == "POST" or not self.request.get("logout_token"):
+            raise Unauthorized()
+        logout_request = BackChannelLogoutRequest(
+            logout_token=self.request.get("logout_token")
+        )
+        client = self.context.get_oauth2_client()
+        if logout_request.verify(
+            aud=client.client_id, iss=client.issuer, keyjar=client.keyjar
+        ):
+            userid = logout_request.to_dict()["logout_token"]["sub"]
+            session = api.portal.get_tool("acl_users").session
+            if session.per_user_keyring:
+                secret_key = session._getSecretKey(userid)
+                manager = getUtility(IKeyManager)
+                if manager[secret_key]:
+                    manager.clear(ring=secret_key)
+                    manager.rotate(ring=secret_key)
+            else:
+                logger.error(
+                    "For the backchannel logout, the session PAS needs to be configured with 'per user keyring'."
+                )
+            return ""
+        else:
+            logger.error("invalid backchannel logout request")
+            raise Unauthorized()

{pas.plugins.oidc-2.0.0b2 → pas_plugins_oidc-2.0.0b4}/src/pas/plugins/oidc/controlpanel/classic.py

@@ -138,6 +138,14 @@ class OIDCControlPanelAdapter:
     def user_property_as_userid(self, value):
         self.settings.user_property_as_userid = value
 
+    @property
+    def identity_domain_name(self):
+        return self.settings.identity_domain_name
+
+    @identity_domain_name.setter
+    def identity_domain_name(self, value):
+        self.settings.identity_domain_name = value
+
 
 class OIDCSettingsForm(controlpanel.RegistryEditForm):
     schema = IOIDCSettings

{pas.plugins.oidc-2.0.0b2 → pas_plugins_oidc-2.0.0b4}/src/pas/plugins/oidc/interfaces.py

@@ -119,6 +119,13 @@ class IOIDCSettings(Interface):
         default="sub",
     )
 
+    identity_domain_name = schema.TextLine(
+        title=_("Identity Domain Name"),
+        description=_("Required for Oracle Authentication Manager only"),
+        required=False,
+        default="",
+    )
+
 
 class IOIDCControlpanel(IControlpanel):
     """OIDC Control panel"""

{pas.plugins.oidc-2.0.0b2 → pas_plugins_oidc-2.0.0b4}/src/pas/plugins/oidc/plugins.py

@@ -27,6 +27,7 @@ from zope.interface import Interface
 
 import itertools
 import plone.api as api
+import requests
 import string
 
 
@@ -69,6 +70,29 @@ class IOIDCPlugin(Interface):
     """ """
 
 
+class OAMClient(Client):
+    """Override so we can adjust the jwks_uri to add domain needed for OAM"""
+
+    def __init__(self, *args, domain=None, **xargs):
+        super().__init__(self, *args, **xargs)
+        self.domain = domain
+        if domain:
+            session = requests.Session()
+            session.headers.update({"x-oauth-identity-domain-name": domain})
+            self.settings.requests_session = session
+
+    def handle_provider_config(self, pcr, issuer, keys=True, endpoints=True):
+        domain = self.domain
+        if domain:
+            # we need to modify jwks_uri in the provider_info to add the identityDomain for OAM
+            # gets used in https://github.com/CZ-NIC/pyoidc/blob/0bd1eadcefc5ccb7ef6c69d9b631537a7d3cfe30/src/oic/oauth2/__init__.py#L1132
+            url = pcr["jwks_uri"]
+            req = requests.PreparedRequest()
+            req.prepare_url(url, dict(identityDomainName=domain))
+            pcr["jwks_uri"] = req.url
+        return super().handle_provider_config(pcr, issuer, keys, endpoints)
+
+
 @implementer(IOIDCPlugin)
 class OIDCPlugin(BasePlugin):
     """PAS Plugin OpenID Connect."""
@@ -92,6 +116,7 @@ class OIDCPlugin(BasePlugin):
     use_deprecated_redirect_uri_for_logout = False
     use_modified_openid_schema = False
     user_property_as_userid = "sub"
+    identity_domain_name = ""
 
     _properties = (
         dict(id="title", type="string", mode="w", label="Title"),
@@ -160,6 +185,12 @@ class OIDCPlugin(BasePlugin):
             mode="w",
             label="User info property used as userid, default 'sub'",
         ),
+        dict(
+            id="identity_domain_name",
+            type="string",
+            mode="w",
+            label="Identity Domain Name (required for Oracle Authentication Manager only)",
+        ),
     )
 
     def __init__(self, id, title=None):
@@ -331,8 +362,19 @@ class OIDCPlugin(BasePlugin):
 
     # TODO: memoize (?)
     def get_oauth2_client(self):
+        domain = self.getProperty("identity_domain_name")
         try:
-            client = Client(client_authn_method=CLIENT_AUTHN_METHOD)
+            if domain:
+                client = OAMClient(
+                    client_authn_method=CLIENT_AUTHN_METHOD,
+                    domain=domain,
+                )
+            else:
+                client = Client(client_authn_method=CLIENT_AUTHN_METHOD)
+            client.allow["issuer_mismatch"] = (
+                True  # Some providers aren't configured with configured and issuer urls the same even though they should.
+            )
+
             # registration_response = client.register(provider_info["registration_endpoint"], redirect_uris=...)
             # ... oic.exception.RegistrationError: {'error': 'insufficient_scope',
             #     'error_description': "Policy 'Trusted Hosts' rejected request to client-registration service. Details: Host not trusted."}

pas_plugins_oidc-2.0.0b4/src/pas/plugins/oidc/services/login/configure.zcml

@@ -0,0 +1,11 @@
+<configure
+    xmlns="http://namespaces.zope.org/zope"
+    xmlns:plone="http://namespaces.plone.org/plone"
+    >
+
+  <!-- Login options -->
+  <adapter
+      factory=".get.OIDCLoginProviders"
+      name="pas-plugins-oidc-providers"
+      />
+</configure>

pas_plugins_oidc-2.0.0b4/src/pas/plugins/oidc/services/login/get.py

@@ -0,0 +1,29 @@
+from pas.plugins.oidc.plugins import OIDCPlugin
+from plone import api
+from plone.base.interfaces import IPloneSiteRoot
+from plone.restapi.interfaces import ILoginProviders
+from zope.component import adapter
+from zope.interface import implementer
+
+
+@adapter(IPloneSiteRoot)
+@implementer(ILoginProviders)
+class OIDCLoginProviders:
+    def __init__(self, context):
+        self.context = context
+
+    def get_providers(self):
+        options = []
+        acl_users = api.portal.get_tool("acl_users")
+        for plugin in acl_users.objectValues():
+            if isinstance(plugin, OIDCPlugin):
+                options.append(
+                    {
+                        "id": plugin.getId(),
+                        "plugin": "oidc",
+                        "title": plugin.title,
+                        "url": f"{self.context.absolute_url()}/@login-oidc/{plugin.getId()}",
+                    }
+                )
+
+        return options

{pas.plugins.oidc-2.0.0b2 → pas_plugins_oidc-2.0.0b4}/src/pas/plugins/oidc/utils.py

@@ -127,6 +127,8 @@ def authorization_flow_args(plugin: plugins.OIDCPlugin, session: Session) -> dic
         "nonce": session.get("nonce"),
         "redirect_uri": plugin.get_redirect_uris(),
     }
+    if plugin.getProperty("identity_domain_name"):
+        args["domain"] = plugin.getProperty("identity_domain_name", "")
     if plugin.getProperty("use_pkce"):
         # Build a random string of 43 to 128 characters
         # and send it in the request as a base64-encoded urlsafe string of the sha256 hash of that string

{pas.plugins.oidc-2.0.0b2 → pas_plugins_oidc-2.0.0b4}/src/pas.plugins.oidc.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.2
 Name: pas.plugins.oidc
-Version: 2.0.0b2
+Version: 2.0.0b4
 Summary: OIDC support for Plone sites
 Home-page: https://github.com/collective/pas.plugins.oidc
 Author: mamico
@@ -34,8 +34,9 @@ Requires-Dist: plone.api
 Requires-Dist: plone.app.registry
 Requires-Dist: plone.base
 Requires-Dist: plone.protect
-Requires-Dist: plone.restapi>=8.34.0
+Requires-Dist: plone.restapi>=9.10.0
 Requires-Dist: oic
+Requires-Dist: requests
 Requires-Dist: z3c.form
 Provides-Extra: test
 Requires-Dist: zope.pytestlayer; extra == "test"
@@ -52,6 +53,19 @@ Requires-Dist: zest.releaser[recommended]; extra == "test"
 Requires-Dist: zestreleaser.towncrier; extra == "test"
 Requires-Dist: pytest-mock; extra == "test"
 Requires-Dist: requests-mock; extra == "test"
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: keywords
+Dynamic: license
+Dynamic: project-url
+Dynamic: provides-extra
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
 
 
 <div align="center"><img alt="pas.plugins.oidc logo" src="https://raw.githubusercontent.com/collective/pas.plugins.oidc/main/docs/icon.png" width="70" /></div>
@@ -269,6 +283,19 @@ Currently, the Plone logout form is unchanged.
 Instead, for testing go to the logout page of the plugin: http://localhost:8080/Plone/acl_users/oidc/logout,
 this will take you to Keycloak to logout, and then return to the post-logout redirect URL.
 
+#### Backchannel SLO (experimental)
+
+OIDC Backchannel Logout is a server-to-server mechanism where the IdP notifies RPs via an HTTP POST request to terminate user sessions upon logout, ensuring secure and seamless Single Logout (SLO) without relying on the user's browser.
+See the specification [OpenID Connect Back-Channel Logout 1.0](https://openid.net/specs/openid-connect-backchannel-1_0.html).
+
+Current backchannel logout implementation, in this product, utilizes functionality introduced in plone.session >= 4.0.0 (Plone 6 and later) for server-side session invalidation (see plone.session PR [plone.session#26](https://github.com/plone/plone.session/pull/26)), and, at the moment, applies only to Plone Classic UI.
+
+To enable this functionality:
+
+1. Navigate to `.../acl_users/session/manage_secret` and enable the `Enable per-user keyring` option.
+
+2. Configure the OpenID Provider (e.g., Keycloak) to use the backchannel logout endpoint with the url: `.../acl_users/oidc/backchannel-logout`
+
 ## Technical Decisions
 
 ### Usage of sessions in the login process
@@ -410,6 +437,27 @@ The project is licensed under the GPLv2.
 
 <!-- towncrier release notes start -->
 
+## 2.0.0b4 (2025-02-28)
+
+
+### New features:
+
+- Add backchannel logout implementation for classic ui session @mamico [#67](https://github.com/collective/pas.plugins.oidc/issues/67)
+
+## 2.0.0b3 (2025-02-03)
+
+
+### New features:
+
+- Register the adapter as needed by the @login endpoint present in plone.restapi @erral [#47](https://github.com/collective/pas.plugins.oidc/issues/47)
+- Changes to make compatible with OAM (Oracle Access Manager) @djay [#65](https://github.com/collective/pas.plugins.oidc/pull/64)
+
+
+### Internal:
+
+- Bump plone.restapi to 9.10.0 [@ericof]
+
+
 ## 2.0.0b2 (2024-12-09)
 
 

{pas.plugins.oidc-2.0.0b2 → pas_plugins_oidc-2.0.0b4}/src/pas.plugins.oidc.egg-info/SOURCES.txt

@@ -45,11 +45,8 @@ src/pas/plugins/oidc/controlpanel/serializer.py
 src/pas/plugins/oidc/locales/__init__.py
 src/pas/plugins/oidc/locales/pas.plugins.oidc.pot
 src/pas/plugins/oidc/locales/update.py
-src/pas/plugins/oidc/locales/de/LC_MESSAGES/pas.plugins.oidc.mo
 src/pas/plugins/oidc/locales/de/LC_MESSAGES/pas.plugins.oidc.po
-src/pas/plugins/oidc/locales/en/LC_MESSAGES/pas.plugins.oidc.mo
 src/pas/plugins/oidc/locales/en/LC_MESSAGES/pas.plugins.oidc.po
-src/pas/plugins/oidc/locales/es/LC_MESSAGES/pas.plugins.oidc.mo
 src/pas/plugins/oidc/locales/es/LC_MESSAGES/pas.plugins.oidc.po
 src/pas/plugins/oidc/profiles/default/browserlayer.xml
 src/pas/plugins/oidc/profiles/default/controlpanel.xml

{pas.plugins.oidc-2.0.0b2 → pas_plugins_oidc-2.0.0b4}/src/pas.plugins.oidc.egg-info/requires.txt

@@ -6,8 +6,9 @@ plone.api
 plone.app.registry
 plone.base
 plone.protect
-plone.restapi>=8.34.0
+plone.restapi>=9.10.0
 oic
+requests
 z3c.form
 
 [test]

{pas.plugins.oidc-2.0.0b2 → pas_plugins_oidc-2.0.0b4}/tests/services/conftest.py

@@ -23,6 +23,7 @@ def keycloak(keycloak_service):
         "scope": ("openid", "profile", "email"),
         "redirect_uris": ("/login_oidc/oidc",),
         "create_restapi_ticket": True,
+        "identity_domain_name": "blah",  # ensure non OAM SP ignores extra params/header
     }
 
 

pas.plugins.oidc-2.0.0b2/src/pas/plugins/oidc/services/login/configure.zcml

@@ -1,15 +0,0 @@
-<configure
-    xmlns="http://namespaces.zope.org/zope"
-    xmlns:plone="http://namespaces.plone.org/plone"
-    >
-
-  <!-- Login options -->
-  <plone:service
-      method="GET"
-      factory=".get.Get"
-      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
-      permission="zope.Public"
-      name="@login"
-      />
-
-</configure>

pas.plugins.oidc-2.0.0b2/src/pas/plugins/oidc/services/login/get.py

@@ -1,42 +0,0 @@
-from pas.plugins.oidc import utils
-from pas.plugins.oidc.plugins import OIDCPlugin
-from plone import api
-from plone.restapi.services import Service
-from typing import Dict
-from typing import List
-
-
-class Get(Service):
-    """List available login options for the site."""
-
-    def check_permission(self):
-        return True
-
-    @staticmethod
-    def list_login_providers() -> List[Dict]:
-        """List all configured login providers.
-
-        This should be moved to plone.restapi and be extendable.
-        :returns: List of login options.
-        """
-        portal_url = api.portal.get().absolute_url()
-        plugins = []
-        for plugin in utils.get_plugins():
-            if isinstance(plugin, OIDCPlugin):
-                plugins.append(
-                    {
-                        "id": plugin.getId(),
-                        "plugin": "oidc",
-                        "url": f"{portal_url}/@login-oidc/{plugin.getId()}",
-                        "title": plugin.title,
-                    }
-                )
-        return plugins
-
-    def reply(self) -> Dict[str, List[Dict]]:
-        """List login options available for the site.
-
-        :returns: Login options information.
-        """
-        providers = self.list_login_providers()
-        return {"options": providers}