Philip Durbin 🚀 (Aug 03 2026 at 20:38): Philip Durbin 🚀 (Aug 03 2026 at 20:38):We use CILogon at https://demo.dataverse.org/modern/ and I suspect that OIDC is used:
Can you tell? :sweat_smile:
Philip Durbin 🚀 (Aug 03 2026 at 20:40):When I try to log in, I see this in the path: /realms/demo/broker/oidc/endpoint
Leo Andreev (Aug 03 2026 at 20:59):Good question... Yes, you are authenticating with CILogon when using your institutional account at https://demo.dataverse.org/modern/ However, the phrasing of the original question was "has directly used CILogon's OIDC endpoint". The Dataverse instance on demo is NOT using CILogon directly, as an oidc authentication provider. The only oidc configured on the Dataverse level is a keycloak instance; which handles the local accounts, and bounces institutional logins to CILogon.
<jvm-options>-Ddataverse.auth.oidc.auth-server-url=https://beta-keycloak.dataverse.org/realms/demo</jvm-options>
(i.e., the path /realms/demo/broker/oidc/endpoint is part of the configured keycloak realm).
... Long story short, I am not sure if this is a use case that the OP is asking about (?).
My guess is that @Ellen K is the authoritative source on all things CILogon at the moment.
maría a. matienzo (Aug 03 2026 at 21:57):thanks both! this is related to the #community > Authenticating Non-Affiliated Users thread. i'm interested to see if CILogon can help satisfy this usecase for us. (we're currently authenticating our affiliated users using Shibboleth.)
Philip Durbin 🚀 (Aug 03 2026 at 21:58):@maría a. matienzo it should work but I've never tried it.
Leo Andreev (Aug 03 2026 at 23:38):We also use Shibboleth, both on demo.dataverse.org and our prod. server, in the "classic", JSF Dataverse UI.
The complicated keycloak setup is only there for the sake of the new-and-experimental SPA UI (/modern).
I very much second what @Philip Durbin 🚀 said above: it may just work for you; if you register your Dataverse with https://cilogon.org/oauth2/register, and then plug the resulting url/client id and secret into your OIDC configuration.
... But I would not really count on it either. I am not an expert on this part of the application, but I do understand that it is complicated and things can go wrong there. If I remember correctly, under the new /modern UI CILogon is working for already existing Shibboleth accounts; but I don't think you can create a new Dataverse account from a successful CILogon login. ... Again, @Ellen K may be able to clarify this further.
Philip Durbin 🚀 (Aug 04 2026 at 00:13):@maría a. matienzo what you might find is that your researchers at Berkeley will be able to create a second account by mistake. But you could always merge them.
Last updated: Aug 18 2026 at 08:27 UTC