Sign in with NobleID on Moodle

Register on NobleID

1. In Dashboard → OAuth apps, register a confidential app. You need two-step login on your NobleID to do this.
2. Add this redirect URI, with your own host:
   https://moodle.example.org/admin/oauth2callback.php
   Your $CFG->wwwroot followed by /admin/oauth2callback.php. Tick ORCID iD too if you will map it.
3. Tick these scopes: OpenID (always on), Profile profile, Email email. The platform asks for these, and sign-in stops if it asks for a scope the app does not have.
4. Copy the client ID and the client secret. The secret is shown once.

The app works at once. Until NobleID verifies it, people see a “not verified” notice on the consent screen.

How Moodle's OAuth 2 login behaves

• It reads NobleID's discovery document from the Service base URL and creates the endpoints itself.
• It reads the person from the userinfo endpoint and does not use the ID token, so ES256 needs no setting.
• It sends state. It sends no PKCE or nonce, and has no PKCE option.
• It needs a username and an email from userinfo. A person who unticks email cannot sign in.
• It cannot read email_verified. Its own Require email verification option is the safeguard: keep it on.
• Signing out is local.

1. Create the service

Site administration → Server → OAuth 2 services → Create new service: Custom.

Save. The services list should show discovery as successful.

2. Check the endpoints

Click Configure endpoints for the service. Discovery should have created at least:

3. Map the account to sub

Click Configure user field mappings. Discovery creates mappings for given_name, family_name, email and picture, and a few claims NobleID does not send. Add one more:

Without it, Moodle links the NobleID login to the email address, and a person who changes their NobleID email loses the link. With it, the link uses sub, which never changes.

Optional: add orcid to the login scopes and map orcid to a custom profile field.

4. Turn on the plugin

Site administration → Plugins → Authentication → Manage authentication → enable OAuth 2. The Sign in with NobleID button then appears on the login page.

With Require email verification on, Moodle emails a confirmation link before it connects a NobleID login to an existing account with the same email, and new accounts confirm their email before first use. Keep it on: Moodle cannot see whether NobleID confirmed the address.

Fill the profile from NobleID

Discovery creates the first four mappings (step 3).

For the ORCID iD: create a text custom profile field, add orcid to the service's login scopes, tick ORCID iD on your app, and map orcid to the field.

Every claim, and how to fill a profile without overwriting what people edit: Fill your app's profile from NobleID.

Before you go live

• Sign in once with your own NobleID. People need a first and last name on their NobleID profile to sign in; NobleID asks for it if it is missing.
• Key accounts on sub. Link to an existing account by email only when email_verified is true.
• Remove any localhost redirect URIs from the app.
• Keep the client secret out of version control.

NobleID values