Sign in with NobleID on Open Journal Systems (OJS)

Register on NobleID

1. In Dashboard → OAuth apps, register a confidential app. You need two-step login on your NobleID to do this.
2. Add this redirect URI, with your own host:
   https://sso.example.org/realms/<realm>/broker/nobleid/endpoint
   This is Keycloak's redirect URI (route 1). For route 2, register the URL the OJS plugin shows instead.
3. Tick these scopes: OpenID (always on), Profile profile, Email email. The platform asks for these, and sign-in stops if it asks for a scope the app does not have.
4. Copy the client ID and the client secret. The secret is shown once.

The app works at once. Until NobleID verifies it, people see a “not verified” notice on the consent screen.

The released plugin cannot check NobleID's sign-in tokens

The plugin accepts a custom provider by discovery URL. But every released version reads only RSA keys and checks ID tokens as RS256. NobleID signs ID tokens with ES256 only, so the plugin finds no usable key and every sign-in fails with its certificate error. The released plugin also sends no state, nonce or PKCE.

Use one of two routes:

1. Through Keycloak. This works today. See route 1 below.
2. Directly, once a PKP release includes the plugin's newer code. See route 2.

Route 1: Keycloak between OJS and NobleID

Keycloak checks NobleID's ES256 tokens and issues its own RS256 tokens to OJS, which the plugin accepts.

1. Set up NobleID as an identity provider in Keycloak by following the Keycloak guide. Use the alias nobleid.
2. In the same realm, create a client for OJS: Clients → Create client, type OpenID Connect, client ID ojs. Turn Client authentication and Standard flow on, everything else off. Under Valid redirect URIs, enter the redirect URL the OJS plugin settings page shows (step 4). Under Valid post logout redirect URIs, enter the journal's home page, for example https://journal.example.org/index.php/<journal>/index: the plugin sends people there through Keycloak when they sign out. Copy the client secret from the Credentials tab.
3. Send people straight to NobleID instead of Keycloak's login form: Authentication → browser → Identity Provider Redirector → Default Identity Provider = nobleid. If the realm serves other applications, duplicate the browser flow, set the redirector in the copy, and select the copy under the OJS client's Advanced → Authentication flow overrides → Browser Flow.
4. In OJS, open Settings → Website → Plugins → Installed Plugins → Generic Plugins → OpenID Authentication Plugin → Settings. Tick Custom OpenID Provider and fill in the fields below. Copy the redirect URL shown next to the custom provider into the Keycloak client (step 2).
5. Keep Enable legacy login (OJS passwords) ticked until at least one administrator account is linked and tested.

The redirect URL usually looks like https://journal.example.org/index.php/<journal>/openid/doAuthentication?provider=custom, with the journal's path. If the plugin is enabled for the whole site, the path is index instead.

OJS receives given_name, family_name and email as Keycloak passes them on. OJS links its accounts to Keycloak's sub, and Keycloak links that to NobleID's sub. Neither link changes if the person changes their email.

Signing out ends the Keycloak session. Whether it also ends the NobleID session depends on Keycloak's Logout URL; see the Keycloak guide.

Route 2: connect directly (not yet released)

The plugin's main branch reads EC keys, checks iss, aud and nonce, and sends state, nonce and PKCE S256. On 2 November 2026 that code was in no release and on no stable branch, and we have not run it against NobleID. When a release contains it, register the redirect URL the settings page shows and fill in:

• The redirect URL usually looks like https://journal.example.org/index.php/<journal>/openid/doAuthentication?provider=custom. The ?provider=custom part belongs to it. Register it too.
• The plugin reads the endpoints from discovery, including the authorization endpoint on www.nobleid.org and the end-session endpoint.
• It asks for openid profile email and sends the client secret in the request body (client_secret_post), which NobleID accepts.
• On sign-out it sends the person to NobleID, which asks them to confirm and returns them to the journal's home page. Add that page (for example https://journal.example.org/index.php/<journal>/index) to the app's sign-out return URLs in the NobleID dashboard.

Fill the profile from NobleID

Route 1 passes these three on when OJS creates the account. The person fills the rest of their OJS profile.

For an ORCID iD in OJS, use PKP's ORCID plugin. It checks the iD with ORCID itself.

Every claim, and how to fill a profile without overwriting what people edit: Fill your app's profile from NobleID.

Before you go live

• Sign in once with your own NobleID. People need a first and last name on their NobleID profile to sign in; NobleID asks for it if it is missing.
• Key accounts on sub. Link to an existing account by email only when email_verified is true.
• Remove any localhost redirect URIs from the app.
• Keep the client secret out of version control.

NobleID values