From what I heard from @abompard it should be able to link the openid accounts to OIDC ones.

But I leave this for @abompard to answer.

Hey! In python-social-auth, there is a setting called SOCIAL_AUTH_PIPELINE where you can list functions that will be run during the authentication process. The social_core.pipeline.social_auth.associate_by_email function is disabled by default, but if you enable it it will match by email address logging-in users with existing users. As a result, new users using OIDC will get their existing account, if you have enabled this function in your pipeline.

I think one of the issue is that translate is a hosted service.

I met with @jibecfed this weekend who pointed me to @darknao for technical matters wrt weblate hosted instance.

Hi @nijel @abompard : I don't know who have to take action to make this migration move forward, or the timeline to do so, is one of you waiting for someone (me included) to do something?

Hi! If the hosted weblate sysadmins are ready to enable the OIDC auth, Fedora can generate a client_id and a client_secret for them. Just tell me how I should send you the secret. GPG-encrypted email is fine, a file on a fedora user's homedir on fedorapeople.org also works.
I will also need the callback URL, probably something like https://translate.fedoraproject.org/accounts/complete/fedora-oidc/.

I suggest adding a second authentication method with OIDC before replacing the old OpenID one, in case something goes bad. Unless you have a staging instance of course!

sysadmin is done by Weblate's team, providing these secrets is to be done with @nijel
we do have a staging URL, but I think it is redirecting to production URL https://translate.stg.fedoraproject.org

weblate doc regarding oidc is here: https://python-social-auth.readthedocs.io/en/latest/backends/oidc.html
it looks like to match client_id / client_scret

I understand from @nijel first message: identify what migration is to be done for users accounts that connected with OpenID to be migrated as OIDC

I'll be happy to help testing if useful

I understand from @nijel first message: identify what migration is to be done for users accounts that connected with OpenID to be migrated as OIDC

Oh good point, I forgot about that. Yeah it's likely that a migration will be necessary, but I'm not sure how it looks like currently in weblate's db. I suppose the identifier with OpenID is going to be http://<username>.id.fedoraproject.org. I'm not exactly certain what it should look like on OIDC, but probably something related to the sub value that the identity provider returns.
I'll run a local instance and see if I can prototype something.

Alright, after some testing, the users will automatically be migrated from OpenID to OIDC provided the following settings are set:

SOCIAL_AUTH_FEDORA_OIDC_KEY = "the-client_id-that-we-will-give-you"
SOCIAL_AUTH_FEDORA_OIDC_SECRET = "the-client_secret-that-we-will-give-you"
SOCIAL_AUTH_FEDORA_OIDC_TOKEN_ENDPOINT_AUTH_METHOD = "client_secret_post"
AUTHENTICATION_BACKENDS: tuple[str, ...] = (    
    [...]
    "social_core.backends.fedora.FedoraOpenId",
    "social_core.backends.fedora.FedoraOpenIdConnect",
    [...]
)
SOCIAL_AUTH_PIPELINE = (
    [...]
    "social_core.pipeline.social_auth.associate_by_email",
    [...]
)
REGISTRATION_REBIND = True  # needed for associate_by_email to work

Does this look reasonable? Do you think it can be set on the Fedora instance?

Yes, that setting should work. I'll send you a link to share the credentials with me.

Weblate is now configured for both authentication methods; using OIDC should automatically link with existing accounts.

If there won't be any issues in the upcoming weeks, we will disable OpenID and keep OIDC only.

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/infra/tickets/issues/12479

Please continue any further discussion there.