Repository metrics
- Stars
- (1,660 stars)
- PR merge metrics
- (PR metrics pending)
Description
🚀 Feature
OpenID Connect is a well known protocol to authenticate users across multiple applications. It is the basis for a lot of self-hosted / self-deployed solutions. The typical deployment has the administrator deploy an authentication server (typically using keycloak server) that is responsible for keeping track of users.
Keycloak handles the authentication part of the process, presenting users with a login form when thy try to access an app, authenticating them, then redirecting them to the app they wanted to access. If you've been in any moderately big company, you've certainly met some variance of this.
Design, Layout, Architecture
I suggest to create a "module" that would propose au new "auth_type", oidc_auth. Ideally, it would not disable the normal auth flow, but it might be technically impractical to do so.
Here's a proposed "flow":
When the module is active, a user is presented with the choice to authenticate with oidc. They might also be directly redirected, especially if it is the only way to authenticate.
When clicking the button, they are redirected to the oidc provider's portal (in this case, a very garish, custom keycloak landing page, we are very proud of it, it also makes noise when you type :3)
The users continue with the authentication flow on their side, and finally...
They get added to a db, or at least the webmail !
Depending on the implementation, of course. But ideally we should have ability to set some users as admin, maybe trough roles in keycloak, and the ability to save per-user preferences within cypht.
Additional notes
Upon asking on the gitter @marclaporte told me it has been done before-ish. It seems the tiki CMS rolled out its own way of doing it with cypht, and it might be used as a starting point.
There is also the option of using the lesser-implemented SAML authentication, but this issue focuses on OIDC.