monicahq/monica

Support logging in with an OAuth2 provider

Open

#1154 opened on Apr 12, 2018

View on GitHub
 (14 comments) (27 reactions) (0 assignees)PHP (24,641 stars) (2,464 forks)batch import
feature requesthelp wantedsecurity

Description

A rephrasing of the now-closed #558. And a reincarnation of #39.

As a user, I would like to be able to log in with a 3rd-party identity provider and not have to maintain yet another username and password credential pair.

This is probably only going to be useful for self-hosted installations -- they can decide who they trust. For the publicly hosted version, I don't know of many OAuth2 providers that has broad community trust. (Mozilla's Firefox Accounts maybe? I don't even know if 3rd parties can use it. Gitlab and/or Github as well?)

If support is implemented in a generic fashion, then users can spin up their own OAuth2 providers (RedHat's KeyCloak, a self-hosted Gitlab instance, there are many other projects.) and trust those.

Contributor guide

Tech stack
phplaravel
Domain
authenticationbackend
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
over 1 week
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
Basic understanding of OAuth2Familiarity with Laravel authenticationKnowledge of PHP and LaravelExperience with socialite packages
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30
Research direction
Investigate previous discussions in linked issues #558 and #39. Review the Laravel authentication system, particularly the use of Laravel Socialite for OAuth2. Look at the current login flow in routes and controllers. Consider which providers to support initially (e.g., GitHub, GitLab). Create a proposal outlining the architecture and required changes.