feat: add oidc for users

docs/install/configuration.md

@@ -41,6 +41,28 @@ To be able to send email from your reMarkable, fill the following variables:
 | `RM_SMTP_STARTTLS` | use starttls command, should be combined with NOTLS. in most cases port 587 should be used |
 | `RM_SMTP_INSECURE_TLS` | If set, don't check the server certificate (not recommended) |
 
+## OIDC authentication
+
+To use OpenID Connect for login, fill the following variables. `RM_HTTPS_COOKIE=true` is also required.
+
+| Variable name | Description |
+|---|---|
+| `OIDC_PROVIDER_URL` | Provider discovery URL (the base URL, not `/.well-known/openid-configuration`). Example: `https://sso.example.com` |
+| `OIDC_CLIENT_ID` | OAuth2 client ID |
+| `OIDC_CLIENT_SECRET` | OAuth2 client secret |
+| `OIDC_REDIRECT_URL` | Callback URL, must end with `/ui/api/oidc/callback`. Example: `https://your-domain.com/ui/api/oidc/callback` |
+| `OIDC_USERID_CLAIM` | Optional: OIDC claim to use as the user ID (default: `preferred_username`). Supports `preferred_username`, `sub`, `email`, other string claims, and dotted paths such as `custom.userid`. If the configured claim is empty, login falls back to `email`. Whenever the actual identifier is `email`, email verification is enforced unless `OIDC_ALLOW_UNVERIFIED_EMAIL=true`. |
+| `OIDC_DISABLE_LOCAL_LOGIN` | Optional: set to `true` to hide the password form, disable the registration endpoint, and auto-redirect `/login` to OIDC. This requires OIDC for all users (default: `false`). When enabled, users visit the login page and are immediately redirected to your OIDC provider. |
+| `OIDC_ADMIN_CLAIM` | Optional: dotted path to the claim that holds admin role values (e.g. `groups`). If unset, no OIDC user is granted admin. The claim is read from the ID token — see `OIDC_EXTRA_SCOPES` if your provider requires a scope to include it. |
+| `OIDC_ADMIN_CLAIM_VALUE` | Optional: value in that claim that grants admin (e.g. `admin`). Re-evaluated on every login. If unset, no OIDC user is granted admin. |
+| `OIDC_EXTRA_SCOPES` | Optional: space-separated extra OAuth2 scopes. `openid`, `email`, and `profile` are always requested (default: none). Use this if your provider requires a scope to include role claims in the ID token (e.g. `groups` for Okta). |
+| `OIDC_DISPLAY_NAME` | Optional: custom label for the OIDC login button (default: `Login with OIDC`) |
+| `OIDC_ALLOW_UNVERIFIED_EMAIL` | Optional: set to `true` to allow login when the provider's `email_verified` claim is missing or `false`. Leave unset for the secure default — logins with an unverified email are rejected to prevent account takeover via an unverified address. Applies whenever the actual user ID is `email`, including fallback from another claim (default: `false`). |
+
+### Provider examples
+
+- [Authelia](oidc/authelia.md)
+
 ## Screen sharing
 
 Screen sharing streams your tablet display to a browser via WebRTC. There are two signaling modes depending on your tablet's software version.

docs/install/oidc/authelia.md

@@ -0,0 +1,76 @@
+# OIDC with Authelia
+
+This guide shows how to configure [Authelia](https://www.authelia.com/) as the identity provider for rmfakecloud.
+
+See the [OIDC configuration reference](../configuration.md#oidc-authentication) for the full list of available environment variables.
+
+## Authelia client configuration
+
+Add a client entry to the `identity_providers.oidc.clients` section of your Authelia configuration. Generate a hashed secret with:
+
+```bash
+authelia crypto hash generate argon2 --random --random.length 64 --random.charset alphanumeric
+```
+
+This prints a plaintext secret and its hash. Use the hash in Authelia's config and the plaintext value in `OIDC_CLIENT_SECRET`.
+
+Authelia 4.38+ does not include the `groups` claim in the ID token by default, even when the `groups` scope is requested. You must define a `claims_policy` that explicitly lists `groups` in `id_token`, and reference it from the client. Add the following to the `identity_providers.oidc` section of your Authelia configuration (not inside `clients:`):
+
+```yaml
+identity_providers:
+  oidc:
+    claims_policies:
+      with_groups:
+        id_token:
+          - email
+          - email_verified
+          - groups
+          - preferred_username
+          - name
+```
+
+Then add the client entry to `identity_providers.oidc.clients`:
+
+```yaml
+identity_providers:
+  oidc:
+    clients:
+      - client_id: 'rmfakecloud'
+        client_name: 'rmfakecloud'
+        client_secret: '$argon2id$v=19$...'  # hashed secret from above
+        public: false
+        authorization_policy: 'one_factor'  # or 'two_factor' for stricter security
+        consent_mode: implicit
+        claims_policy: 'with_groups'
+        redirect_uris:
+          - 'https://your-domain.com/ui/api/oidc/callback'
+        scopes:
+          - 'openid'
+          - 'email'
+          - 'profile'
+          - 'groups'
+        userinfo_signed_response_alg: 'none'
+        token_endpoint_auth_method: 'client_secret_basic'
+```
+
+The `claims_policy: 'with_groups'` is what causes the `groups` claim to appear in the ID token that rmfakecloud reads. Without it, the groups claim is only available at the userinfo endpoint and `OIDC_ADMIN_CLAIM=groups` will not work.
+
+## Admin group
+
+Create a group named `rmfakecloud-admins` in your Authelia user database and add the users who should have admin access.
+
+## rmfakecloud environment variables
+
+```env
+OIDC_PROVIDER_URL=https://auth.example.com
+OIDC_CLIENT_ID=rmfakecloud
+OIDC_CLIENT_SECRET=<plaintext secret from above>
+OIDC_REDIRECT_URL=https://your-domain.com/ui/api/oidc/callback
+RM_HTTPS_COOKIE=true  # required: OIDC flow cookies carry the Secure flag
+OIDC_ADMIN_CLAIM=groups
+OIDC_ADMIN_CLAIM_VALUE=rmfakecloud-admins
+OIDC_EXTRA_SCOPES=groups
+OIDC_DISPLAY_NAME=Login with Authelia
+```
+
+Replace `auth.example.com` with your Authelia hostname and `your-domain.com` with the hostname of your rmfakecloud instance.

go.mod

@@ -1,11 +1,10 @@
 module github.com/ddvk/rmfakecloud
 
-go 1.23.3
-
-toolchain go1.24.1
+go 1.25.0
 
 require (
 	github.com/apognu/gocal v0.9.1
+	github.com/coreos/go-oidc/v3 v3.19.0
 	github.com/danjacques/gofslock v0.0.0-20240212154529-d899e02bfe22
 	github.com/dropbox/dropbox-sdk-go-unofficial/v6 v6.0.5
 	github.com/gin-gonic/gin v1.9.1
@@ -22,6 +21,7 @@ require (
 	github.com/studio-b12/gowebdav v0.9.0
 	github.com/unidoc/unipdf/v3 v3.56.0
 	golang.org/x/crypto v0.36.0
+	golang.org/x/oauth2 v0.36.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -36,11 +36,11 @@ require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
 	github.com/gin-contrib/sse v0.1.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.19.0 // indirect
 	github.com/goccy/go-json v0.10.2 // indirect
-	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/gorilla/i18n v0.0.0-20150820051429-8b358169da46 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
@@ -65,11 +65,9 @@ require (
 	golang.org/x/arch v0.7.0 // indirect
 	golang.org/x/image v0.18.0 // indirect
 	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/oauth2 v0.18.0 // indirect
 	golang.org/x/sys v0.31.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
-	google.golang.org/appengine v1.6.8 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f // indirect
 )