OIDC Authentication Support

[mairas]

⚠️ Development Workflow

MANDATORY: All implementations MUST follow the DEVELOPMENT_WORKFLOW.md.

Each phase issue includes a detailed implementation checklist that must be completed.

---

Summary

Add OpenID Connect (OIDC) authentication to Signal K server, following Homarr's pattern:

• Default: Local credentials (existing behavior unchanged)
• Optional: OIDC can be enabled via configuration
• User provisioning: Auto-create users on first OIDC login
• Permissions: Map OIDC groups/claims to Signal K permission levels (admin/readwrite/readonly)

Motivation

OIDC support enables:

• Single Sign-On (SSO) with enterprise identity providers (Keycloak, Authentik, etc.)
• Centralized user management
• Integration with existing authentication infrastructure
• Reduced password fatigue for users

Architecture

Extend existing tokensecurity.js rather than creating a new security strategy:

• Maintains backward compatibility
• Allows mixing local and OIDC users
• Reuses existing JWT session mechanism after OIDC login

Configuration

Environment variables (following Homarr's naming pattern):

AUTH_OIDC_ENABLED=true
AUTH_OIDC_ISSUER=https://auth.example.com
AUTH_OIDC_CLIENT_ID=signalk-server
AUTH_OIDC_CLIENT_SECRET=your-secret
AUTH_OIDC_CLIENT_NAME="SSO Login"
AUTH_OIDC_ADMIN_GROUPS="admins,sk-admin"
AUTH_OIDC_READWRITE_GROUPS="users"
AUTH_OIDC_DEFAULT_PERMISSION="readonly"

Implementation Phases

• Phase 1: Core OIDC Backend #2 - Phase 1: Core OIDC Backend
• Phase 2: Permission Mapping #3 - Phase 2: Permission Mapping
• Phase 3: Frontend Integration #4 - Phase 3: Frontend Integration
• Phase 4: Admin UI Configuration #5 - Phase 4: Admin UI Configuration
• Phase 5: Testing & Documentation #6 - Phase 5: Testing & Documentation

Related Work

• Based on Homarr's OIDC implementation pattern
• Uses openid-client npm package for OIDC handling

🤖 Generated with Claude Code