Support for OpenID Connect, LDAP, etc.

[TheDoDoo]

It would be very helpful if the panel supported common authentication standards such as OpenID Connect, LDAP, OAuth2, or SAML.

[rmartinoscar]

Hey to my knowledge we don't plan on allowing user creation from third party, also we already have OAuth2 with Socialite

[t-lessy]

Ain't there only Authentik? It would be easier to configure OIDC with provider.tld/.well-known/openid-configuration. To be more precise, I use Casdoor, which provides this autoconfigure path. As I know, there only base domain prompt in authentication settings, which automatically redirects as Authentik should do, sed not as my OIDC provider.

O' course, it's my situation and use scenario, but for long-time feature list it would be awesome to be.

[dougmaitelli]

Yeah, I honestly don't understand why Authentik is a "hardcoded" option. It should just be OIDC and then you can integrate with Authentik and any other as well. The logic and auth flow is exactly the same, just let the user specify the discovery url, name, client id and client secret.

[meman0303]

Can Keycloak be added as an option?

[dougmaitelli]

Can Keycloak be added as an option?

To be fair, you can use keycloak, if you use the plugin for Generic OIDC.
It just is (to me) a very weird decision to keep generic OIDC as a plugin if so many other Oauth providers are bundled in the release while generic OIDC literally uses the same library and would need no extra dependencies.

[meman0303]

I did not know there was a plugin for it thankyou

[T4tze]

I would love that as well👍

[CrazyIsMyLive]

This is a very interesting idea that could greatly simplify life for many Pelikan hosts by enabling centralized control.

[Seba244c]

I would love this. Everything else is centralized for us, having to manage accounts separately is a pain for me.

[xDev789]

+1. We use Keycloak and had to implement a middleware to make Authentik integration work with it.

[Sworyz]

+1 We use PocketID with LDAP here.

[devilr33f]

hey, made this patch to support pocket id. tested only on my local instance but looks like it works: https://github.com/devilr33f/pelican-pocketid

[dougmaitelli]

Did you open a PR to the official repo with these? Would be nice to have this in the official code base tbh.

[devilr33f]

Did you open a PR to the official repo with these? Would be nice to have this in the official code base tbh.

no, because i don't have time for proper testing.
you can use the code for your PR if you need to

[dougmaitelli]

Would be great if someone could pack that into a plugin now that plugins are supported https://pelican.dev/docs/panel/advanced/plugins

I might try at some point if I find some time

[poVoq]

Oauth2 is basically OIDC, but what seems to be missing is an option to configure an generic endpoint that isn't Google, Discord etc.

I would like to authenticate with Oauth2 against my Forgejo server for example.

[poVoq]

Actually my bad: https://github.com/pelican-dev/plugins/tree/main/generic-oidc-providers

[dougmaitelli]

I been using the plugin for a while now. It works, but it is a bit annoying to have to manually download it again every time the panel updates because there are conflicting changes.

IMO Generic OIDC should be a core feature, makes no sense to me that the core panel supports so many OAuth2 providers but does not support a Generic option.

[lancepioch]

OAuth login with providers like Authentik, Discord, and GitHub is built in, missing users can be auto created since v1.0.0-beta24 via #1573, and a generic OIDC provider is available as an official plugin. LDAP and SAML aren't planned for core, so please open a focused discussion if you need those. Closing as resolved.