Skip to content

Add basic OIDC integration with locally setup Authentik#1805

Open
kmoy1 wants to merge 1 commit intowger-project:masterfrom
kmoy1:OIDCSupport
Open

Add basic OIDC integration with locally setup Authentik#1805
kmoy1 wants to merge 1 commit intowger-project:masterfrom
kmoy1:OIDCSupport

Conversation

@kmoy1
Copy link
Copy Markdown
Contributor

@kmoy1 kmoy1 commented Nov 1, 2024

NOTE: Since this requires local manual setup of an OIDC IDP, this should not be merged into master but into its own branch (e.g. 'OIDC').

Addresses #1797

Proposed Changes

  • Added a very basic form of OIDC Authentication support, by adding a "Login with Authentik" button to the Login page. It will authenticate with another (locally) spun-up Authentik IDP server, instead of requiring username/password combo. It will use the email of the user instead.

Please check that the PR fulfills these requirements

  • [] Tests for the changes have been added (for bug fixes / features) - not sure how to test this, because this code review requires manual setup of an OAuth2 provider.
  • Added yourself to AUTHORS.rst

Other questions

  • Do users need to run some commmands in their local instances due to this PR
    (e.g. database migration)?

Yes. Users need to spin up an Authentik application of their own and then set these environment variables in the Django app (or hardcode them in settings_global.py: not recommended), values of which are provided by Authentik.

OIDC_RP_CLIENT_ID
OIDC_RP_CLIENT_SECRET
OIDC_OP_AUTHORIZATION_ENDPOINT
OIDC_OP_TOKEN_ENDPOINT
OIDC_OP_USER_ENDPOINT
OIDC_OP_JWKS_ENDPOINT

They also need to set
OIDC_RP_SIGN_ALGO=RS256

@eyJhb eyJhb mentioned this pull request Jan 2, 2025
4 tasks
@Keridos
Copy link
Copy Markdown

Keridos commented Mar 22, 2026

This looks like a draft for me. Under the assumption that the implementation is working:
The OIDC login should be only activated when the OIDC Variables are set.
Additional Choice: When it is activated you may disable regular account login with username and password.
Additionally it would be very nice to make the name of the OIDC Provicer (on the button) also configurable via env variable.

Sadly I lack the skills for web development and never worked with Django so far or I'd implement the changes myself.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants