SSO with OIDC

[cj13579]

This change makes the single sign on capability generic and looks to satisfy the requirements of #131.

It's basically the same as what we have already for Google accounts but would support any OIDC provider. I have tested this configuration with OIDC to Google and with Authentik,

I have renamed the configuration options and environment variables to be OIDC instead of google. The required environment variables to be set now are:

• OIDC_AUTHORIZATION_URL
• OIDC_TOKEN_URL
• OIDC_ISSUER
• OIDC_CLIENT_ID
• OIDC_CLIENT_SECRET

If you are using Google, for example, all of the above items apart from issuer (which is always https://accounts.google.com) are given to your when you download the JSON file that has the client ID and secret. For example:

OIDC_AUTHORIZATION_URL=https://accounts.google.com/o/oauth2/auth
OIDC_TOKEN_URL=https://oauth2.googleapis.com/token
OIDC_ISSUER=https://accounts.google.com
OIDC_CLIENT_ID=abc-123.apps.googleusercontent.com
OIDC_CLIENT_SECRET=GOOGLEFOO-1234

With something like Authentic, you get shown the URLs when you configure your OIDC provider:

OIDC_AUTHORIZATION_URL=https://auth.example.com/application/o/authorize/
OIDC_TOKEN_URL=https://auth.example.com/application/o/token/
OIDC_ISSUER=https://auth.example.com/application/o/wishlist/
OIDC_CLIENT_ID=asdfsdfhfghjfghkj
OIDC_CLIENT_SECRET=123345567657809

When you are configuring an OIDC provider you must configure the following redirect URLs:

• https://wishlist.example.com/auth/oidc/redirect
• https//wishlist.example.com/auth/oidc/link/redirect

[cj13579]

Perhaps also solves #26?

[UndyingSoul]

Please revert this change.

Other than that, I have oidc working with this fork using Authentik 2024.10.4 as the OIDC provider.

[UndyingSoul]

Apologies. First time submitting a comment on a PR on mobile. These are the lines specifically to revert before merging. Thanks.

[cj13579]

It’s OK, I was worried about this previously but it resolves itself when @Wingysam merges.

[DanteMS]

Is there an image available with these changes? I tried building one, but encountered some weird extension issues when starting a container.

[Wingysam]

I'd like to keep backwards compatibility with the Google configuration. I'm also concerned that calling it OIDC on the button labels might confuse people. I doubt that anyone in my family except for me has ever heard of OIDC. Maybe we could have an environment variable where the user provides the name/icon of the service being used for login?