Can remark42 be integrated with Auth0? #1618
-
|
Just what it says on the question. The docs mention it needs OAuth, and Auth0 technically does that, so I'm not sure. |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 5 replies
-
|
Remark42 has many OAuth providers integrated so you probably don't need Auth0. |
Beta Was this translation helpful? Give feedback.
-
|
But I need sign in to the application, not just the comments. Unless remark42 auth can integrate with the parent application? |
Beta Was this translation helpful? Give feedback.
-
|
Remark42 utilizes the go-pkgz/auth library for all auth-related tasks and has the capability to support third-party authentication providers. For more information, please refer to https://go-pkgz.umputun.dev/auth/#custom-oauth2. However, it is currently not integrated into Remark42. If anyone is interested and able to add support for this, I would be open to accepting a pull request. It's important to note that changes would be required on both the backend and frontend components. Nevertheless, I am unsure how a "single sign-on" would work in practice, as Remark42 is an external system to your application. It handles authentication concerns with JWT and expects specific claims to be set in cookies or communicated through headers. Theoretically, a bridge (reverse proxy in front of the application and remark42) could handle it, but this would require development. |
Beta Was this translation helpful? Give feedback.
-
|
What if the cookie(s) remark42 expects is/are set by the application? The JWT could also be generated by the application, since I could use the same secret as remark42. Another issue would be if the user needs to sign in, they will have the sign in to the comments, and the sign in to the application, and only the sign in to the application could potentially work for both. |
Beta Was this translation helpful? Give feedback.
-
|
this may work, but you will need to run remark42 on the same domain. We have instructions how to do it. as long as you app set both |
Beta Was this translation helpful? Give feedback.
-
I'm not sure how much of issue is this. You can keep one of auth providers in remark42 (for example email), so user could login to comments only without login to your app. Or you can alter CSS and just hide the login button in remark42 widget if this what you need |
Beta Was this translation helpful? Give feedback.
this may work, but you will need to run remark42 on the same domain. We have instructions how to do it.
as long as you app set both
JWTand"XSRF-TOKENcookies (you can see how our auth does it here), and all the claims we expect are properly set, remark42 wouldn't care what application set it.