[REQUEST] Implement OIDC authorization flow #350

winston0410 · 2024-10-24T07:41:31Z

Is your feature request related to a problem? Please describe.
I would like to authorize user with external IDP and giving them access to AdventureLog without registering again.

Describe the solution you'd like
Adventurelog to support basic OIDC authorization flow. It doesn't have to be PKCE, the basic flow with client id and client secret should solve the problem

Describe alternatives you've considered
SAML and LDAP. These two approaches are more complex, and OIDC is more modern

Additional context
Add any other context or screenshots about the feature request here.

Aesgarth · 2024-11-10T22:33:49Z

I'd love to see this too

seanmorley15 · 2024-11-11T19:01:59Z

I am looking into this right now! I want to actually revamp the auth system first, this would mean moving from the current auth system (dj-rest-auth) which is limited to basically just signup and registration, to allauth which has a lot more features like MFA and ODIC (also will make it easier to support a future AdventureLog mobile app 🤫)

nebriv · 2024-12-09T22:46:49Z

Using allauth is a great solution, I use it in many of my django projects. +1! Its a well thought out library, hopefully the migration isn't too painful!

seanmorley15 · 2024-12-09T23:57:54Z

I am currently working on the AllAuth system in the development branch. I am just working some things out before its released but it should not require any manual migration. Thankfully Django makes the whole auth switch really easy!
This will migrate from JWT to session based auth and add MFA as well!

spiritedsnowcat · 2024-12-30T05:34:46Z

I'm excited for this! Thanks for putting the work in. I plan to use Authentik on my home server to do SSO and MFA, but this project supporting OIDC is gonna be a huge enhancement!

UndyingSoul · 2025-01-03T16:00:35Z

Can't wait for this feature. I've been putting off deploying AdventureLog until some sort of SSO is supported. Like @spiritedsnowcat, I'll be using Authentik as an OIDC provider.

I am willing to test this feature as it develops.

seanmorley15 · 2025-01-06T18:16:30Z

Hi everyone! Development for ODIC auth is in full swing and is coming along great so far! I have a working demo of GitHub SSO and Authentik. I will continue to work and perfect this in the coming weeks and plan to release for the next update!! Once its beta ready I will update here for others to try.
I am super glad to see the hype for this feature!

seanmorley15 · 2025-01-13T22:24:29Z

Just released this on the latest tag, hope you all enjoy!

UndyingSoul · 2025-01-14T04:53:38Z

Just pulled the latest image, and am running into a few issues.

Following the docs, I get a 404 after attempting to login using SSO.

My Authentik is accessible and working for all my other services with Oauth at https://auth.example.com

AdventureLog is deployed to https://AdventureLog.example.com

I'm away from my machine right now, so I can't paste in configs/screenshots right now. Just wondering if you've seen this bug.

When I am back at my machine, I'll send a screenshot of what the error looks like, my admin panel configuration, my docker-compose.yml, and the relevant log message(s) which might help track this issue down.

P.S. In the docs, there's at least one instance of Authentik being spelled Autnentik

seanmorley15 · 2025-01-14T04:56:33Z

Got it! take your time @UndyingSoul and send any relevant info when you are ready and I will help!
Also its probably easier for communication on the discord server if you prefer rather than going back and forth on GitHub :)

UndyingSoul · 2025-01-15T01:07:23Z

Alrighty. Here's what I've got, redacting the sensitive information, example.com represents my actual tld.

Error

My environment

Authentik: 2024.10.4
Traefik: 3.1.6
AdventureLog: v0.8.0
PostGIS: 15-3.3
Docker: 27.1.1, build 6312585

docker-compose.yml

services:
  web:
    image: ghcr.io/seanmorley15/adventurelog-frontend:latest
    container_name: adventurelog-frontend
    restart: unless-stopped
    networks:
      - proxy
      - internal
    environment:
      - PUBLIC_SERVER_URL=http://server:8000 # Should be the service name of the backend with port 8000, even if you change the port in the backend service
      - BODY_SIZE_LIMIT=100000
    #ports:
    #  - "8015:3000"
    depends_on:
      - server
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.adventurelogweb.entrypoints=https"
      - "traefik.http.routers.adventurelogweb.rule=Host(`adventurelog.example.com`) && !(PathPrefix(`/media`) || PathPrefix(`/admin`) || PathPrefix(`/static`))" # Replace with your domain
      - traefik.http.services.adventurelogweb.loadbalancer.server.port=3000
      - traefik.docker.network=proxy

  db:
    image: postgis/postgis:15-3.3
    container_name: adventurelog-db
    restart: unless-stopped
    networks:
      - internal
    environment:
      POSTGRES_DB: adventurelog
      POSTGRES_USER: dbuser
      POSTGRES_PASSWORD: supersecretdbpassword
    volumes:
      - /docker/adventurelog/data:/var/lib/postgresql/data/

  server:
    image: ghcr.io/seanmorley15/adventurelog-backend:latest
    container_name: adventurelog-backend
    restart: unless-stopped
    networks:
      - internal
      - proxy
    environment:
      - PGHOST=db
      - PGDATABASE=adventurelog
      - PGUSER=dbuser
      - PGPASSWORD=supersecretdbpassword
      - SECRET_KEY=supersecretkey
      - DJANGO_ADMIN_USERNAME=adminuser
      - DJANGO_ADMIN_PASSWORD=supersecretpassword
      - DJANGO_ADMIN_EMAIL=adventurelog.example.com
      - PUBLIC_URL=https://adventurelog.example.com # Match the outward port, used for the creation of image urls
      - CSRF_TRUSTED_ORIGINS=https://adventurelog.example.com # Comma separated list of trusted origins for CSRF
      - DEBUG=False
      - FRONTEND_URL=https://adventurelog.example.com # Used for email generation. This should be the url of the frontend
      - EMAIL_BACKEND='email'
      - EMAIL_HOST='smtp.example.com'
      - EMAIL_USE_TLS=True
      - EMAIL_PORT=587
      - EMAIL_USE_SSL=True
      - EMAIL_HOST_USER='[email protected]'
      - EMAIL_HOST_PASSWORD='redactedEmailPassword'
      - DEFAULT_FROM_EMAIL='[email protected]'
      - DISABLE_REGISTRATION=True
    #ports:
      #- "8016:80"
    depends_on:
      - db
    volumes:
      -  /docker/adventurelog/media:/code/media/
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.adventurelogserver.entrypoints=https"
      - "traefik.http.routers.adventurelogserver.rule=Host(`adventurelog.example.com`) && (PathPrefix(`/media`) || PathPrefix(`/admin`) || PathPrefix(`/static`))" # Replace with your domain
      - traefik.http.services.adventurelogserver.loadbalancer.server.port=80
      - traefik.docker.network=proxy

networks:
  internal:
  proxy:
    external: true

Relevant Logs

Where is replaced with the oauth provider id/client id?:

adventurelog-frontend  | SvelteKitError: Not found: /accounts/oidc/<client-id>/login/
adventurelog-frontend  |     at resolve2 (file:///app/build/server/index.js:3776:18)
adventurelog-frontend  |     at resolve (file:///app/build/server/index.js:3609:34)
adventurelog-frontend  |     at resolve (file:///app/build/server/chunks/hooks.server-B9jJ9cmg.js:26:16)
adventurelog-frontend  |     at i18nHook (file:///app/build/server/chunks/hooks.server-B9jJ9cmg.js:96:18)
adventurelog-frontend  |     at apply_handle (file:///app/build/server/chunks/hooks.server-B9jJ9cmg.js:8:14)
adventurelog-frontend  |     at resolve (file:///app/build/server/chunks/hooks.server-B9jJ9cmg.js:22:35)
adventurelog-frontend  |     at themeHook (file:///app/build/server/chunks/hooks.server-B9jJ9cmg.js:87:18)
adventurelog-frontend  |     at apply_handle (file:///app/build/server/chunks/hooks.server-B9jJ9cmg.js:8:14)
adventurelog-frontend  |     at resolve (file:///app/build/server/chunks/hooks.server-B9jJ9cmg.js:22:35)
adventurelog-frontend  |     at authHook (file:///app/build/server/chunks/hooks.server-B9jJ9cmg.js:39:20) {
adventurelog-frontend  |   status: 404,
adventurelog-frontend  |   text: 'Not Found'
adventurelog-frontend  | }

Admin Configuration

Authentik Configuration

I'm intentionally leaving the redirect URL empty, since, by default, Authentik puts the first successful redirect url here anyway, then I don't have to worry about fat-fingering the URL.

seanmorley15 · 2025-01-15T01:12:35Z

I think I found the issue, PUBLIC_URL should be the URL of the AdventureLog server not the frontend. This will also need to be set in the Authentik settings as your redirect URI. Ex: PUBLIC_URL=https://adventureapi.mydomain.com and in Authentik redirect uri ^https://adventureapi.mydomain.com/accounts/oidc/.*$

winston0410 added the enhancement New feature or request label Oct 24, 2024

github-project-automation bot added this to AdventureLog Roadmap Oct 24, 2024

seanmorley15 added this to the AdventureLog v0.8.0 milestone Nov 11, 2024

seanmorley15 moved this to Ready in AdventureLog Roadmap Nov 27, 2024

seanmorley15 added the help wanted Extra attention is needed label Dec 16, 2024

seanmorley15 moved this from Ready to Backlog in AdventureLog Roadmap Dec 30, 2024

seanmorley15 modified the milestones: AdventureLog v0.8.0, AdventureLog v0.9.0 Jan 3, 2025

seanmorley15 moved this from Backlog to In progress in AdventureLog Roadmap Jan 6, 2025

seanmorley15 removed the help wanted Extra attention is needed label Jan 6, 2025

seanmorley15 self-assigned this Jan 7, 2025

seanmorley15 mentioned this issue Jan 12, 2025

OIDC Auth and City Visits Data #438

Merged

seanmorley15 closed this as completed in #438 Jan 13, 2025

github-project-automation bot moved this from In progress to Done in AdventureLog Roadmap Jan 13, 2025

UndyingSoul mentioned this issue Jan 17, 2025

Fixes gap in docker-compose example/docs with working oidc implementation #455

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[REQUEST] Implement OIDC authorization flow #350

[REQUEST] Implement OIDC authorization flow #350

winston0410 commented Oct 24, 2024

Aesgarth commented Nov 10, 2024

seanmorley15 commented Nov 11, 2024

nebriv commented Dec 9, 2024

seanmorley15 commented Dec 9, 2024 •

edited

Loading

spiritedsnowcat commented Dec 30, 2024

UndyingSoul commented Jan 3, 2025

seanmorley15 commented Jan 6, 2025

seanmorley15 commented Jan 13, 2025

UndyingSoul commented Jan 14, 2025

seanmorley15 commented Jan 14, 2025 •

edited

Loading

UndyingSoul commented Jan 15, 2025

seanmorley15 commented Jan 15, 2025 •

edited

Loading

[REQUEST] Implement OIDC authorization flow #350

[REQUEST] Implement OIDC authorization flow #350

Comments

winston0410 commented Oct 24, 2024

Aesgarth commented Nov 10, 2024

seanmorley15 commented Nov 11, 2024

nebriv commented Dec 9, 2024

seanmorley15 commented Dec 9, 2024 • edited Loading

spiritedsnowcat commented Dec 30, 2024

UndyingSoul commented Jan 3, 2025

seanmorley15 commented Jan 6, 2025

seanmorley15 commented Jan 13, 2025

UndyingSoul commented Jan 14, 2025

seanmorley15 commented Jan 14, 2025 • edited Loading

UndyingSoul commented Jan 15, 2025

Error

My environment

docker-compose.yml

Relevant Logs

Admin Configuration

Authentik Configuration

seanmorley15 commented Jan 15, 2025 • edited Loading

seanmorley15 commented Dec 9, 2024 •

edited

Loading

seanmorley15 commented Jan 14, 2025 •

edited

Loading

seanmorley15 commented Jan 15, 2025 •

edited

Loading