Authentication using SAML and Open ID connect

[ninjatrench]

Have you considered SAML 2.0 or OIDC authentication types ? or is it in the roadmap ?

[bugy]

Hi @ninjatrench, to be honest, I didn't consider implementing some generic authentication types, but rather provide integration on-demand through some services.
For example, at the moment there is google auth support (which is similar to OIDC, as far as I understand)
In the nearest future, I want to add integration with AWS Cognito (because then I would be able to use it in a current company).

But I don't have any experience with OIDC and even don't know anything about SAML :(

[ninjatrench]

Do you mind if I try and implement it? I was exploring other tools like wooey (IDK if you have heard or used it) but that is on Django and way too heavy. I would rather want to invest my time on improving this tool

[bugy]

@ninjatrench definitely! Any contribution is more than welcome!

Just as starting points, you can check these 2 files:
https://github.com/bugy/script-server/blob/master/src/auth/auth_google_oauth.py
https://github.com/bugy/script-server/blob/master/web-src/js/login.js

I think they cover 95% of the protocol-specific implementation.
And one more thing: for google auth I decided to use client-based redirection (i.e. client code is aware of redirection and keys) for better user experience.

[bugy]

Hi @ninjatrench, did you start working on it already?

I'm working on some frontend refactorings at the moment (#282), and don't want to create troubles for you with merge conflicts

[ninjatrench]

Yeah, but not anything substantial. I was planning to finish it over this weekend; let me contact you over email to set up a meeting or something because I looked the above mentioned 2 files but OpenID connect will require changes at a lot of other layers.

[bugy]

Hi @ninjatrench, thanks for the quick reply. Then I'll try to finish my refactorings on Friday, so you could rebase your branch

A meeting is fine, let's do it! It might very well be, that much more changes are needed, I'm not aware of OpenID, so hard to estimate affected areas. I though it should be similar to google oauth, but it seems that I'm wrong