[BUG Support] SSO

[Ryderjj89]

Morning! I just discovered this app through https://selfh.st and this looks really nice. I see it has an admin panel for creating/managing users, but was wondering if there are plans to add SSO support for things like Authentik, Authelia, etc. OIDC would be great.

[fccview]

Hi @Ryderjj89

I am actually not planning to implement SSO any time soon, I initially build this app to just share checklists/documents between me and my wife.

However, I'll keep this issue open and if I get enough request for it I will think about it.
It's a lot of work 😆

I'm also open to collaboration/pull requests/peer reviewing someone's feature if anyone is interested in implementing it

Hope this is not too disappointing :)

[fccview]

This is happening in the next release 👀 #50

[Ryderjj89]

Oh hell yeah. WIll definitely try it out! I use Authentik so that'll be perfect.

[fccview]

This has been FINALLY included in the latest release: https://github.com/fccview/rwMarkable/releases/tag/1.5.0 ♥️

Please let me know if you struggle setting it up, I tried to keep it as simple and standard as I could, but for my personal experience with my day job as software engineer, sso is fidgety 🤦‍♂️

[samuelthng]

Question regarding this feature - how did you 'migrate' a local user to login with SSO using the same name?

I've wired up the OIDC to my Pocket ID instance, login seems fine but it redirects back to the login page - container doesn't show logs too, so I'm suspecting it's due to existing user.

Update:
Figured it out - when client secret is provided, PKCE should be off.
Should've read the docs properly, my bad.

Great work @fccview, this will vastly help with family adoption of the app!

Update 2:
Also, confirmed working fine with Pocket ID
OIDC_ISSUER: https://my-pocket-id.domain.com
PKCE Disabled.

[markalex2209]

but it redirects back to the login page

Tried to configure OIDC too (though with Authelia) and got the same: after successful login in Authelia I'm redirected to callback page with code, but then back to login page (IIRC with http 307)

[fccview]

Question regarding this feature - how did you 'migrate' a local user to login with SSO using the same name?

Hey, simply if the user name matches it will continue using the same folder, no migration needed, username = unique ID. Due to the file system in place this was extremely easy to achieve with little to no extra work. However ALL characters need to be identical. If the sso username is different you'll need to manually move the files across in the new user folder (and update the shared-items.json file accordingly unfortunately, no ways around that.

but it redirects back to the login page

Tried to configure OIDC too (though with Authelia) and got the same: after successful login in Authelia I'm redirected to callback page with code, but then back to login page (IIRC with http 307)

Hi, like @samuelthng said, if PKCE is on you can't use a client secret.
If you are using a client secret just turn PKCE off, if you aren't using a client secret you'll need to turn PKCE on.

Let me know if this sorts it out for you, I have not personally tested Authelia so it may be an actual bug!
I'll re-open the issue until you confirm this is sorted :)