Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature/OIDC auth #591

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from

Conversation

lukerosser
Copy link

Adds OIDC login support

OIDC metadata discovery is supported or URLs can be specifically provided through .env

Some potential discussion areas:

  • Removes username and password fields from the login replaced by a single OIDC login button
  • Automatically provisions a user following a successful OIDC login
  • evtx2splunk has been rebuilt manually with a python-dotenv version bump to the next minor version, 0.21, to solve version conflicts with oic
  • The other "oidc_proxy" auth method has been left untouched as it looks to support a different use case without direct integration by authenticating elsewhere and reading the resulting headers

@e-renna
Copy link

e-renna commented Sep 19, 2024

OIDC implementation (technically) fulfills #214 since MFA can be delegated to the auth provider

@whikernel
Copy link
Contributor

Thanks a lot @lukerosser ! 🙏

@e-renna - I'll close #214 as MFA is already available since a few version 👍

@whikernel whikernel changed the base branch from develop to hotfix_2.4.13 September 20, 2024 12:58
@whikernel whikernel changed the base branch from hotfix_2.4.13 to develop September 20, 2024 12:59
@whikernel
Copy link
Contributor

@lukerosser - I ported your changes to the current next release because I want this to be published asap and the develop branch may be delayed a bit.

For your - valid - points:

  1. It's a valid points. For my test I directly redirects the user to the SSO portal if OIDC is set up. In a second time we'll see how we can handle the hybrid mode where users can be from OIDC and local for instance.
  2. I added a condition on the already existing IRIS_AUTHENTICATION_CREATE_USER_IF_NOT_EXIST variable which allows to change this behavior.
  3. Thanks, this module (which is mine) is a bit of pain and probably noone is using it, so it might disappear sometimes
  4. Indeed, it's legacy - we'll probably remove at some point

Thanks again for the work 🙏

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants