oAuth

[FoksVHox]

I would love to see support for oAuth in Catchet. I know there are some other (closed) issues requesting the same functionality, but I think this would be a great addition for Catchet.

[jbrooksuk]

@FoksVHox what provider would you be interested in using?

[milliams]

This would be useful for us too. For us, specifically CachetHQ acting as an OIDC client/relying party would be good.

The way I've seen it work elsewhere would be either a config file on Cachet's side which maps identities (e.g. sub or email claims) coming from OIDC JWTs to ephemeral (or at least on-the-fly-generated) users in Cachet (including whether they are an admin or not); or some configured role map which reads claims coming from OIDC and uses that to decide access or admin status.

Specifically, we're using Keycloak as our OIDC IdP.

[FoksVHox]

@FoksVHox what provider would you be interested in using?

@jbrooksuk Personally I'd be interested in using Azure, as that is what we use for SSO at my company.

[psuet]

Hey,

I have just sent a pull-request with a basic oAuth Implementation (and only in cachet-core right now)

Right now it does not utilizes any claims / groups / ... etc. and the necessary restrictions must be provided by the provider side.
It's only tested for Github and Keycloak right now as this is what was easily available to me.

But the integration of further providers (into the workbench) is quite straight forward. You can follow the guide here with the following modifications:

• AppServiceProvider is the WorkbenchServiceProvider
• You must reinitialize the redirect path in the register method of the WorkbenchServiceProvider as it changes the path (see the other providers for an example)

I will add the integration for the main application once there was some feedback here.
I don't know which providers should be included by default. This would probably be also open to debate.