This PR includes the possibility of including a generic OIDC-based SSO on the console in addition to the current Github OAuth. Hence, it provides a more generic way to connect to a provider and delegate multi-user authentication via the AUTH_OIDC_PROVIDER.

Why?

Although Github OAuth does its job with a simple configuration, it lacks the capacity to provide an enterprise case delegation for authorization and authentication management like tools like Auth0 and Keycloak, for instance, which might work as a proxy for other providers while also providing features like RBAC.

How?

Through the AUTH_OIDC_PROVIDER environment variable, the jitsu self-hosted admin can pass a JSON object containing at least a valid issuer, clientId, and clientSecret of a provider compliant with the OIDC Discovery spec that provides a /.well-known/openid-configuration endpoint.

The implementation relies on a custom provider implementation of NextAuth.js, while being careful to provide profile that can fill the jitsu UserProfile schema definition and related tables.

Examples

Auth0

Env Config

AUTH_OIDC_PROVIDER='{"issuer":"https://{yourDomain}.us.auth0.com/","clientId":"valid_client_id","clientSecret":"valid_client_secret"}'

Demo

Keycloak

Env Config

AUTH_OIDC_PROVIDER='{"issuer":"http://localhost:8080/realms/dev_realm","clientId":"dev_client","clientSecret":"9bvQ9hgVxekDMfMmCdK8dds3ef4097HX"}'