47 lines
2.2 KiB
Markdown
47 lines
2.2 KiB
Markdown
# TASK METADATA
|
|
|
|
- **Target Files:** `auth-yes/server/db.ts`, `auth-yes/server/oidc.ts`,
|
|
`auth-yes/server/main.ts`, `auth-yes/ui/admin/integrations.tsx` (and related
|
|
UI files)
|
|
- **Core Objective:** Implement seamless 3rd-party SSO via a Zero-Click OIDC
|
|
Provider and Traefik ForwardAuth Header injection.
|
|
- **Dependencies:** Core Auth-Yes session mechanisms, Valkey cache, Hono
|
|
routing, React/JSX for UI.
|
|
- **Additional Important Notes:** Ensure OIDC logic is decoupled from `main.ts`
|
|
to prevent a monolith. Database migrations are required for OIDC
|
|
clients/authorization codes.
|
|
|
|
---
|
|
|
|
### Phase 2: The Bonus Stage — Seamless 3rd-Party SSO (Gitea, Portainer, etc.)
|
|
|
|
Your vision for frictionless 3rd-party access without double-logins is
|
|
achievable through two native patterns we can bring directly into auth-yes:
|
|
|
|
#### 1. The "Zero-Click" OIDC Provider in auth-yes
|
|
|
|
• Most self-hosted power tools (Gitea, Nextcloud, Grafana, Portainer, Proxmox,
|
|
Vaultwarden) support standard OpenID Connect (OIDC). • When auth-yes exposes
|
|
standard OIDC endpoints (/oauth/authorize, /oauth/token, /oauth/userinfo): • You
|
|
click "Login with Auth-Yes" on Gitea (or configure Gitea for auto-login). •
|
|
Gitea redirects to auth.atyg.org. • Because you already have your .atyg.org
|
|
passkey cookie active, auth-yes instantly authorizes and redirects back in ~10
|
|
milliseconds without presenting any login dialogs. • Gitea automatically creates
|
|
and syncs your account on the fly.
|
|
|
|
#### 2. Reverse-Proxy Header Authentication (Traefik ForwardAuth)
|
|
|
|
• Apps like Gitea have native Reverse Proxy Auth
|
|
(ENABLE_REVERSE_PROXY_AUTHENTICATION = true). • When Traefik calls
|
|
/api/forward-auth, auth-yes injects X-Forwarded-User: <username>. Gitea
|
|
immediately trusts the header and logs you in transparently with zero
|
|
interaction.
|
|
|
|
#### 3. 3rd-Party App Integrations Manager in Admin Console
|
|
|
|
• We can expand our Application Registry (/admin/apps) with an Integrations
|
|
Catalog (Client IDs, OIDC secrets, callback URLs, and role-mapping presets for
|
|
Gitea, Grafana, Portainer, etc.). • This gives you a single pane of glass to
|
|
manage passkey-secured SSO across your entire self-hosted ecosystem, allowing
|
|
you to optionally bypass Cloudflare Zero Trust popups entirely.
|