help wanted: delegate authentication to an external IdP (OIDC/OAuth2)

[jyio]

Thank you for sharing this awesome UI. Happy new year!

#68 adds a very useful feature, and I'd like to integrate it with my existing auth stack. How would one delegate authentication to an external IdP (for example, OIDC/OAuth2 or forward auth headers)?

[justinh-rahb]

I'm hopeful this is something they already had in mind and I suspect so from looking at the discussion of that feature merge. There's still much to do before I could expose this to the Internet with confidence, but all in good time.

[tjbck]

Hey guys! Happy New Year!

I'd love to implement a feature that would delegate authentication to external services, but I'm trying to focus on other core features like RAG, function calling, etc. at the moment, so I'm not entirely sure when I'll be able to take a look at this. If anyone could get the ball rolling for this feature and create a PR, I'd greatly appreciate it. Thanks!

[jyio]

Totally understandable that there are other priorities. I'll try to look into it when I get a chance. Thank you for considering it :)

[Collected5353]

Shouldn't be too hard since https://fastapi.tiangolo.com/tutorial/security/simple-oauth2/ already contains most of the code I can take look to see what we would need to implement.

I think handling public Oauth should be straightforward. Configuring external IDP may take more time and testing.

[justinh-rahb]

Working with Google, Microsoft etc. yes should be fairly easy. I feel this would probably cover most people that want OIDC for a start. Generic IDPs such as KeyCloak, Authentik, Authelia, etc. are more difficult, because you'll need to stand up that infrastructure for testing.

[Collected5353]

Right now the best advice I can give is to run ngrok to integrate Oauth. Got it working for google with no issues.

[sammcj]

Has anyone got an example of a redirect URL / request that passes in a JWT for authentication?

I want to bypass the internal authentication page as I'm using Authentik as my IDP across all apps.

[SurvivaLlama]

I am ready and willing to test out LDAP once it gets added

[yousecjoe]

I'm interested in testing this for Zero Trust IAM requirements using Keycloak, Entra, JumpCloud, and others.