[PR #63] [CLOSED] Single sign-on (OAuth/OIDC) #66

New Issue

2026-02-16T12:52:47-05:00

yindo commented

2026-02-16 12:52:47 -05:00

📋 Pull Request Information

Original PR: https://github.com/stoatchat/rust-authifier/pull/63
Author: @ghost
Created: 12/18/2024
Status: ❌ Closed

Base: master ← Head: single-sign-on

📝 Commits (10+)

c370344 split up authentication into flows
d2b099a introduce callback model
b6b0dd5 add methods to callback model
5abc6cb add SSO configuration
c028411 introduce ID provider model
7a462a7 introduce secret model
eac6111 add methods to ID provider model
e97a075 provide authorization handler
1062f9c provide callback handler
00bdd97 complete callback handler with account creation

📊 Changes

35 files changed (+1501 additions, -25 deletions)

View changed files

➕ config.toml (+16 -0)
📝 crates/authifier/Cargo.toml (+9 -0)
📝 crates/authifier/src/config/mod.rs (+18 -0)
➕ crates/authifier/src/config/sso.rs (+274 -0)
📝 crates/authifier/src/database/definition.rs (+19 -1)
📝 crates/authifier/src/database/dummy.rs (+59 -1)
📝 crates/authifier/src/database/mongo.rs (+124 -1)
📝 crates/authifier/src/derive/rocket.rs (+28 -0)
📝 crates/authifier/src/impl/account.rs (+57 -12)
➕ crates/authifier/src/impl/callback.rs (+43 -0)
➕ crates/authifier/src/impl/id_provider.rs (+333 -0)
📝 crates/authifier/src/impl/mod.rs (+3 -0)
➕ crates/authifier/src/impl/secret.rs (+38 -0)
📝 crates/authifier/src/lib.rs (+1 -0)
📝 crates/authifier/src/models/account.rs (+6 -1)
➕ crates/authifier/src/models/callback.rs (+20 -0)
📝 crates/authifier/src/models/mod.rs (+4 -0)
➕ crates/authifier/src/models/secret.rs (+29 -0)
📝 crates/authifier/src/result.rs (+31 -0)
📝 crates/authifier/src/util.rs (+6 -0)

...and 15 more files

📄 Description

This is a draft, a few things to consider:

Should email verification be allowed through authifier or only through the upstream ID provider?

Provide the following options:

native: the account has to verify its email via revolt

oauth: the account has to verify its email via the upstream provider, we check this with the email_verified claim (if not present? should default to the former option? or just error at startup? )

native-oauth: the same as the previous option without the requirement of the email_verified claim

disabled: just mark all oauth users as having their email verified

Should the encoding secret be configurable?

I suppose the secret should just be configurable then so it's both persistent and private

How specific do we want the error variants to be?

...

Do we wanna store the metadata of OIDC providers? If so how long should they be cached for?

Yes, cache it for min. 1 hour

All I can think of for now. Refer to https://connect2id.com/learn/openid-connect and https://connect2id.com/learn/oauth-2-1 for implementation details.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/stoatchat/rust-authifier/pull/63 **Author:** [@ghost](https://github.com/ghost) **Created:** 12/18/2024 **Status:** ❌ Closed **Base:** `master` ← **Head:** `single-sign-on` --- ### 📝 Commits (10+) - [`c370344`](https://github.com/stoatchat/rust-authifier/commit/c370344bf427d25c6dc77e91f2787a40312e293f) split up authentication into flows - [`d2b099a`](https://github.com/stoatchat/rust-authifier/commit/d2b099a13aa188f7bbe8062e7eca930dc1a0c443) introduce callback model - [`b6b0dd5`](https://github.com/stoatchat/rust-authifier/commit/b6b0dd50993c51c7921caeadae4f6e305d589da7) add methods to callback model - [`5abc6cb`](https://github.com/stoatchat/rust-authifier/commit/5abc6cbab01444f40484b438da706f5dae1523b4) add SSO configuration - [`c028411`](https://github.com/stoatchat/rust-authifier/commit/c02841138346c097cecb701023123813497f7f1c) introduce ID provider model - [`7a462a7`](https://github.com/stoatchat/rust-authifier/commit/7a462a794ed6e1998ba98aa6743d6db47c50ee1a) introduce secret model - [`eac6111`](https://github.com/stoatchat/rust-authifier/commit/eac61115a1430b0f91bbda4d745a97d5aaef32b0) add methods to ID provider model - [`e97a075`](https://github.com/stoatchat/rust-authifier/commit/e97a075406cf274add1c5b73feed0c5a0270c531) provide authorization handler - [`1062f9c`](https://github.com/stoatchat/rust-authifier/commit/1062f9cbc29781226fc0d928ccf0ac6b5cd6b296) provide callback handler - [`00bdd97`](https://github.com/stoatchat/rust-authifier/commit/00bdd970019cfa255e287c4c6fbde7f83ab93fdb) complete callback handler with account creation ### 📊 Changes **35 files changed** (+1501 additions, -25 deletions) <details> <summary>View changed files</summary> ➕ `config.toml` (+16 -0) 📝 `crates/authifier/Cargo.toml` (+9 -0) 📝 `crates/authifier/src/config/mod.rs` (+18 -0) ➕ `crates/authifier/src/config/sso.rs` (+274 -0) 📝 `crates/authifier/src/database/definition.rs` (+19 -1) 📝 `crates/authifier/src/database/dummy.rs` (+59 -1) 📝 `crates/authifier/src/database/mongo.rs` (+124 -1) 📝 `crates/authifier/src/derive/rocket.rs` (+28 -0) 📝 `crates/authifier/src/impl/account.rs` (+57 -12) ➕ `crates/authifier/src/impl/callback.rs` (+43 -0) ➕ `crates/authifier/src/impl/id_provider.rs` (+333 -0) 📝 `crates/authifier/src/impl/mod.rs` (+3 -0) ➕ `crates/authifier/src/impl/secret.rs` (+38 -0) 📝 `crates/authifier/src/lib.rs` (+1 -0) 📝 `crates/authifier/src/models/account.rs` (+6 -1) ➕ `crates/authifier/src/models/callback.rs` (+20 -0) 📝 `crates/authifier/src/models/mod.rs` (+4 -0) ➕ `crates/authifier/src/models/secret.rs` (+29 -0) 📝 `crates/authifier/src/result.rs` (+31 -0) 📝 `crates/authifier/src/util.rs` (+6 -0) _...and 15 more files_ </details> ### 📄 Description This is a draft, a few things to consider: - Should email verification be allowed through `authifier` or only through the upstream ID provider? > Provide the following options: > - `native`: the account has to verify its email via revolt > - `oauth`: the account has to verify its email via the upstream provider, we check this with the `email_verified` claim (if not present? should default to the former option? or just error at startup? ) > - `native-oauth`: the same as the previous option without the requirement of the `email_verified` claim > - `disabled`: just mark all oauth users as having their email verified - Should the encoding secret be configurable? > I suppose the secret should just be configurable then so it's both persistent and private - How specific do we want the error variants to be? > ... - Do we wanna store the metadata of OIDC providers? If so how long should they be cached for? > Yes, cache it for min. 1 hour All I can think of for now. Refer to https://connect2id.com/learn/openid-connect and https://connect2id.com/learn/oauth-2-1 for implementation details. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

yindo added the pull-request label 2026-02-16 12:52:47 -05:00

yindo closed this issue

2026-02-16 12:52:47 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: stoatchat/rust-authifier#66