Arturo Bernal created JSPWIKI-1315:
--------------------------------------
Summary: Support OpenID Connect login for single sign-on with an
external identity provider
Key: JSPWIKI-1315
URL: https://issues.apache.org/jira/browse/JSPWIKI-1315
Project: JSPWiki
Issue Type: New Feature
Reporter: Arturo Bernal
This is a proposal for discussion, not an implementation. Organisations that
run a wiki expect to sign in with the identity provider they already have, such
as Keycloak, Azure AD or Google Workspace, and today JSPWiki cannot do that
without container specific setup.
What exists today: authentication is JAAS based. The modules in
org.apache.wiki.auth.login are UserDatabaseLoginModule (the default, selected
with jspwiki.loginModule.class), WebContainerLoginModule (container managed
authentication), CookieAuthenticationLoginModule and
CookieAssertionLoginModule, and AnonymousLoginModule. Single sign-on therefore
depends on what the servlet container offers. The open issues JSPWIKI-861
(OAuth, Facebook) and JSPWIKI-94 (OpenID) ask for something related but are old
and narrower.
Proposal: add an optional login module, or a small authentication filter, that
implements the OpenID Connect authorization code flow with PKCE against a
configured issuer (discovery document), maps claims to the wiki login name,
full name, e-mail and roles or groups, and works next to the existing modules
so that nothing changes for installations that do not configure it. Open
questions: whether the dependency on an OIDC library is acceptable (a well
maintained one with an Apache compatible licence would be needed), how provider
groups map to JSPWiki groups and to the roles Admin and Authenticated (see
JSPWIKI-1176), and how logout and session expiry should behave.
Related issues: JSPWIKI-861, JSPWIKI-94, JSPWIKI-1176. Direction to be
discussed on [[email protected]|mailto:[email protected]] first.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
