OIDC Support

[adrianipopescu]

Describe the feature you would like to see

Any chance we could have oidc support? That would allow us to plugin whatever centralized system we might have deployed.

This would be great for security inside the environments as many passwords = many potential weak points.

Describe how you would like to see this feature implemented

Environment variables, preferably or entries in a config file

Describe any alternatives you've considered

Alternatives would be a proxy for oidc, but it feels less than ideal as there's more points of failure.

[amir20]

My intention was to provide proxy forward solution so that anybody could integrate their own proxy.

Alternatives would be a proxy for oidc, but it feels less than ideal as there's more points of failure.

What do you mean by this?

I don't think I'll have time to get to this personally. And not a lot of people are contributing to Dozzle so it feels like I would only prioritize this if a lot people ask for it.

[Woahai321]

i would like to 2nd this request please, oidc would be fab!

[anshibanov]

oidc would be great 🙏

[amir20]

I have worked on this a little #3728

It's pretty complicated. So I wouldn't say it will be done soon. But it's a start.

[wollomatic]

Dozzle works great with Oauth2-Proxy:

 oauth2proxy:
    image: quay.io/oauth2-proxy/oauth2-proxy:v7.8.2
    restart: unless-stopped
    read_only: true
    mem_limit: 1G
    depends_on:
      - dozzle
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges
    command:
      - --upstream=http://dozzle:8080
      - --session-cookie-minimal=true
      - --allowed-role=admin,logviewer
    environment:
      # See: https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview/
      # and: https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider/#keycloak-oidc-auth-provider
      - OAUTH2_PROXY_HTTP_ADDRESS=0.0.0.0:8080
      - OAUTH2_PROXY_PROVIDER=keycloak-oidc
      - OAUTH2_PROXY_OIDC_ISSUER_URL=<<ISSUER_URL>>
      - OAUTH2_PROXY_REDIRECT_URL=<<REDIRECT_URL>>
      - OAUTH2_PROXY_REVERSE_PROXY=true
      - OAUTH2_PROXY_CLIENT_ID=<<CLIENT_ID>>
      - OAUTH2_PROXY_CLIENT_SECRET # get from .env
      - OAUTH2_PROXY_CODE_CHALLENGE_METHOD=S256
      - OAUTH2_PROXY_OIDC_EXTRA_AUDIENCES=account
      - OAUTH2_PROXY_SCOPE=openid profile email
      - OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
      - OAUTH2_PROXY_COOKIE_SECRET # get from .env
      - OAUTH2_PROXY_COOKIE_SECURE=true
      - OAUTH2_PROXY_COOKIE_EXPIRE=10h
      - OAUTH2_PROXY_COOKIE_NAME=__Host-
      - OAUTH2_PROXY_COOKIE_SAMESITE=lax
      - OAUTH2_PROXY_EMAIL_DOMAINS=*
      - OAUTH2_PROXY_PASS_ACCESS_TOKEN=false
      - OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER=false
      - OAUTH2_PROXY_PASS_BASIC_AUTH=true
      - OAUTH2_PROXY_PASS_USER_HEADERS=false
      - OAUTH2_PROXY_PASS_HOST_HEADER=true
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dozzle.rule=Host(`l<<DOZZLE_URL>>`)"
      - "traefik.http.routers.dozzle.tls.certresolver=default"
      - "traefik.http.routers.dozzle.entrypoints=web-secure"
      - "traefik.http.routers.dozzle.middlewares=default-ratelimit@file, secHeaders@file" # depends on your Docker configuration
      - "traefik.http.services.dozzle.loadbalancer.server.port=8080"
    networks:
      - traefik_proxy
      - dozzle

[adrianipopescu]

true, there are middlewares or proxies like what you mentioned or say tinyauth or the traefik oidc middleware but it isn't a premium experience, especially limiting visibility by group or role or both

[amir20]

especially limiting visibility by group or role or both

@adrianipopescu what do you mean by limiting group or role visibility? I don't think OIDC will will have groups either.

[adrianipopescu]

I was thinking having a rule per environment, say, "infra" server can only be seen by people in group A, with groups being functionally a tag that's looked up with contains in the groups claim. Think MVP's MVP. But imo it's can be considered out of scope.

[amir20]

HHmmmm @adrianipopescu that's already possible. You can use filters, to have per user filter that gets passed to Docker. It is also supported with proxy using Remote-Filter.

Which makes me wonder, is there a lot of value adding OIDC? I started implementing it a little but realized that it would require some big refactoring to fit OIDC.

I think the pros would be:

1. Be able to use Dozzle without having to stand up a proxy and configure the parameters
2. More options since OIDC is an open platform

[adrianipopescu]

pretty much, you can offload it to a middleware like traefik's oidc implementation, but my 2c is that it's cleaner and long term you have more control and options

your call on this