SSO / OpenID connect support?

[anarcat]

Hi!

Would it be possible to implement single-sign on support, perhaps by making goatcounter an OpenID relaying party, or implementing SAML?

Or is it possible to use external authentication and (essentially) trust the REMOTE_USER variable (or header) provided by the proxy and automagically create users?

thanks!

[arp242]

Sure, I don't mind adding it as such. No one asked before.

Are you using this for a corporate setting? Or what's the context? The reason I'm asking is because that's where SAML is typically used and I'm somewhat tempted to say "I'll add it if someone sponsors the work". I never had to implement SSO/SAML before but I've heard tons of people complain about it over the years about being an absolute pain to deal with.

[anarcat]

Sure, I don't mind adding it as such. No one asked before. Are you using this for a corporate setting? Or what's the context? The reason I'm asking is because that's where SAML is typically used and I'm somewhat tempted to say "I'll add it if someone sponsors the work". I never had to implement SSO/SAML before but I've heard tons of people complain about it over the years about being an absolute pain to deal with.

This is, right now, my home lab, but it's an experimentation space for work. Work, right now, is torproject.org which is a relatively large organization, but it's a non-profit, so not exactly "corporate"? :) It seems the two emerging standards (because, of course, we can't have a single one) are SAML and OIDC at this point. A separate project (Readeck) recently started down this path, and they took the interesting approach of first implementing Oauth authentication tokens for the apps (because it's quite an "app-based" software), and *then* they'll work on the rest of OIDC... But considering goatcounter has no app, maybe that approach is moot, and you're better off either with SAML or jumping straight into OIDC. I'm not super familiar with either of them anymore, I've heard bad things about both... I think it's perfectly fine to say this though:

I'll add it if someone sponsors the work

... not only because this is corporate-y, but also because it's your project, your time, and "free" software, which *someone* needs to pay for. :) Thanks for your response!