Feature: Add OpenID authentication

[sponte]

Changes

• Add generic OpenID Connect (OIDC) authentication provider that works with any OIDC-compliant identity
  provider (Keycloak, Auth0, Okta, etc.)
• Add automatic discovery of OIDC endpoints via .well-known/openid-configuration
• Add support for custom login button labels for all OAuth providers
  • Configurable via UI in Settings > OAuth
  • Configurable via environment variables (e.g., OPENID_LOGIN_LABEL="Login with Company SSO")
  • Priority: Database setting > Environment variable > Default translation
• Add custom_label column to oauth_settings table via migration
• Cache OIDC configuration for 1 hour to reduce API calls

Implementation Details

• Created custom OIDC provider in app/Socialite/OpenIDConnect/ following Laravel Socialite patterns
• Extended all form components to support custom labels
• Updated login view to use dynamic labels via getLoginLabel() method
• Added environment variable support for all OAuth providers (not just OpenID)

Testing

• Tested with Keycloak instance
• Verified custom labels work via both UI and environment variables
• Confirmed OIDC discovery endpoint caching works correctly
• Tested migration rollback functionality

Backwards Compatibility

• All existing OAuth providers continue to work unchanged
• Migration is non-breaking (adds nullable column)
• Default behavior unchanged if custom labels not configured
• Existing translations still used as fallback

Documentation Updates

• Updated .ai/patterns/security-patterns.md with OpenID provider details
• Added OAuth configuration examples to .env.development.example
• Updated CHANGELOG.md with feature additions

Use Case

This enables organizations to use their existing OIDC identity providers (like Keycloak, Auth0, or
corporate SSO systems) with Coolify, while also being able to customize the login button text to match
their branding (e.g., "Login with SSO" instead of generic "Login with OpenID").

[Cinzya]

Looks like its adding the same as #6696

[sponte]

Fair enough. I've looked at using the laravel oidc provider but I've encountered some dependency incompatibilities with php version.

Additionally you have the ability to name the provider here as Login with OpenID is too generic when using such abstract provider.

Anyhow, glad to see there is some traction on providing oidc to coolify! Love the project and we're using a self-hosted version here at Platform Shape to develop our MVP. great work everyone!