Whas is this proxy doing

[Vad1mo]

I am trying to find out what this code does. We are looking for a ways how we can extend Mattermost to delegate auth to an OIDC provider.

Best would be to write an plugin then rather to modify the mattermost-server.

Would you be so kind and give a short overview about the intention of this code?

[droguljic]

In short this proxy sits in front of a Mattermost instance and inspects requests for an 'auth' cookie, if cookie is not present user is redirected to an OIDC provider, otherwise request is passed through. Proxy also maintains an internal user database so it can provision OIDC users into Mattermost and thus achieve SSO.

I don't see how this functionality could be achieved through a plugin. Not a single line of Mattermost is altered as this a totally separate application.

Some things are lacking,

• Full support for Mattermost v4 API
• Automatic profile updates through webhooks

[Vad1mo]

Thank for the feedback, are you currently using this code?

How does it do it more precisely? does the proxy login the user on the fly? So it maintains a user/password database?

[droguljic]

Private fork of this code is used.

Once proxy receives userInfo from an OIDC provider it checks if such user exists inside internal user database, check is done by email.
When user doesn't exist, random password is generated and user is created inside Mattermost and internal database. After that user is logged in and request is passed through.
When user does exist, updated is performed based on userInfo. After that login and pass through happens also.

For this to work, root user, i.e. system admin, needs to be created. Proxy can automatically create root user on start, under assumption that will be the first user created inside Mattermost. Proxy can also receive credentials of root user through config.