Implement OAUTH, SAML, Social Login

[ykorzikowski]

Django All-Auth already support a huge list of social providers.

https://django-allauth.readthedocs.io/en/latest/providers.html#keycloak

Make it possible to login via keycloak, google etc.

[bruno-lopes]

That would be very nice! This way, it would be possible to have single sign-on with other applications.

[Marv93]

The django-allauth link is deprecated. https://docs.allauth.org/en/latest/index.html is the current link to the documentation.

[QuestOAuth74]

It appears there are few developers assisting with this project. I really wish we had more updates. This is such a wonderful web app.

[stp14]

I feel like I'm really close on this. I've got django-allauth installed (version 0.56.0), and (based on this documentation) I've tried the following in my settings.py:

SOCIALACCOUNT_PROVIDERS = {
    "openid_connect": {
        "APPS": [
          {
            "provider_id": "keycloak",
            "name": "Keycloak",
            "client_id": "<mediacms client  id>",
            "secret": "<mediacms keycloak client secret>",
            "settings": {
              "server_url": "https://keycloak.<domain>/realms/<realm>/.well-known/openid-configuration",
            },
          }
        ],
        "SCOPE": [
            "profile",
            "email",
        ],
    }
}

...but since it says Keycloak was removed in favor of generic OpenID Connect, I tried this based on the OIDC documentation:

SOCIALACCOUNT_PROVIDERS = {
    "openid_connect": {
        "OAUTH_PKCE_ENABLED": True,
        "APPS": [
            {
                "provider_id": "keycloak",
                "name": "Keycloak",
                "client_id": "<mediacms client id>",
                "secret": "<mediacms keycloak client secret>",
                "settings": {
                    "server_url": "https://keycloak.<domain>>",
                    "oauth_pkce_enabled": True,
                },
            },
        ],
        "SCOPE": [
            "profile",
            "email",
        ],
    }
}

Neither of those results in the Social applications section being populated in my MediaCMS instance, after restarting the container and running python manage.py migrate (just in case)

I have GLOBAL_LOGIN_REQUIRED = True set, so I made the fix noted in #1093

I also added "allauth.account.middleware.AccountMiddleware", under MIDDLEWARE = [ in my settings.py because it yelled at me that it was required. If I put it on the first line under MIDDLEWARE = [ that seemed to break the GLOBAL_LOGIN_REQUIRED fix... so I moved it toward the bottom of the list. List looks like this now:

MIDDLEWARE = [
    "django.middleware.security.SecurityMiddleware",
    "django.contrib.sessions.middleware.SessionMiddleware",
    "django.middleware.locale.LocaleMiddleware",
    "django.middleware.common.CommonMiddleware",
    "django.middleware.csrf.CsrfViewMiddleware",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "django.contrib.messages.middleware.MessageMiddleware",
    "django.middleware.clickjacking.XFrameOptionsMiddleware",
    "allauth.account.middleware.AccountMiddleware",
    "debug_toolbar.middleware.DebugToolbarMiddleware",
]

Also, in my settings.py:

AUTHENTICATION_BACKENDS = (
    "django.contrib.auth.backends.ModelBackend",
    "allauth.account.auth_backends.AuthenticationBackend",
)

So even if I can't pre-populate "Social Account" login in the settings file, I hoped maybe I could add it through the GUI. So I can navigate to https://mediacms.<domain>/admin/socialaccount/socialapp/add/ and go through that process to add Keycloak, as seen here:

It then shows in the https://mediacms.<domain>/admin/socialaccount/socialapp/ buuuuut...

Even after all this, I don't see any option to log in with my "social provider" when I log out. So it may be that adding it via the GUI is working and I just can't get to the button to log in with Keycloak? I can't find any setting to activate/show that button.

Also I see several discussions about this (#693 is one) so I hope somebody can give me that last nudge to get it working.

[dwolfe884]

Wanted to post the last steps I had to use to get the login with socials button showing up.

I added the following lines to templates/account/login.html to get my auth0 integration working:

{% load socialaccount %}

[...]

<a href="{% provider_login_url 'auth0' %}" class="btn btn-primary">Login with Auth0</a>

This along with adding "allauth.socialaccount.providers.auth0" to the INSTALLED_APPS array inside of cms/settings.py allowed me to enter all my OIDC settings from auth0 and do a full SSO login.

[mgogoulos]

Thanks for sharing any details here, it's true that most of the providers require some work in settings + templates, so there can't be a global solution to fit all scenarios!

for what is worth I'm currently working on a SAML integration with customizations on the attributes and mapping

[dwolfe884]

I reworked my solution to rely on a new SOCIAL_LOGINS settings specified in settings.py as seen below.

SOCIAL_LOGINS = ["auth0"]

I then added a for loop to the login template to render out any social logins specified by the user in settings.py.

{% if SOCIALLOGINS %}
        {% for login in SOCIALLOGINS%}
                <a href="{% provider_login_url login %}" class="btn btn-primary">Sign in with {{ login }}</a>
        {% endfor %}
{% endif %}

Do you think this is something worth cleaning up and opening as a PR?

Additionally, if there's interest, I could transfer my personal notes to a new docs page to detail one example of setting up OIDC since everyone's setup will be a little different.

[mgogoulos]

sure, feel free to submit any doc or even code and I'll try to review!

[mgogoulos]

SAML is supported through https://github.com/mediacms-io/mediacms/releases/tag/v5.0.0 now :)

[chsasank]

I implemented oauth referring to suggestions from @dwolfe884 and @stp14. Please find it at #1257. I could however get this working from 4.6.0 instead of 5.0.0 because there are way too many features related to SAML auth which conflicted with this.