Feature Reuqest: OIDC Authentication Support

[markusheinemann]

Problem

I'm currently using vitodeploy for multiple side-projects where access to the application is granted to multiple users. In addition to vitodeploy we have multiple other infrastructure apps (like gitea, sentry, grafan, etc.) where the onboarding/offboarding is easy possible trough an external IdP like Keycloak or Microsoft AD. For vitodeploy the users have to be created/removed manually which can simply be forgotten

Proposal

Introduce OIDC as an optional login method with local fallback.

Scope (MVP)

• Configuration of the authentication provider via Environment Variables
  • issuer URL, client ID/secret, scopes
  • claim mappings (sub, email, name, optional groups/roles)
• Login flow:
  • Authorization Code + PKCE
  • state/nonce validation
  • ID token verification (iss/aud/exp/signature)
• User handling:
  • identity linking (provider <--> user)
  • optional auto-provision on first login
• Role mapping:
  • map external claims/groups to Vito roles
• Logout:
  • local logout
  • optional RP-initiated IdP logout when supported

Maybe Laravels Sociallite extension can be used for an easy implementation.

Would that a feature the maintainers/other users are interested in? If yes, I can workout a detailed design document for implementation we can discuss. I can also take care of the implementation afterward.

Happy to hear from you :)