FEATURE: Allow users to sign in using LinkedIn OpenID Connect

[Drenmi]

What is this change?

LinkedIn has grandfathered its old OAuth2 provider. This can only be used by existing apps. New apps have to use the new OIDC provider.

This PR adds a linkedin_oidc provider to core. This will exist alongside the discourse-linkedin-auth plugin, which will be kept for those still using the deprecated provider.

I chose to inline the authenticator for now, because the omniauth-linkedin-oidc gem only supports omniauth >= 2. Once we're done with the OmniAuth upgrade we can choose to keep this inline or switch to the gem.

Does it even work?

Running on my local, authenticating against my own LinkedIn developer app, and using ngrok to expose the callback URL to the internet.

[discoursebot]

This pull request has been mentioned on Discourse Meta. There might be relevant details there:

https://meta.discourse.org/t/sign-in-with-linkedin-method-deprecated-by-linkedin/288164/22

[martin-brennan]

Looks good to me, but yeah might be worth David having a look too because he is very familiar with these auth flows. Also this part:

This will exist alongside the discourse-linkedin-auth plugin, which will be kept for those still using the deprecated provider.

IIRC we still want to get rid of this plugin and move that code into core as another provider right? Could call it linkedin_legacy_authenticator or something.

[Drenmi]

IIRC we still want to get rid of this plugin and move that code into core as another provider right?

I don't think I've seen this mentioned, but given no new customers can use the legacy provider, maybe it's not worth it. Especially since they would need to update their existing setups.

[davidtaylorhq]

IIRC we still want to get rid of this plugin and move that code into core as another provider right?

I don't think I've seen this mentioned, but given no new customers can use the legacy provider, maybe it's not worth it. Especially since they would need to update their existing setups.

Yeah I agree - makes sense to keep the old implementation in the plugin. As soon as this core change is merged, we can introduce an admin warning in the plugin like

⚠️ discourse-linkedin-auth is deprecated. Switch to new provider using instructions on meta

Then we can archive the plugin repo and mark it EOL on Meta.