User Management: OpenID support (or SAML)

[olivierlambert]

That would be cool to get login working via an OpenID provider (using SSO in short, with Keycloak for example).

I know that keycloak-js can do it (https://www.keycloak.org/securing-apps/vue is a complete walk-through), or even https://www.npmjs.com/package/vue-oidc-client as a more generic one. There's also https://github.com/openid/AppAuth-JS

I'm not fluent enough in Vue, but I can do the tests for you on a dedicated branch if you like 👍

[eldiaboloz]

Not exactly what you want, but if you put the service behind oauth2-proxy and then disable auth in uptime-kuma, you can integrate with keycloak and all other oauth2 providers that oauth2-proxy supports.
This will become a problem if there is support for more than one user in the future, but for now works great.

[olivierlambert]

Thanks! That's interesting but I'd like to have the status page public, and be able to login for the dashboard (as now, but with Oauth).

Is that doable with oauth2-proxy?

[eldiaboloz]

Yes it is possible - the authetication is done in keycloak only. You need to set only which group from keycloak has access
OAUTH2_PROXY_KEYCLOAK_GROUPS: /some-group
For the public status page you need to allow some urls:
OAUTH2_PROXY_SKIP_AUTH_REGEX=(/status|/assets/.*|/icon.svg)
Here is more documentation on using keycloak provider in oauth2-proxy
There is a little difference if you use env variables ( via docker ) or cfg file

[jack1902]

another alternative would be to use something like https://github.com/pomerium/pomerium (there are a few but this is one i have used in the past)

[olivierlambert]

FYI @eldiaboloz it works with this solution for now. Even if I'd like "real" OpenID integration, this is enough for my use case 👍

[oussjarrousse]

I think adding SSO integration (OAuth or SAML) would make this APP much more interesting for small businesses and small organisations, who already have a weak IT-department and trouble managing credentials...

[Maven35]

+1 i am looking for SSO integration at least either OIDC or SAML since I run keycloak in my environment

[Daemonslayer2048]

If it matters at all, I also would find (basic) SAML or OIDC support useful

[xgaia]

I'm interested to the openID support to, and I'm interested to implement the functionality. @louislam , do you accept PR for this ?

[piepmax]

FYI @eldiaboloz it works with this solution for now. Even if I'd like "real" OpenID integration, this is enough for my use case 👍

could you please post the relevant part of your docker-compose-file?
I always get a 404 of the oauth2-proxy.

[olivierlambert]

I'm not using Docker at all.

[piepmax]

I'm not using Docker at all.
Thanks!
Maybe @eldiaboloz has a hint?

[eldiaboloz]

@maxulm
Here is my working example with cleaned up "secrets" and my domain name.

I think i ended using cfg instead of .env because the skip_auth_routes needs to be an array and the regex was getting too complex to read

[piepmax]

@maxulm Here is my working example with cleaned up "secrets" and my domain name.

I think i ended using cfg instead of .env because the skip_auth_routes needs to be an array and the regex was getting too complex to read

Thanks a lot!