[feature]: SSO/SAML and LDAP auth

[rush-skills]

Is there an existing issue for this?

• I have searched the existing issues

Summary

According to https://plane.so/pricing and #1211
SSO/SAML will be present in the open-source self-hosted version of plane.
Do we have any timeline on when that might be ready?

Also, does Plane support LDAP auth? Can it be easily added - is the auth engine flexible or easily to work around with?

Why should this be worked on?

Adding SSO login support enables much easier integration with existing IAM solutions present inside firms and thus adding this crucial feature will make it ready to be used by our team in my $DAYJOB

[torbenraab]

Hey there, just added a PR for SSO with OIDC which resolves Issue #413. I think I can look into SAML and/or LDAP soon.

[rush-skills]

@torbenraab Thanks, I will look into that PR to see if it helps me understand how to go about the integration. Ideally, I want to add tequila auth to Plane for my $DAYJOB usage, which has a Django auth module present at https://github.com/epfl-si/django-tequila.

I have been trying to add this to the Django app, but can't get it to work as I desired (I wanted the login page to automatically redirect to tequila for auth and use the redirect to get the user info and login).

I have started some work at #1337, and would love if someone can guide me through integrating and enabling the tequila auth properly. I think I will need to add the configs to .env and another flag to enable/disable this mode, but any help on what I am missing would be greatly appreciated.

[torbenraab]

@rush-skills Does Tequila support OIDC? Then maybe the best option is to go with my PR. I just implemented the option to do the login automatically via OIDC if the variable is set to.
P.S. auto redirect is what we also needed for better user friendliness

[rush-skills]

Hey @torbenraab
Thanks for the OIDC work. I have been experimenting with that to test our OIDC provider (SWITCH).
I have eventually given up on tequila integration (that was halfway done) because I don't think a lot of people use it and it adds unnecessary complexity to the code base.
I have now added LDAP support in #1446 which works for me now

[Alexander-creator333]

Hi all.
I'm setting up plane authorization via Keycloak using saml-sso.
In PLANE I included the following options:

web/.env
NEXT_PUBLIC_ENABLE_OAUTH=1
NEXT_PUBLIC_DEPLOY_URL="https://oauth.my.domain/realms/plane-sso/protocol/saml/clients/plane.my.domain"

space/.env
NEXT_PUBLIC_ENABLE_OAUTH=1

Authorization on the keycloak server passes and redirects to the PLANE page, where it says that authorization failed.
Tell me where I went wrong?

[torbenraab]

@Alexander-creator333 Hey, just reworked my OpenID Connect PR and the new can be found as #3341 please try it with the new code

[kfkawalec]

When can we expect this to be ready? :)

[Brukkil]

+1
Very want to integrate Authentik with Plane so all users will in one place

[athornfam2]

Would like to add LDAP support to this. Might be an easy one to dash out as bookstack has native LDAP integration in place using docker.

[Brukkil]

From my side SAML is preferred
It's easy to granulate access at user creation step
Just my things

[jrndberg]

+1
Would really appreciate OpenID