Allow to use an external OAuth provider to create accounts

[Ash-Crow]

In order to set up a Mastodon instance for an existing community, I would like to restrict account creation to existing users through OAuth, to avoid account usurpation.

For that, I would like to link registration to an OAuth consumer.

[urchinhead]

When I regist account at another instance, I'd like to use my account of my main used instance. so It's an OAuth provider.

[pierreozoux]

At https://indie.host, we also plan to have a central identity provider, and I'm also missing this functionality.

[pierreozoux]

At https://indie.host, we also plan to have a central identity provider, and I'm also missing this functionality.
We could probably use either:

• https://gitlab.com/satorix/omniauth-oauth2-generic
• https://github.com/discourse/discourse-oauth2-basic

But for sure, there will be some work needed.

[amandasaurus]

I would like this too.

There is https://en.osm.town, an instance for the (english speaking) OpenStreetMap community, and OSM.org provides OAuth for people's OSM accounts. Allowing "sign ups" to en.osm.town using oauth would make new sign ups much easier. "one click mastodon account creation" would be very beneficial.

For en.osm.town, we don't need to require oauth sign ups, merely that it's possible.

[LunaSquee]

Just letting you know there's still demand for this. Thanks :)

[tjormola]

Would be much appreciated, thanks :)

[Gargron]

Mastodon includes the omniauth gem, through which e.g. CAS and SAML systems are connected. Using omniauth it should be possible to support sign up through any OAuth service.

https://github.com/omniauth/omniauth/wiki

However, I don't see how I could make this any easier to integrate since every service requires some level of customization. It might be as easy as adding a new line in here for some: https://github.com/tootsuite/mastodon/blob/master/config/initializers/omniauth.rb I haven't tried.

[legend813]

@Gargron In another Thread, saper refered to this topic here. I don't know how to implement your mentioned solution in my selfhosted mastodon instance. I would really appreciate if you could add some instructions.

[ThisIsMissEm]

We now support OIDC through OmniAuth, and also have a OMNIAUTH_ONLY mode which restricts account access/creation to those through your provider. There's also ONE_CLICK_SSO_LOGIN that changes the sign up / login to just a "login with sso" button.

I think this issue can now be closed.