New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Is it possible for Netlify CMS to simply authenticate directly with GitHub? #663

Closed
nottrobin opened this Issue Oct 8, 2017 · 6 comments

Comments

Projects
None yet
4 participants
@nottrobin
Copy link

nottrobin commented Oct 8, 2017

I love the simplicity of static sites, and for a while now I've been meaning to play around with creating a CMS-like interface for allowing content editors to edit a Jekyll site in a markdown repository.

Then I found Netlify CMS and it looked like you'd solved the exact problem I was interested in - providing an admin area as a single-page application, where users can authenticate through OAuth and then edit the pages in a CMS interface, committing back to the repository when changes are saved.

But after looking into it for a while, I've found that actually the solution provided is rather unsatifying, because in fact I need to use Netlify as my OAuth backend for this to work (even if I can it to be a proxy user-management to GitHub). I can't simply let my users authenticate with GitHub.

From #37:

Currently the GitHub backend depends on netlify's Authentication Provider system ...
We do want to see other OAuth services enabled as well so there's no dependency on netlify.

This significantly complicated the problem space, by adding in a dependent service. For most users, this seems like an unnecessary complication.

My question is, is there a good reason why the Netlify CMS didn't implement the much more obvious solution first, and authenticate directly with GitHub? This must surely have been the first thing that would have occurred to anyone trying to solve this problem. Is there a technical limitation with GitHub's OAuth API that prevents this? Or has it simply been done this way to support Netlify's pricing model by encouraging people to use Netlify as a service?

@nottrobin

This comment has been minimized.

Copy link

nottrobin commented Oct 8, 2017

Perhaps I'm misunderstanding the way OAuth works? Perhaps it needs some back-end functionality on the same domain? I just kinda thought the whole point of OAuth is that the client could authenticate with a third party service.

@nottrobin

This comment has been minimized.

Copy link

nottrobin commented Oct 8, 2017

Okay I've answered my question by reading about OAuth flows: implicit grant and discovering that GitHub explicitly doesn't support implicit grant.

This means that there needs to be a server-side component to any application that wants to talk to GitHub's API through OAuth. And Netlify offers such a server-side component, and I also have the option of running one myself. Now this makes sense - Netlify hasn't made the problem more complicated than it has to be, it simply has to be this complicated.

@tech4him1

This comment has been minimized.

Copy link
Collaborator

tech4him1 commented Oct 8, 2017

@nottrobin Yes, that is pretty much why it works like it does. Let us know if you have any more questions!

@Benaiah

This comment has been minimized.

Copy link
Contributor

Benaiah commented Oct 9, 2017

@nottrobin note that it is possible to set up the CMS without Netlify specifically - there’s a brief guide here.

@jimafisk

This comment has been minimized.

Copy link

jimafisk commented Dec 22, 2017

@Benaiah the guide you referenced is missing, any chance it still exists somewhere? Netlify is a great service, but I think this project would have a better chance of gaining traction if it was more clear how to set up independent of a specific host.

@nottrobin I've been really curious about the same thing! It looks like GitLab supports implicit flow. People have also been working on allowing GitLab to be used as the backend for NetlifyCMS: #57

@tech4him1

This comment has been minimized.

Copy link
Collaborator

tech4him1 commented Dec 22, 2017

@jimafisk Our new authentication docs are at https://www.netlifycms.org/docs/authentication-backends/.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment