Implement OAUTH, SAML, Social Login

[ykorzikowski]

Django All-Auth already support a huge list of social providers.

https://django-allauth.readthedocs.io/en/latest/providers.html#keycloak

Make it possible to login via keycloak, google etc.

[bruno-lopes]

That would be very nice! This way, it would be possible to have single sign-on with other applications.

[Marv93]

The django-allauth link is deprecated. https://docs.allauth.org/en/latest/index.html is the current link to the documentation.

[QuestOAuth74]

It appears there are few developers assisting with this project. I really wish we had more updates. This is such a wonderful web app.

[stp14]

I feel like I'm really close on this. I've got django-allauth installed (version 0.56.0), and (based on this documentation) I've tried the following in my settings.py:

SOCIALACCOUNT_PROVIDERS = {
    "openid_connect": {
        "APPS": [
          {
            "provider_id": "keycloak",
            "name": "Keycloak",
            "client_id": "<mediacms client  id>",
            "secret": "<mediacms keycloak client secret>",
            "settings": {
              "server_url": "https://keycloak.<domain>/realms/<realm>/.well-known/openid-configuration",
            },
          }
        ],
        "SCOPE": [
            "profile",
            "email",
        ],
    }
}

...but since it says Keycloak was removed in favor of generic OpenID Connect, I tried this based on the OIDC documentation:

SOCIALACCOUNT_PROVIDERS = {
    "openid_connect": {
        "OAUTH_PKCE_ENABLED": True,
        "APPS": [
            {
                "provider_id": "keycloak",
                "name": "Keycloak",
                "client_id": "<mediacms client id>",
                "secret": "<mediacms keycloak client secret>",
                "settings": {
                    "server_url": "https://keycloak.<domain>>",
                    "oauth_pkce_enabled": True,
                },
            },
        ],
        "SCOPE": [
            "profile",
            "email",
        ],
    }
}

Neither of those results in the Social applications section being populated in my MediaCMS instance, after restarting the container and running python manage.py migrate (just in case)

I have GLOBAL_LOGIN_REQUIRED = True set, so I made the fix noted in #1093

I also added "allauth.account.middleware.AccountMiddleware", under MIDDLEWARE = [ in my settings.py because it yelled at me that it was required. If I put it on the first line under MIDDLEWARE = [ that seemed to break the GLOBAL_LOGIN_REQUIRED fix... so I moved it toward the bottom of the list. List looks like this now:

MIDDLEWARE = [
    "django.middleware.security.SecurityMiddleware",
    "django.contrib.sessions.middleware.SessionMiddleware",
    "django.middleware.locale.LocaleMiddleware",
    "django.middleware.common.CommonMiddleware",
    "django.middleware.csrf.CsrfViewMiddleware",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "django.contrib.messages.middleware.MessageMiddleware",
    "django.middleware.clickjacking.XFrameOptionsMiddleware",
    "allauth.account.middleware.AccountMiddleware",
    "debug_toolbar.middleware.DebugToolbarMiddleware",
]

Also, in my settings.py:

AUTHENTICATION_BACKENDS = (
    "django.contrib.auth.backends.ModelBackend",
    "allauth.account.auth_backends.AuthenticationBackend",
)

So even if I can't pre-populate "Social Account" login in the settings file, I hoped maybe I could add it through the GUI. So I can navigate to https://mediacms.<domain>/admin/socialaccount/socialapp/add/ and go through that process to add Keycloak, as seen here:

It then shows in the https://mediacms.<domain>/admin/socialaccount/socialapp/ buuuuut...

Even after all this, I don't see any option to log in with my "social provider" when I log out. So it may be that adding it via the GUI is working and I just can't get to the button to log in with Keycloak? I can't find any setting to activate/show that button.

Also I see several discussions about this (#693 is one) so I hope somebody can give me that last nudge to get it working.