Zulip + Ory?

[dm17]

vinckr, one of the Ory members, suggested I open a discussion: #275 (comment)

The general question is: what is the best way to add Zulip if I want to keep my Auth setup limited to Ory's offerings. How would you connect them? Zulip docs say, "Zulip allows logging in via email/password as well as various social authentication providers like Google, GitHub, GitLab, and Apple." But don't explicitly state OAuth2 as far as I can see. Any recommendations? I'd like to keep it simple...

[kmherrmann]

https://zulip.readthedocs.io/en/stable/production/authentication-methods.html#openid-connect might help

[ariep]

Yeah, we use Zulip with Hydra via OIDC, that works fine!

[dm17]

@ariep Using a reverse proxy as well? Would be curious to see your docker compose, if so! Thanks.

[ariep]

Yes, in the sense that it runs under kubernetes so everything passes through the ingress controller. Here is our ingress object for zulip (slightly redacted), perhaps you can translate the parts you need to your setup. Not sure if it's helpful though, it's pretty generic.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/tls-acme: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: 25m
  name: zulip
  namespace: stackspin-apps
spec:
  rules:
  - host: zulip.SOMEDOMAIN
    http:
      paths:
      - backend:
          service:
            name: zulip
            port:
              number: 80
        path: /
        pathType: ImplementationSpecific
  tls:
  - hosts:
    - zulip.SOMEDOMAIN
    secretName: stackspin-zulip

Note the kubernetes.io/tls-acme: "true" annotation which gets picked up by cert-manager to acquire the necessary tls cert.