Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement SSO via OIDC #127

Draft
wants to merge 10 commits into
base: next
Choose a base branch
from
Draft

Conversation

evan-goode
Copy link
Member

Remaining work is hinted by some TODO comments. I'll make a checklist here too once I get a little farther. Login still unimplemented (only registration works). I'd like to get this in before releasing 3.0.0 due to the API and config schema changes.

I decided to go with https://github.com/zitadel/oidc instead of https://github.com/coreos/go-oidc since the former can implement an OIDC IDP ("server") as well as an RP ("client"), in case we want/need to become an IDP in the future.

For #39

Remaining work is hinted by some TODO comments. Login still
unimplemented (only registration works).

For unmojang#39
@evan-goode
Copy link
Member Author

evan-goode commented Jan 11, 2025

  • Login
  • Registration as new player
  • Registration from existing player
  • Actually verify ID tokens in CreateUser
  • Support invites
  • Link existing account
    • By username/password
    • By authenticating with another OIDC provider?
  • API
    • Allow creating OIDC-provided accounts
    • Get OIDC info about a user
  • Support multiple browser tokens per user?
  • Gracefully deprecate old config options
    • RegistrationNewPlayer.AllowchoosingUUID
    • RegistrationExistingPlayer.Nickname
    • RegistrationExistingPlayer.AccountURL
    • RegistrationExistingPlayer.SessionURL
    • RegistrationExistingPlayer.SetSkinURL
    • RegistrationExistingPlayer.RequireSkinVerification
  • Config option to allow/disallow setting passwords
  • Config option to allow/disallow password login
  • Config option to allow/disallow linking multiple OIDC accounts? Gitea for example allows this.
  • Preserve destination parameter during login using state cookie
  • PKCE support (probably a bool config option for now)
  • Encrypt ID token cookie?
  • UI changes under /web/user
  • "Minecraft passwords"
  • Docs
  • Tests

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant