Add Google OAuth login - Githubissues

V-Sekai / uro

Provides functionality needed to run your V-Sekai backend. It will serve custom game content, support content caching, and provide a user authentication system

https://v-sekai.org

MIT License

8 stars 3 forks source link

Add Google OAuth login #31

Open SaracenOne opened 3 years ago

SaracenOne commented 3 years ago

Status: proposed
Deciders: @SaracenOne
Date: 2021-02-10

Context and Problem Statement

Add support for logging in with a Google account.

Decision Drivers

People don't want to duplicate accounts across the internet.
Easier to secure one account

Considered Options

Support only password and email
Support Google Oauth
Support Google Oauth and others
Double Sign-in - Support only URO OIDC and email password. URO OIDC redirects to a proper Google OAUTH and others.

Decision Outcome

Choose Double Sign-in

Positive Consequences

Single sign on is allowed
Does not hard code the secrets of the Google auth

Negative Consequences

Client has a public token to submit logins
If Google accounts is compromised, the permissions lost is Google oauth defined.

Pros and Cons of the Options

Double Sign-in - Support only URO OIDC and email password.

We click on the Google button to have URO open a brower redirected to Google.

Good, the URO server knows how to contact the proper ODIC identity provider
Good, this allows us the flexibility to not hard code the external ODIC identity providers
Bad, because we have to run a ODIC identity provider
Bad, because the trust is the sum of all the identity provider securities

Support only password and email

We already do this.

Good, because it is the bare minimum for bootstrapping
Bad, because it adds another account system to the players

Support Google Oauth

We add Google oauth.

Good, because Google a widely trusted identity provider
Bad, because Google is only one identity provider
Bad, because keys for the Google provider need to be hard coded.

Support Google Oauth and others

We add Google oauth and others.

Good, because Google is not the only identity provider
Bad, because the trust is the sum of all the identity provider securities
Bad, because keys for the Google provider need to be hard coded.
Bad, because keys for the other IDC providers need to be hard coded.

Links