search

georchestra / georchestra-gateway

GNU General Public License v3.0
0 stars 7 forks source link

Ability to define a default oauth2 service #139

Open jusabatier opened 2 months ago

jusabatier commented 2 months ago

Currently, we can define a 'cas-oauth2' registration service : https://github.com/georchestra/georchestra-gateway/blob/wip-cas-oauth2-provider-rabbitmq/datadir/gateway/gateway.yaml#L219-L234

But when trying to connect, it ask the user to choose the registration service they want to use.

image

I don't think this is user friendly as most of them don't know what it is.

So I think we should have the ability to define a default registration service to use for /login route. For the default conf it should use '/oauth2/authorization/cas-oauth2'

pmauduit commented 2 months ago

We have some customers who need to be able to use several identity providers, for example:

Screenshot from 2024-08-27 10-41-50

It is not uncommon actually to be able to select external identity providers on online services these days, but "cas-oauth2" is not that meaningful, for sure.

and the login template can be modified to disambiguate things, as on the previous screenshot, see the documentation here: https://github.com/georchestra/georchestra-gateway/blob/main/docs/ui-customization.adoc

Also, having a default login provider could be a feature, but I wonder if it could already been implemented by a configuration of the front webserver (catching '?login' and redirect to /login/oauth2/myprovider or so)

jusabatier commented 2 months ago

I don't mean to totally disable the provider selection mechanism, but to add the ability (optional) to define a default one that is selected instead of prompt final user.

I agree that some platforms may want to use multiple providers, but for those with only CAS, it's not userfriendly to select the provider in a list of one.