Skip to main content

Allow "simple" OIDC setups for self-hosted instances

Feature Request

Hello!

Is it possible to change the OIDC setup to be “normal”, as in:

  • No domain restrictions (anyone can login using OIDC)

  • No implicit routing to OIDC providers

This would go towards the more common implementation of OIDC sign in, where the security layer is the OIDC provider, and not the application (with domain routing).

This would also imply a change in the login screen, because you’d need to have, like most apps do, two login methods side-by-side — email/password and OIDC providers. With the option to disable password login, if the instance admin only wants OIDC login available.

I am willing to help with a PR for this, if the team is open to it! :)

Thanks!

Posted by Filipe Silva Medeiros ·
2 comments

Log in to comment and vote

Comments2

  • Julien

    Team•

    Jun 15

    Hi Filipe,

    Thanks for the suggestion! Just to make sure we scope this correctly for self-hosted instances: are you mainly asking for a direct “Sign in with OIDC” button on the login page that redirects to the configured OIDC provider, without requiring users to enter an email first and without matching the email domain to an OIDC connection?

    • Filipe Silva Medeiros

      •

      Jun 16

      Indeed! That is exactly right. One of the main points is to allow OIDC login for multiple people that use different email providers (including personal emails such as Gmail). We have an internal OIDC provider that can handle all of that logic. :)