Implement logging in via external identity providers #4238
Conversation
thepaperpilot
requested review from
dessalines,
phiresky and
Nutomic
as code owners
|
Woodpecker is failing but it works for me locally. I'm not totally sure how to handle the error it's giving. Could one of the reviewers help me out? |
|
CI seems to fail because there is a mismatch between the sql schema and the db struct defined in crates/db_schema/src/source/external_auth.rs. Try running Anyway we are currently busy preparing for the Lemmy 0.19 release, so this will have to wait a while for review. |
crates/db_views/src/structs.rs
Outdated
| /// An external auth view. | ||
| pub struct ExternalAuthView { | ||
| pub external_auth: ExternalAuth, | ||
| } |
There was a problem hiding this comment.
This view seems totally pointless if it only has one field. Why not move the methods into crates/db_schema?
| &local_user_view.local_user.password_encrypted, | ||
| ) | ||
| .unwrap_or(false); | ||
| let valid: bool = local_user_view.local_user.password_encrypted == "" |
There was a problem hiding this comment.
Looks like the password field should be nullable/optional then.
| return HttpResponse::Found() | ||
| .append_header(("Location", "/login?err=internal")) | ||
| .finish(); | ||
| } |
There was a problem hiding this comment.
Why not use ? for error handling? You can customize the response headers based on the error type in crates/utils/src/error.rs. Or make a helper function and use .map_err(). In any case you shouldnt repeat the same error handling over and over, this isnt Go :P
|
We'll be able to look at this in greater detail after the new year. The failing lint means you need to run |
|
Thanks! I plan on also addressing the rest of nutomic's feedback, just haven't been rushing since it's way too late to get into this release. Would it make sense to add that cargo command as a pre commit step? |
|
Cool, no rush.
We used to use Cargo husky to do that (both fmt and clippy), but stopped using it because
So now we just let CI tell you the errors. You can set up your own git pre-commit hook tho. |
| @@ -23,8 +23,10 @@ lemmy_db_views = { workspace = true, features = ["full"] } | |||
| lemmy_db_views_moderator = { workspace = true, features = ["full"] } | |||
| lemmy_db_views_actor = { workspace = true, features = ["full"] } | |||
| lemmy_api_common = { workspace = true, features = ["full"] } | |||
| lemmy_api_crud = { workspace = true } | |||
There was a problem hiding this comment.
Dont do this, it will slow down compilation. Instead move anything that you need from api_crud into api_common.
| pub client_secret: String, | ||
| pub scopes: String, | ||
| pub published: DateTime<Utc>, | ||
| pub updated: Option<DateTime<Utc>>, |
There was a problem hiding this comment.
Can you add comments what all these fields mean? Or a link to documentation?
| diesel::delete(external_auth.find(external_auth_id)) | ||
| .execute(conn) | ||
| .await | ||
| } |
There was a problem hiding this comment.
You can remove this and rely on the trait impl for delete.
|
Outdated, feel free to reopen when you work on it again. |
Description
Implements #2930. I believe #489 is a duplicate of that issue, and would also be considered implemented by this. Note that this does NOT make lemmy itself an identity provider, and thus does NOT implement #1368.
External auth methods can be added via the admin settings, and then buttons are shown on the login page to use those auth methods instead of "basic" auth (username + password). The implementation supports both OAuth or OIDC auth methods, and can register non-existent users as well (if a new setting is explicitly turned on).
Other frontends that wish to support these external auth methods can use the changes in lemmy-ui as a reference. They'll need to show the buttons to go to the authorization URL with the appropriate redirect URI, and then implement the endpoint at that URI that takes the
authcookie and navigates to the redirect URI param it was passed. Optionally, frontends can also implement the new admin settings.Future Work
Most of these are not implemented because my understanding is lemmy-ui is getting replaced soon-ish anyways and these are tasks that would take awhile to implement which is probably not worth it imo.
Related PRs
Screenshots