LocalCrag SSO

[dorthrithil]

Can we provide some sort of SSO option to have a single sign on across multiple LC instances? Constrains would be:

• Optional. An instance can decide if it supports LC SSO or not
• Only share userinfo + avatar across instances
• Support both at once: local users and SSO users
• Add means to convert user to SSO user / attach an existing user to an SSO login

Is this all possible with e.g. keycloak?

[BlobbyBob]

This should definitely be possible, although I don't know whether we need Keycloak for that. At first, I would suggest a more federated approach based on OpenID Connect with an approximate workflow to this:

1. A user logs in with a username that is somehow identified as external
2. If the external LC instance is not known, OIDC service discovery and client registration are performed ad-hoc
3. OAuth 2.0 authentication procedure is performed

This would mean

1. LC instances need to get OIDC Provider functionality
2. LC instances need to get OIDC relying party (RP) functionality
3. The user could use any OIDC Provider with service discovery for authentication

An open question for me is how to design the workflow to appropriately convert a local user to SSO and vice versa.
Additionally, LocalCrag instances might not be the most reliable services in that they could vanish over time, effectively rendering SSO logins through them impossible. This would require some kind of additional account recovery mechanism.
Maybe we could fetch the user's email through OIDC and use that as foundation for SSO account recovery?

Switching to Keycloak afterwards if we want easy integration of, for example, 3rd party SSO services would be easily implemented as it supports OIDC.