[feature] overhaul the oidc system

[theSuess]

Since I'm very interested in this topic, I've built a draft to implement my feedback on #763, #917 and #309

This is by no means final, and very much intended as a base for further discussions on these issues.

It works by intercepting the first OIDC callback of a user and returns a small page for customizing the username if no matching user is found. The text field is prefilled with the preferred_username claim.

It also performs validation and checks the DB for colliding usernames

The biggest open topic IMHO is finding a way to migrate existing OIDC setups to the new ExternalID field. I honestly have no idea what would be the best approach here

[theSuess]

I had an idea for a graceful migration path:

• Introduce a config flag to try matching the email to existing users
• If a user already exists for a login request but does not have the externalID set, ask the user if they want to link the account
• If yes, populate the externalID field
• If not, ask the user to provide a new username

What do you think about this?

[theSuess]

I had an idea for a graceful migration path:

* Introduce a config flag to try matching the email to existing users

* If a user already exists for a login request but does _not_ have the externalID set, ask the user if they want to link the account

* If yes, populate the externalID field

* If not, ask the user to provide a new username

What do you think about this?

I've now implemented this (without the step of asking for a new username for now).

With this, we have a migration path for servers already using OIDC

[tsmethurst]

Heya, apologies for being slow to respond to this, it's been rather a hectic week :')

This looks good to me so far! At least, I don't see any glaring issues, but will have to try it out on gts.superseriousbusiness.org (which uses oidc) to see how it works :)

One thing you missed is adding the new config flag to examples/config.yaml, and also updating the documentation here https://github.com/superseriousbusiness/gotosocial/blob/main/docs/configuration/oidc.md.

Once those things are done, I think you can mark this as ready for review and we can have a proper look through it.

Thank you, this is great work!

[theSuess]

No problem, I'm just happy to hack on something not work-related :grin:

I've added the docs and example config. I always seem to forget at least one place when adding new config options :D

Also marked this PR as ready :crossed_fingers:

[tsmethurst]

This looks good to me :) @NyaaaWhatsUpDoc do you also wanna review or nah?

[tsmethurst]

hey @theSuess , can you merge main into this or rebase to resolve the merge conflicts? then i'll look at it afresh

[theSuess]

Rebased and tested

[NyaaaWhatsUpDoc]

I'll take a look at this today too :) sorry I managed to miss your notifications on this @tsmethurst

[tsmethurst]

No worries pal :)

[NyaaaWhatsUpDoc]

I have started to review this, but I have ran out of spoons for the evening, and it is late. I shall get back to it tomorrow evening most likely :)

[tsmethurst]

i suggest we merge this once 0.6.0 is out, so we have time to mess about with it :)

[edit] Also sorry for the constant need for rebases dominik :grimacing: