mirror of
https://github.com/plankanban/planka.git
synced 2026-02-25 11:21:03 +03:00
[Feature Request] Google SSO #360
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @XStylus on GitHub (Sep 25, 2023).
I'd like to respectfully request support for Google SSO.
Our team uses Google Workspace, and I'd like to allow users to log in by clicking a "Log in With Google" link, or similar function.
Thank you!
@lorenz commented on GitHub (Oct 19, 2023):
This should work in the next release with my changes to the OIDC implementation in
743f2956c8@meltyshev commented on GitHub (Oct 19, 2023):
Released: https://github.com/plankanban/planka/releases/tag/v1.14.0. Now you can try to set up Google SSO.
@meltyshev commented on GitHub (Oct 19, 2023):
I've just tried setting up SSO via Google, and for some reason
codeis returned in the query parameters rather than in the fragment. But if I try to take thecodefrom the query parameters, everything works fine. Is this a Google problem or am I doing something wrong in the settings?@lorenz commented on GitHub (Oct 19, 2023):
Can you post the authorization request URL used (it doesn't contain any private data)?
@meltyshev commented on GitHub (Oct 19, 2023):
https://accounts.google.com/o/oauth2/v2/auth?client_id=XXX&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Foidc-callback&response_mode=fragmenthttp://localhost:3000/oidc-callback?code=XXX&scope=email+profile+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile+openid&authuser=0&prompt=noneUPD: probably we need to add
response_modeto the env variables and take thecodedepending on the setting, or just always usequeryto cover more providers, but it's hard for me to imagine if there could be security issues withquery.@lorenz commented on GitHub (Oct 19, 2023):
That's really weird, Google should be returning this as a fragment, not a query string. The standard very clearly says that our request is compliant and it is AFAIK mandatory-to-implement for OIDC (but not OAuth 2.0). Google claims to be OIDC certified, but from what I can tell the test suite does not really exercise this.
There is no harm in falling back to also looking at the query parameters if no fragment is available, but this is IMO really on Google.
@meltyshev commented on GitHub (Oct 20, 2023):
Tested and released the fix: https://github.com/plankanban/planka/releases/tag/v1.14.1