mirror of
https://github.com/pocket-id/pocket-id.git
synced 2025-12-10 01:10:42 +03:00
🚀 Feature: Ability for users to set a profile picture #452
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @acidRain-burns on GitHub.
Feature description
Allow users to set and change their profile picture, and allow this to be provided to client applications when requested. A simple input like what is already offered for OIDC Client settings should suffice. If it makes more sense or is too much overhead, allowing users to set their own URL or letting server owners set their own avatar service might be a better option.
Pitch
There are many client applications Pocket ID is working really well for, and many of them have profile picture imports. It would be nice for people to be able to set their picture once, and have it show up everywhere without them or I needing to mess with Gravatar (though the inclusion of Gravatar is a great feature!).
@simono41 commented on GitHub:
Try version 1.0 of Homarr. I had seen that there.
https://github.com/homarr-labs/homarr
@simono41 commented on GitHub:
As far as I know homarr uses this profile picture import function.
@stonith404 commented on GitHub:
I'm working on this feature at the moment but I'm unsure how I should handle the authorization for the profile picture URL. Should the URL be accessible publicly or only with an access token?
Do you have a few examples of client applications that support importing the profile picture from an OIDC Provider? This would help me to decide how I should handle the authorization.
@stonith404 commented on GitHub:
@simono41 I've tried Homarr 1.0 and also looked into the code but I don't think they support it. Are you sure that the profile image was taken from the OIDC provider. Which OIDC provider do you use?
@stonith404 commented on GitHub:
@simono41 Thanks, I've checked it out but it seems Homarr doesn't use the profile pictures of the OIDC provider.
@simono41 commented on GitHub:
I'm sorry
I thought they would support this because I can't upload a profile picture there. I looked again on the internet and with Gitlab it should be possible by having the profile picture as a URL (i.e. publicly available without authentication) in the user info, but it can also be included in the ID token (don't know exactly what that is).
https://docs.gitlab.com/ee/integration/openid_connect_provider.html
@stonith404 commented on GitHub:
@simono41 Thanks. Yeah the profile picture URL is accessible without authentication. In GitLab this makes sense as the profile picture can be viewed without an account.
However, since Pocket ID is not a public service, it probably makes more sense to protect the profile picture endpoint. The challenge I’m facing is figuring out the best way to secure it, especially since I’m not entirely sure how clients will be accessing the profile pictures.
@stonith404 commented on GitHub:
@acidRain-burns Thanks for the example. The application downloads the image on sign in. If you have other examples it would be great if you can share them.
If every client application downloads the profile image on sign in, I could just create a link that's only valid for a short time period. But I suspect that there are client applications that directly use the profile picture URL without downloading the image.
@acidRain-burns commented on GitHub:
Personally, I'm not too concerned about the profile pictures being publicly available; but all my services have access to the same private network and reverse proxy.
Sorry this took so long to respond to though; I can track down a few more but here is how KitchenOwl does the import:
8da1fb8aa3/backend/app/controller/auth/auth_controller.py (L386)Let me know if you need more / different examples.
@33Fraise33 commented on GitHub:
2 things that pop up:
@kmendell commented on GitHub:
@stonith404 jpegPhoto from ldap is the actual image data itself stored in ldap as far as i know.
Ill test this feature later today once i get back home.
@helmut72 commented on GitHub:
Nextcloud also supports profile picture from OIDC. Have tried it with Zitadel.
Would be cool if profile picture is used from
jpegPhotoattribute if LDAP is used for user management. Then, user does have a single place to change his profile picture.@acidRain-burns commented on GitHub:
I'd like it if pocket could supply the picture, but being able to set another URL works too. It might be too many options to have both, so if I had to chose only one I'd pick letting users upload them, but I think your suggestion is a great one @33Fraise33; I know I can make it work for my deployment.
@stonith404 commented on GitHub:
@helmut72 Is
jpegPhotoan actual image or a link?@stonith404 commented on GitHub:
I'm almost done. In case someone wants to test it you can use the
ghcr.io/pocket-id/pocket-id:developmentimage.@helmut72 commented on GitHub:
jpegPhoto is a base64 encoded attribute:
https://www.openldap.org/faq/data/cache/165.html