[Feature Request] Support login with OIDC

[michaelhthomas]

Description

Authentication providers like Authelia, Auth0, Authentik, Keycloak, etc. make managing user permissions across selfhosted services much easier.

Desired Behavior

I would like to be able to configure a custom OIDC provider for logins, and have this option appear on the Jellyseer login page. This PR from Overseerr implements support for generic OIDC login. Since OIDC is already supported for Plex SSO, supporting other external authentication services is fairly straightforward.

Additional Context

Here is a screencast from the linked Overseerr PR showing what this feature would look like when implemented.

https://cln.sh/wGbPIdYUKas2QId0cqxw

Code of Conduct

• I agree to follow Overseerr's Code of Conduct

[michaelhthomas]

I'd be happy to try my hand at re-implementing this for Jellyseerr, so long as all are onboard.

[fallenbagel]

I'd be happy to try my hand at re-implementing this for Jellyseerr, so long as all are onboard.

Any help would be much appreciated c:

[michaelhthomas]

@fallenbagel Would you say it's alright to go ahead and remove the Plex OAuth login stuff in here as well? It's intertwined with the authentication logic a little more than I'd like.

[fallenbagel]

@fallenbagel Would you say it's alright to go ahead and remove the Plex OAuth login stuff in here as well? It's intertwined with the authentication logic a little more than I'd like.

If the plex OAuth is removed, wouldn't that remove support for plex?

[michaelhthomas]

Login with Plex, yes. If the goal is to keep that support in place, then I can definitely leave it. I could also see if it's possible to just detangle the Plex login a bit so that it's isolated like the rest of the auth providers.

[fallenbagel]

Login with Plex, yes. If the goal is to keep that support in place, then I can definitely leave it. I could also see if it's possible to just detangle the Plex login a bit so that it's isolated like the rest of the auth providers.

Yeah the goal is for plex to be supported as well

[michaelhthomas]

Got it. I'll try separating plex login into its own component so all the login logic isn't on the main Login component

[ados8]

Testing with Authentik and it fails the OIDC login due to exceeded threshold.

Jellyseerr presents an error to sign in.

My config is as follows:
OIDC Issuer URL: https://auth.domain.com/application/o/jellyseerr/
OIDC Provider Name: Authntik
OIDC Client ID: generated ID from Authntik

[kurokay]

It would be an awesome feature to add !

[largelyinept]

Definitely +1 to the interest here! I use Authentik and would love to more easily and granularly secure my *rr stack

[fallenbagel]

Definitely +1 to the interest here! I use Authentik and would love to more easily and granularly secure my *rr stack

Could you test out the :preview-184 tag. Make sure to not test on your production server

[largelyinept]

Thanks @fallenbagel! I tested a setup with Authentik and it's worked great!
Only thing to note is the oidc-authenticated user is shown as type 'local', and the email (rather than username) is used as displayname (not sure if this is easy to change - I don't really mind all that much)