Feature Request: GibbonCore as OIDC Service Provider for SSO

[OZORDI]

Describe the Bug

I know this isnt a bug, but the request a feature forum is down. Would it be possible to create custom auth methods for Gibbon? Like SAML and OIDC is really all thats left for me to migrate to Gibbon. Ive evaluated several SIS and I prefer this the most because its OSS but POwerSchool is the only one with OIDC and SAML support and id rather not use them.

Or is there a workaround that would let me use my idp with Gibbon?

To Reproduce

None

Expected behavior

None

Actual behavior

None

Screenshots

No response

Gibbon version

No response

Browser

None

Browser Version

No response

Additional Context

No response

[SKuipers]

Hi @OZORDI We'd be happy to explore some possible options here. In recent years we refactored the whole login system in Gibbon to use the Aura/Auth library in PHP, which offers more standardizes authentication gateways. Through this, we've implemented OAuth through Google and Microsoft, however the System Admin > Third Party Settings page also supports generic OAuth endpoints. Have you had a chance to try this with your OIDC provider? Otherwise, we can look at what changes would be needed to add the OIDC connection settings.

We haven't built a SAML adapter yet, but would be open to schools wanting to work on this. A community developer made an LDAP connector, and although they hadn't finished it, it looks like this is very close to functional as well. Our development team is very small, but we'd be happy to collaborate on any of these kinds of changes, if you have any development capacity on your end.

[yookoala]

By OIDC, I believe @OZORDI meant OpenID Connect, an extension to OAuth2 for providing authentication, authorisation and user information.

Correct me if I'm wrong, I think Gibbon currently act as an OAuth2 application that can have people login from other OAuth2 provider (e.g. Google Suite). And @OZORDI is asking if Gibbon can be an OAuth2 provider with extra support that are specified by OIDC specification.

So if this feature is implemented, other web application (of a school) may use Gibbon as a school's centralised login / SSO system. User are redirected to Gibbon to fill-in username / password and then redirect back to the application with user information for that specific application.

[SKuipers]

Thanks @yookoala for this clarification. In this case, its not something Gibbon does by default, but I think a developer could certainly add this functionality through a custom module if they were inclined. Otherwise, if the aim was to use an existing IDP (LDAP or Active Directory) with Gibbon, then this is more possible with the above mentioned auth connectors.