SSO support (OAuth2/OIDC, LDAP)

[jhbruhn]

Is your feature request related to a problem? Please describe.
Managing users for a server which provides multiple services (Mastodon, Matrix, bookwyrm) gets tedious without a central user store. This can be solved by using exactly that and simplifying login using SSO.

Describe the solution you'd like
It would be nice to be able to Sign in (and create if needed) users using the OpenID Connect standard.

Describe alternatives you've considered
Alternatively, backing the user store using LDAP could be an option, but is less preferred because a proper SSO solution can be more secure (2FA) and streamlined.

[loleg]

In particular, being able to login through the Fediverse would be a good start. A combination of Mastodon OAuth and Django OAuth Toolkit would do this.

[osresearch]

I've built docker files to allow https://v.st/ to run mastodon, matrix, pixelfed, hedgedocs, grafana, and gitea with a common SSO and would like to also support bookwyrm. It seems that every one of those uses a different implementation language and framework for user auth, so... yeah, it's just a simple matter of programming. It looks like django has a OIDC interface that might be possible to integrate with the login flow: https://mozilla-django-oidc.readthedocs.io/en/stable/installation.html#quick-start

[osresearch]

I have hacked together a draft pull request that enables SSO and works with my keycloak configuration #2464

[osresearch]

The patches now support assigning roles via Keycloak, so it is now possible to administer the system via SSO created accounts. The PR is ready for deeper review from someone more familiar with django and the rest of the bookwyrm code tree.

[jhbruhn]

How is the state of this? I would love to run a BookWyrm instance which can authenticate with my local Keycloak installation.