Idea / Feature request: Generic OIDC / SSO support

[darkymehdi]

Hi!

First of all, great work on GyroidVault, the project looks really polished and is exactly the kind of self-hosted 3D model library I was looking for.

Would you consider adding generic OpenID Connect (OIDC) authentication support?

This would allow GyroidVault to integrate with identity providers such as:

Authentik
Keycloak
Authelia

Ideally:

Generic OIDC discovery via an issuer URL
Authorization Code Flow + PKCE
Automatic/JIT user provisioning on first login
Match existing users by email
Optional group/claim mapping to GyroidVault roles:
Admin
Uploader
Viewer
Option to keep local authentication enabled as a fallback
Optional "force SSO" mode to disable local login for normal users

Example configuration could look something like:

OIDC_ENABLED=true
OIDC_ISSUER=https://auth.example.com/application/o/gyroidvault/
OIDC_CLIENT_ID=gyroidvault
OIDC_CLIENT_SECRET=...
OIDC_SCOPES=openid profile email groups

OIDC_ADMIN_GROUP=gyroidvault-admin
OIDC_UPLOADER_GROUP=gyroidvault-uploader
OIDC_VIEWER_GROUP=gyroidvault-users

OIDC_AUTO_PROVISION=true
OIDC_FORCE_LOGIN=false
Why?

GyroidVault already has multi-user support and roles, so OIDC would make it much easier to integrate into self-hosted environments where authentication is centralized.

In my case, I use Authentik as the identity provider for most of my self-hosted applications, and native OIDC support would allow GyroidVault to integrate cleanly without putting a Forward Auth proxy in front of it and still requiring a second GyroidVault login.

Even an initial implementation with just:

OIDC login + JIT provisioning + Admin/User mapping

would already be extremely useful.

Thanks for considering it!

[TeeCodeDev]

Thank you for the idea. Sounds great! I will add it to the roadmap!

[TeeCodeDev]

It is here! I have just released version 2.3.0 were OIDC / SSO Support is added.

[darkymehdi]

Thanks a lot !