Plans on implementing OIDC client?

[LeVraiRoiDHyrule]

Hi,
AurionMail seems like a fantastic project.
To integrate it into a greater stack, is there plans to implement OIDC client?
It would allow users to authenticate using Authentik or any other IdP.
I would imagine something similar to https://github.com/Timshel/OIDCWarden
Authentication is done with the IdP, and then a master password is required for encryption.

[paulhenry46]

Hi, indeed, that would be a great idea.
After investigating, I think this should be possible, as you described it. I integrated it into the roadmap, thanks for the idea !

[LeVraiRoiDHyrule]

Thanks for your feedback!
I can see that you are already adding docs about this: https://github.com/AurionMail/docs/blob/main/external_sso.md
When it will be available on the docker image ghcr.io/aurionmail/orchestra, I can try the feature and give some feedback. (note: I am new to AurionMail so I might need some time to familiarise with it)

[LeVraiRoiDHyrule]

Hi,
I would have 2 questions:

I can see that you released OIDC support as beta versions for 1.0.12. Thank you very much, I would like to try them.
Would it be possible to also release the corresponding container versions on ghcr.io for those beta versions?

Do you also plan to implement role mapping?
It would be even better to be able to define from OIDC groups (or entitlements in case of Authentik, which is why the best option is to have a variable to define from which OIDC scope roles are read, like what OIDCWarden is doing) which user should be admin or normal user (or any other type of permission there is in AurionMail).

[paulhenry46]

Hi, thanks for your feedbacks and ideas. Indeed, at the moment, it works with binary version, but I prefer testing with Docker before publishing on ghcr ! The most difficult parts works, so I have no doubt it will be available very soon for Docker !

For role mapping, I don't think it will be in next release. Neither bulwarkmail or Cryptpad (which we rely on) natively support this kind of feature, although I have some ideas about how to implement it. So first, i will finish implementing basic external SSO and after I will work on this !

[paulhenry46]

Good news, I got some times to finalize it today ! It is now available in binary as well in Docker. I tested it with Authelia, as it the IdP I use the most. So if you manage to make it working with another IdP and can share the config, don't hesite to open a PR or issue to put it on https://github.com/AurionMail/docs/blob/main/external_sso.md 😉