Login with generic oauth feature

[echoesactiii]

This aims to add a configurable, generic OAuth client module, so that it can be used with things like Keycloak etc, without needing a separate OAuth client configuration for every provider.

It adds the following ini settings under oauth.generic:

• client_id, client_secret, CallbackProxy, CallbackProxyAPI as usual
• host: The hostname/base URL for the oauth server
• display_name: The display name (defaults to "OAuth")
• token_endpoint, inspect_endpoint, auth_endpoint which will all be different depending on the oauth implementation.

---

• I have signed the CLA

[thebaer]

Thanks for submitting this, @ketudb! This looks really good so far, and will make a great addition to WriteFreely!

Just one thing that stands out so far -- we'll need to add Connect / Disconnect buttons to the Account Settings page. This functionality was added in #243 and originally left out of my tutorial, but I've just updated it. Once you get that part in, we'll do a full review.

[echoesactiii]

This looks really good so far, and will make a great addition to WriteFreely!

Thanks!

Just one thing that stands out so far -- we'll need to add Connect / Disconnect buttons to the Account Settings page.

Sure, I'll bounce back to that. How would you feel about that being optional, with the context that in some circumstances that it could be the required way of logging in?

[thebaer]

How would you feel about that being optional, with the context that in some circumstances that it could be the required way of logging in?

I'm absolutely open to that. Off the top of my head, I think it'd still be worth indicating that the account is connected in the UI, but just preventing people from disconnecting it. What do you think?

Also, I'm not sure if this'll require reworking normal username / password auth. If so, generally speaking, I'd just say that fewer configuration fields == better.

[echoesactiii]

Off the top of my head, I think it'd still be worth indicating that the account is connected in the UI, but just preventing people from disconnecting it. What do you think?

Hmm... yeah that makes sense. I'll have to dig into this again once I rebuild my dev instance.

Also, I'm not sure if this'll require reworking normal username / password auth. If so, generally speaking, I'd just say that fewer configuration fields == better.

I do agree with you! I mostly see the use-case here is being SSO with Keycloak etc, which is the use-case I'm testing this change for/intend to use it for.

[pascoual]

Thanks for this PR @ketudb!
I've tested it on a Hiboo SSO OIDC compliant and using scope "profile" but not "read_user". Can we imagine adding an option to specify the scope to ask ?
After login through SSO the default blog is missing: "This page is missing". Do you encounter the same ? If you want me to look deeper I can.

[thebaer]

This is superseded by #317 -- closing this, and we'll finish up there.