[FEATURE] Map oidc info to custom headers

[adrianipopescu]

Is your feature request related to a problem? Please describe.
I'd like to be able to forward parameters to apps behind tinyauth. This allows tinyauth to act as a much more powerful auth middleware, for example when paired with pocket-id

Describe the solution you'd like
The ability to specify custom labels per target container informing tinyauth what data to send and on what field. Like a key-value map. This would require deployer knowledge of the data path for the user information in oidc response, for example. (If implementing via json path for example)

Describe alternatives you've considered
Just migrating to a more powerful auth provider like authentik or authelia but it's the simplicity that is appealing.

There's also a supplimental approach where I use the user header already passed by tinyauth and do a lookup and fill in the info but that'll end up as proxy -> tinyauth -> lookup -> app. More steps, more brittle.

Additional context
N/A

[steveiliop56]

Not sure if I understand correctly. From my understanding you basically recommend an extra label to some target service, e.g. tinyauth.headers where you can set something like Remote-Email to whatever you like and then when you do a request to that service tinyauth reads the label and adds the headers you specified. Is that right?

[adrianipopescu]

Correct, but didn't want to burden you with the mapping, for example, and suggested that be a lookup of some kind on the user data.

[steveiliop56]

I am thinking something like this tinyauth.headers: Remote-Email=user@example.com,Remote-Name=John Doe, would this be ok?

[adrianipopescu]

excellent for, I think, most if not all apps

[adrianipopescu]

one opinion, if not too much, would be if the values get hardcoded to leave an extension point for later down the road in case someone wante to use variables from the oauth response

[steveiliop56]

I lost you lol. The idea is you set this label to every target service you want and tinyauth will just copy the headers. E.g. if you set Random-Header=something then tinyauth will send back to the app backend Random-Header=something am I understanding correctly? If that's the case that should be very easy to implement.

[adrianipopescu]

Consider this:

Pocket-Id's OIDC implementation supports these claims:

In an ideal state it would be amazing to be able to write a label such as:

Header-Username=Oidc('preferred_username') or Header-Username=Oidc('email') or Header-Username='admin@site.tld' as hardcoded

Sorry for not being specific.

As a "general scenario use-case" and easiest, it's to implement hardcoded. That way for general purpose apps (think Dozzle), you can just send hardcoded data to enable auth

https://dozzle.dev/guide/authentication#forward-proxy

[steveiliop56]

Oh I see. The hardcoded part is easy I can include it in the next release for sure. Now for the oidc not sure how easy it would be. It's definitely something nice and it would be cool if I can integrate it with the OAuth providers so it's the next thing I will be working on.

[adrianipopescu]

Gotcha, we can split this issue in two if you want, or we can keep it as a single one. Your choice.

And thanks!

[steveiliop56]

Let's keep it a single issue for now. I'm crazy so you may see the next release include it 😉. I firstly need to play with pocket id and see how can I parse the responses correctly and if it's easy I may do it all in one go. If it's harder than expected I will split the issue.