Add Google, GitHub or OIDC Sign-In to Your Self-Hosted Dashboard, and Keep It Safe

Описание и применение

Внедрение OAuth/OIDC в самодеплоиментный дашборд Levelrail с ограничением регистрации по домену, автоматическим созданием пользователей с правами только чтения, приглашениями с ролями, входом через device‑code и аудитом действий.

Задача

Implement secure OAuth/OIDC sign‑in for a self‑hosted dashboard while preventing unauthorized access and account takeover.

Результат

OAuth/OIDC integration added with domain‑restricted sign‑ups, read‑only default users, role‑based invites, device‑code CLI login, and audit logging, enhancing security while maintaining usability.

Рабочий процесс

• Register an OAuth app at the provider and set the redirect URI to /api/v1/auth/oauth/PROVIDER/callback
• Enable the provider in Levelrail Settings with client ID, secret, and issuer URL for OIDC
• Restrict sign‑ups by allowed email domain using levelrail-cli settings oauth set
• Understand sign‑in outcomes: linked account, new domain‑allowed user (read‑only), domain‑not‑allowed (403), email conflict (refused)
• Invite teammates via levelrail-cli invites create with role or abilities, ensuring privilege checks
• Enable CLI login with device‑code flow using levelrail-cli auth login --device

Доказательства

Register an OAuth application. You will need to give it a redirect URI, which is the callback path on your dashboard: /api/v1/auth/oauth/PROVIDER/callback

Источник

Each provider has an allowed email domain setting. With it set, a new signup outside that domain gets refused.

Источник

The sign‑in logic has four outcomes, and the choices behind them are deliberate.

Источник