Add Google, GitHub or OIDC Sign-In to Your Self-Hosted Dashboard, and Keep It Safe

说明与用途

在自托管的 Levelrail 仪表盘中实现 OAuth/OIDC，限制按域名注册，自动创建只读用户，基于角色的邀请，使用 device‑code 进行 CLI 登录，并记录审计日志。

问题

Implement secure OAuth/OIDC sign‑in for a self‑hosted dashboard while preventing unauthorized access and account takeover.

结果

OAuth/OIDC integration added with domain‑restricted sign‑ups, read‑only default users, role‑based invites, device‑code CLI login, and audit logging, enhancing security while maintaining usability.

工作流

• Register an OAuth app at the provider and set the redirect URI to /api/v1/auth/oauth/PROVIDER/callback
• Enable the provider in Levelrail Settings with client ID, secret, and issuer URL for OIDC
• Restrict sign‑ups by allowed email domain using levelrail-cli settings oauth set
• Understand sign‑in outcomes: linked account, new domain‑allowed user (read‑only), domain‑not‑allowed (403), email conflict (refused)
• Invite teammates via levelrail-cli invites create with role or abilities, ensuring privilege checks
• Enable CLI login with device‑code flow using levelrail-cli auth login --device

证据

Register an OAuth application. You will need to give it a redirect URI, which is the callback path on your dashboard: /api/v1/auth/oauth/PROVIDER/callback

来源

Each provider has an allowed email domain setting. With it set, a new signup outside that domain gets refused.

来源

The sign‑in logic has four outcomes, and the choices behind them are deliberate.

来源