goth

Thanks, need to make the docs less verbose in some places :-) https://clace.io/docs/configuration/authentication/ lists the supported auth mechanisms for apps. A builtin system account is the default. The OAuth providers supported are : github google digitalocean bitbucket amazon azuread microsoftonline gitlab auth0 okta oidc. Any other provider supported by https://github.com/markbates/goth can be easily added, with a small code change. For admin operations (creating/updating apps) using the client CLI, a unix domain socket is used. No other auth is used for UDS other than the file system level permissions. A REST API for admin operations can be optionally enabled, in which case it will use the system account https://clace.io/docs/configuration/security/#admin-api-acce.... Client cert based auth is not supported currently. Were you wanti

Thanks for sharing. Very nice: - Secure by default (automatic https with letsencrypt, secure cookies) - Sane defaults (No public access unless explicitly added) Curious (not nit picking). What's the high level possibility of allowing keycloak (or another self hosted auth provider)? Looks like you are leveraging goth... fairly simple for someone to extend down the road via a contribution, correct? https://github.com/gnur/tobab/blob/2d1fa1227d1f56ee332d3d83b... Ref - https://github.com/markbates/goth/issues/319

I really like goth https://github.com/markbates/goth

If you're okay with OAuth providers then https://github.com/markbates/goth gives you the capability to handle more than just Google accounts. Otherwise, you're right in that there doesn't exist a 'de facto' auth package for Go like Devise in the Rails world. Part of this is because you can't rely on stuff like ActiveRecord, ActionController, etc. to do some of the heavy lifting for you (Go being just a language, not a framework on its own). FWIW, I'm partway through writing a concise cookie- (and optionally Redis-) backed store that effectively asks you to provide a `User` type that can satisfy `GetID() string` and `IsAdmin() bool` methods. The middleware/lib does most of the work once you call `mypkg.SetUser(yourusertype)` in your login handler. This obviously doesn't cover features such as password reset emails, user registration, etc b