OAuth login with multiple providers

[skfh82]

Is it possible in Quarks to have a flow where:

1. User accesses a protected resource
2. They are taken to a login page where the user chooses their authentication provider such as Google, Facebook, Keycloak etc.
3. User logs in and are taken back to their target page

Is there any documentation on this?

[sberyozkin]

@skfh82, This is how you can handle it in Quarkus:

1. Use OIDC Multitenancy. The idea there is that you define multiple configurations, one per each provider, and a tenant resolver selects the correct configuration based on the current request properties, for example, if the request is made to /service/google then pick up the configuration required to authenticate with Google, if it is /services/github - then select the configuration required to authenticate to GitHub, etc. You can see this approach in action in Quarkus Renarde

2. Use a single provider such as Keycloak which can federate to a selected 3rd party provider like Google/etc, the idea there is that SPA sends a hint such as kc_idp_hint=google to Quarkus OIDC web-app which will forward it to Keycloak, this option is only supported on the main branch and will be available in 2.15.0.Final.

@viswatejan, can you please add some information re the option 2 ?

Thanks

[viswatejan]

@sberyozkin covered it pretty much.

If you have more apps to secure it with multiple social providers (like google, facebook, etc) in addition to Keycloak, second option will be best as you do not need to configure each app with each social identity provider. You can register all the social identity providers in Keycloak once and just provide the Keycloak OIDC configuration in your app. This will give your app the capability to redirect to Keycloak login page where you can either login through Keycloak credentials or choose a preferred social provider. This will also give you the option to force authentication with any Keycloak registered identity provider by passing kc_idp_hint query param to your application URL.

[sberyozkin]

@viswatejan Thanks