Messages

Just FYI (without discredeting any of the above efforts) the next business edition in october will include OIDC for WebGUI, Captive Portal and OPNWAF (Apache2 based Web Application Firewall).

So you could get a secure implementation that is supported and maintained by the project directly.

Yeah i was aware and I am utilising some of the initial framework they have added. However, I am using opnsense for my personal internet and do not have a business license. So i created a smaller (and probably less featured) solution for the open source version.

At the time I also thought the SSO was only for the Captive Portal too hehe. Oh well, this solution I made still suits my needs :)

Hello everyone!

Ive been upgrading my homelab to use PocketID SSO where possible for all my logins. I ran into an issue with OPNsense which only supported Single-Password solution. I could have proxied my SSO with a LDAP or Radius server (or just use Authentik), but it was adding extra complexity and not what i wanted (a single button to sign in).

So... I took it amongst myself to implement OpenID Connect into OPNsense as a plugin! It appears as a Access > Servers and will let you configure a OIDC client to login with a single press!

The plugin work flawlessly and in a pretty good state at the moment, however I would like a code review and tell me what I might be missing. Since it is a security related plugin, more eyes the better.

I do also use some _questionable_ hacks to get the custom ui for editing configuration. Im not sure if its worth hacking up the UI with JS or just moving to a seperate menu item and not use the Access > Server menu (which would suck as a UX discoverability perspective).

Anyways, i have it self hosted on my gitea (for super fast FreeBSD CI), but i have a mirror available on GitHub:
https://github.com/Lachee/opnsense-oidc

Please let me know what you think :)