NethVoice: sign in with ns8-idp #8265

NethVoice CTI can already delegate the login to a SAML2 identity provider (#8142), but it cannot use the OIDC provider of the cluster. Users signed in to other cluster applications must type their password again in NethVoice CTI and NethLink.

Proposed solution

• Add oidc to the NethVoice authentication methods, next to password and saml2.
• In the NethVoice settings, select an OIDC provider among those available in the cluster. NethVoice registers its client with register-client.
• The administrator can decide not to use single sign-on, even if a provider is installed: the default authentication method stays password.
• Add an OIDC entry point (for example oauth2-proxy) in front of the existing token-minting route, following the same contract used by the SAML2 implementation: the verified user name is passed to the CTI server, which issues the CTI token without a password.
• The same protections of the SAML2 method apply: local and privileged accounts are always refused over SSO, and the optional user allowlist is honored.
• NethLink and the mobile app use the same login flow already implemented for SAML2.

Alternative solutions

• Keep only SAML2 and configure ns8-idp as a SAML2 provider: possible with Keycloak, but it does not use the cluster OIDC interface, so the configuration stays manual.

Additional context

The SAML2 implementation was designed to accept OIDC later with only a new entry point.

See also

• Parent: Single sign-on for applications with ns8-idp #8258
• NethVoice SAML2 SSO: NethVoice: pluggable authentication methods with SAML2 Single Sign-On #8142
• https://github.com/nethesis/ns8-nethvoice