robrotheram/taiga-back-openid

taiga-contrib-openid-auth

镜像概述和主要用途

taiga-contrib-openid-auth是一个OpenID/Keycloak认证插件，基于https://github.com/taigaio/taiga-contrib-github-auth%E5%BC%80%E5%8F%91%E3%80%82%E8%AF%A5%E6%8F%92%E4%BB%B6%E5%85%BC%E5%AE%B9Taiga 4.2.1、5.x和6版本，主要用于为Taiga项目管理平台提供OpenID和Keycloak认证功能，允许用户通过OpenID或Keycloak身份提供商进行登录。

核心功能和特性

• 多版本兼容：支持Taiga 4.2.1、5.x及6版本
• OpenID/Keycloak集成：提供与OpenID和Keycloak身份认证系统的集成能力
• Docker化部署：与官方Taiga Docker镜像兼容，提供前后端分离的Docker镜像
• 环境变量配置：通过环境变量轻松配置认证参数，无需修改代码
• 自定义支持：允许其他自定义配置继续生效，不影响现有功能

使用场景和适用范围

适用于需要通过OpenID或Keycloak进行用户身份认证的Taiga部署环境，特别适合企业内部使用Keycloak等身份管理系统的场景，可实现统一身份认证和用户管理。

详细的使用方法和配置说明

安装

Docker

该插件与官方Taiga Docker镜像兼容（https://github.com/taigaio/taiga-docker%EF%BC%89%E3%80%82%E9%A1%B9%E7%9B%AE%E6%9E%84%E5%BB%BA%E4%BA%86%E4%B8%A4%E4%B8%AA%E5%9F%BA%E4%BA%8ETaiga%E5%AE%98%E6%96%B9%E9%95%9C%E5%83%8F%E7%9A%84%E9%95%9C%E5%83%8F%EF%BC%8C%E7%A1%AE%E4%BF%9D%E5%85%B6%E4%BB%96%E8%87%AA%E5%AE%9A%E4%B9%89%E9%85%8D%E7%BD%AE%E5%8F%AF%E7%BB%A7%E7%BB%AD%E5%B7%A5%E4%BD%9C%E3%80%82%E4%BB%A5%E4%B8%8B%E6%98%AF%E4%BF%AE%E6%94%B9%E9%BB%98%E8%AE%A4docker-compose%E6%96%87%E4%BB%B6%E4%BB%A5%E5%AE%89%E8%A3%85OpenID%E6%8F%92%E4%BB%B6%E7%9A%84%E6%AD%A5%E9%AA%A4%E3%80%82

配置

镜像信息

提供两个镜像：

• robrotheram/taiga-front-openid：前端镜像
• robrotheram/taiga-back-openid：后端镜像

环境变量配置

通过以下环境变量配置前端conf.json和后端settings.py：

Docker Compose配置示例

基于https://github.com/taigaio/taiga-docker%E4%BF%AE%E6%94%B9%E7%9A%84docker-compose%E6%96%87%E4%BB%B6%EF%BC%9A

yaml
version: "3.5"

x-environment:
  &default-back-environment
  # 数据库设置
  POSTGRES_DB: taiga
  POSTGRES_USER: taiga
  POSTGRES_PASSWORD: taiga
  POSTGRES_HOST: taiga-db
  # Taiga设置
  TAIGA_SECRET_KEY: "taiga-back-secret-key"
  TAIGA_SITES_DOMAIN: "localhost:9000"
  TAIGA_SITES_SCHEME: "http"
  # 邮件设置。取消以下行注释并配置SMTP服务器
  # EMAIL_BACKEND: "django.core.mail.backends.smtp.EmailBackend"
  # DEFAULT_FROM_EMAIL: "no-reply@example.com"
  # EMAIL_USE_TLS: "False"
  # EMAIL_USE_SSL: "False"
  # EMAIL_HOST: "smtp.host.example.com"
  # EMAIL_PORT: 587
  # EMAIL_HOST_USER: "user"
  # EMAIL_HOST_PASSWORD: "password"
  # Rabbitmq设置
  # 应与taiga-async-rabbitmq和taiga-events-rabbitmq中的设置相同
  RABBITMQ_USER: taiga
  RABBITMQ_PASS: taiga
  
  # 遥测设置
  ENABLE_TELEMETRY: "True"
  
  # 启用OpenID时允许注册不存在的用户。设为false以禁用所有注册
  PUBLIC_REGISTER_ENABLED: "True"

  # OpenID设置
  ENABLE_OPENID: "True"
  OPENID_USER_URL : "https://{url-to-keycloak}/auth/realms/{realm}/protocol/openid-connect/userinfo"
  OPENID_TOKEN_URL : "https://{url-to-keycloak}/auth/realms/{realm}/protocol/openid-connect/token"
  OPENID_CLIENT_ID : "<CLient ID>"  # 替换为实际客户端ID
  OPENID_CLIENT_SECRET : "<CLient SECRET>"  # 替换为实际客户端密钥

x-volumes:
  &default-back-volumes
  - taiga-static-data:/taiga-back/static
  - taiga-media-data:/taiga-back/media
  # - ./config.py:/taiga-back/settings/config.py  # 自定义配置文件（可选）


services:
  taiga-db:
    image: postgres:12.3
    environment:
      POSTGRES_DB: taiga
      POSTGRES_USER: taiga
      POSTGRES_PASSWORD: taiga
    volumes:
      - taiga-db-data:/var/lib/postgresql/data
    networks:
      - taiga

  taiga-back:
    image: robrotheram/taiga-back-openid  # 使用OpenID后端镜像
    environment: *default-back-environment
    volumes: *default-back-volumes
    networks:
      - taiga
    depends_on:
      - taiga-db
      - taiga-events-rabbitmq
      - taiga-async-rabbitmq

  taiga-async:
    image: taigaio/taiga-back:latest
    entrypoint: ["/taiga-back/docker/async_entrypoint.sh"]
    environment: *default-back-environment
    volumes: *default-back-volumes
    networks:
      - taiga
    depends_on:
      - taiga-db
      - taiga-back
      - taiga-async-rabbitmq

  taiga-async-rabbitmq:
    image: rabbitmq:3-management-alpine
    environment:
      RABBITMQ_ERLANG_COOKIE: secret-erlang-cookie
      RABBITMQ_DEFAULT_USER: taiga
      RABBITMQ_DEFAULT_PASS: taiga
      RABBITMQ_DEFAULT_VHOST: taiga
    networks:
      - taiga

  taiga-front:
    image: robrotheram/taiga-front-openid  # 使用OpenID前端镜像
    environment:
      TAIGA_URL: "http://localhost:9000"
      TAIGA_WEBSOCKETS_URL: "ws://localhost:9000"
      ENABLE_OPENID: "true"
      OPENID_URL : "https://{url-to-keycloak}/auth/realms/{realm}/protocol/openid-connect/auth"  # 替换为实际认证URL
      OPENID_CLIENT_ID : "<ClientID>"  # 替换为实际客户端ID
      OPENID_NAME: "Name you want to give your openid provider e.g keycloak"  # 替换为实际提供商名称
    networks:
      - taiga
    # volumes:
    #   - ./conf.json:/usr/share/nginx/html/conf.json  # 自定义前端配置（可选）

  taiga-events:
    image: taigaio/taiga-events:latest
    environment:
      RABBITMQ_USER: taiga
      RABBITMQ_PASS: taiga
      TAIGA_SECRET_KEY: "taiga-back-secret-key"
    networks:
      - taiga
    depends_on:
      - taiga-events-rabbitmq

  taiga-events-rabbitmq:
    image: rabbitmq:3-management-alpine
    environment:
      RABBITMQ_ERLANG_COOKIE: secret-erlang-cookie
      RABBITMQ_DEFAULT_USER: taiga
      RABBITMQ_DEFAULT_PASS: taiga
      RABBITMQ_DEFAULT_VHOST: taiga
    networks:
      - taiga

  taiga-protected:
    image: taigaio/taiga-protected:latest
    environment:
      MAX_AGE: 360
      SECRET_KEY: "taiga-back-secret-key"
    networks:
      - taiga

  taiga-gateway:
    image: nginx:1.19-alpine
    ports:
      - "9000:80"
    volumes:
      - ./taiga-gateway/taiga.conf:/etc/nginx/conf.d/default.conf
      - taiga-static-data:/taiga/static
      - taiga-media-data:/taiga/media
    networks:
      - taiga
    depends_on:
      - taiga-front
      - taiga-back
      - taiga-events

volumes:
  taiga-static-data:
  taiga-media-data:
  taiga-db-data:

networks:
  taiga:

注意：使用前需将配置中的占位符（如{url-to-keycloak}、{realm}、<CLient ID>等）替换为实际环境中的值。