robrotheram/taiga-front-openid

taiga-contrib-openid-auth

镜像概述和主要用途

taiga-contrib-openid-auth是一个为Taiga项目管理平台提供OpenID/Keycloak认证功能的插件。该插件基于taiga-contrib-github-auth开发，兼容Taiga 4.2.1、5.x及6版本，允许用户通过OpenID服务（如Keycloak）进行身份验证并登录Taiga平台。

核心功能和特性

• OpenID认证支持：集成OpenID协议，支持通过Keycloak等OpenID身份提供者进行用户认证
• 兼容性：与Taiga 4.2.1、5.x、6版本兼容
• 基于现有插件：在taiga-contrib-github-auth基础上开发，保持与Taiga生态的一致性
• Docker化部署：提供前端和后端Docker镜像，可无缝集成到官方Taiga Docker部署环境中
• 灵活配置：通过环境变量自定义OpenID服务参数，支持不同OpenID提供者

使用场景和适用范围

• 需要为Taiga平台集成OpenID认证的企业或组织
• 使用Keycloak作为统一身份认证服务的环境
• 希望通过第三方身份提供者管理Taiga用户访问权限的场景
• 基于Docker部署Taiga并需要扩展认证方式的用户

使用方法和配置说明

镜像信息

该插件提供两个Docker镜像，基于官方Taiga镜像构建：

• 前端镜像：robrotheram/taiga-front-openid
• 后端镜像：robrotheram/taiga-back-openid

环境变量配置

通过以下环境变量配置OpenID认证参数：

Docker Compose部署示例

以下是基于官方Taiga Docker Compose配置修改的部署示例，集成OpenID认证插件：

yaml
version: "3.5"

x-environment:
  &default-back-environment
  # 数据库设置
  POSTGRES_DB: taiga
  POSTGRES_USER: taiga
  POSTGRES_PASSWORD: taiga
  POSTGRES_HOST: taiga-db
  # Taiga设置
  TAIGA_SECRET_KEY: "taiga-back-secret-key"
  TAIGA_SITES_DOMAIN: "localhost:9000"
  TAIGA_SITES_SCHEME: "http"
  # 电子邮件设置（如需配置SMTP服务器，请取消以下注释并修改）
  # EMAIL_BACKEND: "django.core.mail.backends.smtp.EmailBackend"
  # DEFAULT_FROM_EMAIL: "no-reply@example.com"
  # EMAIL_USE_TLS: "False"
  # EMAIL_USE_SSL: "False"
  # EMAIL_HOST: "smtp.host.example.com"
  # EMAIL_PORT: 587
  # EMAIL_HOST_USER: "user"
  # EMAIL_HOST_PASSWORD: "password"
  # RabbitMQ设置
  RABBITMQ_USER: taiga
  RABBITMQ_PASS: taiga
  
  # 遥测设置
  ENABLE_TELEMETRY: "True"
  
  # 允许新用户注册（如禁用所有注册，设为False）
  PUBLIC_REGISTER_ENABLED: "True"

  # OpenID设置
  ENABLE_OPENID: "True"
  OPENID_USER_URL : "https://{url-to-keycloak}/auth/realms/{realm}/protocol/openid-connect/userinfo"
  OPENID_TOKEN_URL : "https://{url-to-keycloak}/auth/realms/{realm}/protocol/openid-connect/token"
  OPENID_CLIENT_ID : "<Client ID>"
  OPENID_CLIENT_SECRET : "<Client SECRET>"

x-volumes:
  &default-back-volumes
  - taiga-static-data:/taiga-back/static
  - taiga-media-data:/taiga-back/media
  # - ./config.py:/taiga-back/settings/config.py  # 如需自定义配置文件，取消注释

services:
  taiga-db:
    image: docker.xuanyuan.run/postgres:12.3
    environment:
      POSTGRES_DB: taiga
      POSTGRES_USER: taiga
      POSTGRES_PASSWORD: taiga
    volumes:
      - taiga-db-data:/var/lib/postgresql/data
    networks:
      - taiga

  taiga-back:
    image: docker.xuanyuan.run/robrotheram/taiga-back-openid  # 使用OpenID后端镜像
    environment: *default-back-environment
    volumes: *default-back-volumes
    networks:
      - taiga
    depends_on:
      - taiga-db
      - taiga-events-rabbitmq
      - taiga-async-rabbitmq

  taiga-async:
    image: docker.xuanyuan.run/taigaio/taiga-back:latest
    entrypoint: ["/taiga-back/docker/async_entrypoint.sh"]
    environment: *default-back-environment
    volumes: *default-back-volumes
    networks:
      - taiga
    depends_on:
      - taiga-db
      - taiga-back
      - taiga-async-rabbitmq

  taiga-async-rabbitmq:
    image: docker.xuanyuan.run/rabbitmq:3-management-alpine
    environment:
      RABBITMQ_ERLANG_COOKIE: secret-erlang-cookie
      RABBITMQ_DEFAULT_USER: taiga
      RABBITMQ_DEFAULT_PASS: taiga
      RABBITMQ_DEFAULT_VHOST: taiga
    networks:
      - taiga

  taiga-front:
    image: docker.xuanyuan.run/robrotheram/taiga-front-openid  # 使用OpenID前端镜像
    environment:
      TAIGA_URL: "http://localhost:9000"
      TAIGA_WEBSOCKETS_URL: "ws://localhost:9000"
      ENABLE_OPENID: "true"
      OPENID_URL : "https://{url-to-keycloak}/auth/realms/{realm}/protocol/openid-connect/auth"
      OPENID_CLIENT_ID : "<ClientID>"
      OPENID_NAME: "Keycloak"  # OpenID提供者显示名称
    networks:
      - taiga
    # volumes:
    #   - ./conf.json:/usr/share/nginx/html/conf.json  # 如需自定义前端配置，取消注释

  taiga-events:
    image: docker.xuanyuan.run/taigaio/taiga-events:latest
    environment:
      RABBITMQ_USER: taiga
      RABBITMQ_PASS: taiga
      TAIGA_SECRET_KEY: "taiga-back-secret-key"
    networks:
      - taiga
    depends_on:
      - taiga-events-rabbitmq

  taiga-events-rabbitmq:
    image: docker.xuanyuan.run/rabbitmq:3-management-alpine
    environment:
      RABBITMQ_ERLANG_COOKIE: secret-erlang-cookie
      RABBITMQ_DEFAULT_USER: taiga
      RABBITMQ_DEFAULT_PASS: taiga
      RABBITMQ_DEFAULT_VHOST: taiga
    networks:
      - taiga

  taiga-protected:
    image: docker.xuanyuan.run/taigaio/taiga-protected:latest
    environment:
      MAX_AGE: 360
      SECRET_KEY: "taiga-back-secret-key"
    networks:
      - taiga

  taiga-gateway:
    image: docker.xuanyuan.run/nginx:1.19-alpine
    ports:
      - "9000:80"
    volumes:
      - ./taiga-gateway/taiga.conf:/etc/nginx/conf.d/default.conf
      - taiga-static-data:/taiga/static
      - taiga-media-data:/taiga/media
    networks:
      - taiga
    depends_on:
      - taiga-front
      - taiga-back
      - taiga-events

volumes:
  taiga-static-data:
  taiga-media-data:
  taiga-db-data:

networks:
  taiga:

部署步骤

1. 将上述Docker Compose配置保存为docker-compose.yml
2. 替换配置中的占位符（{url-to-keycloak}、{realm}、<Client ID>、<Client SECRET>等）为实际值
3. 运行docker-compose up -d启动服务
4. 访问http://localhost:9000，Taiga登录页面将显示配置的OpenID认证选项

注意事项

• 确保OpenID服务（如Keycloak）已正确配置，并允许Taiga的回调URL
• PUBLIC_REGISTER_ENABLED设为"True"时，新用户可通过OpenID自动注册；设为"False"时，仅允许已有用户通过OpenID登录
• 如需自定义配置，可挂载配置文件（如后端的config.py或前端的conf.json）