How to setup Lychee Authentication with local and OAuth?

[hhanzo1]

Lychee Authentication (local and OAuth)

Admin

1. Add local Lychee Username (use email address as account name) and Password
2. Set Allow Self-management User Account ticked

User

Local Auth

1. User authenticates with local Lychee Username and Password

2. If user prefers to use their Google account:
   a) Select Profile or U2F
   b) Setup OAuth authentication
   c) Setup Google

3. Logout

OAuth

1. User authenticates with Google by clicking on G
2. Enter Gmail Address and Password
3. Authenticate

User now has the option to either use their local Lychee password or Google password to authenticate with their Username.

[ildyria]

yep that is pretty much it. :)

[hhanzo1]

Thanks for the confirmation.

I initially though the OAuth implementation would let admins add accounts (for example @gmail.com), then users can authenticate via Google OAuth. I'm glad I finally figured it out. :-)

[ildyria]

If there is already an account with the mail, it becomes linked (if I remember correctly).

[hhanzo1]

I couldn't get that to work.

I was creating local Lychee accounts like so: john.doe@gmail.com with no password. I was expecting that if John Doe clicked on the G to authenticate they would be able to do so, but it does not appear to be the case. I did not want to issue an additional password to the user.

A local Lychee account is needed for successful authentication first, then the user can go to Profile/U2F and click on Setup Google within the user profile. An extra step.

Anyway, I'm happy now. Thank you for the support.

[ildyria]

The email is not the same as the username.

[ildyria]

Nevermind: https://github.com/LycheeOrg/Lychee/blob/master/app/Actions/Oauth/Oauth.php#L48 Seems like we directly exit :)