Feature Request: Support for OIDC / Keycloak Integration for Centralized Identity Management #194

New Issue

MrUnknownDE · 2026-04-05T16:15:57+02:00

MrUnknownDE commented

2026-04-05 16:15:57 +02:00

Originally created by @diegosarina on 1/24/2026

Problem Statement: Currently, Databasus manages users and roles internally. For organizations with multiple tools, this creates "identity silos," requiring manual user provisioning, deprovisioning, and password management within the application itself.

The Case for OIDC (Keycloak): Implementing an OpenID Connect (OIDC) client would allow Databasus to integrate with enterprise identity providers like Keycloak, Okta, or Authelia.

Centralized Access Control: Admins can manage who has access to Databasus from a single point (SSO).
Security: Offload MFA (Multi-Factor Authentication) and password policies to a dedicated IAM (Identity and Access Management) tool.
Onboarding/Offboarding: Automatically grant or revoke access when a member joins or leaves the company via OIDC groups/claims.
Scalability: Essential for DevOps teams managing multiple environments where local user management becomes unfeasible.

Suggested Implementation: Add configuration flags (or environment variables) for OIDC_ISSUER_URL, OIDC_CLIENT_ID, and OIDC_CLIENT_SECRET. Mapping OIDC groups to Databasus Workspaces/Roles would be the "gold standard." :)

*Originally created by @diegosarina on 1/24/2026* **Problem Statement:** Currently, Databasus manages users and roles internally. For organizations with multiple tools, this creates "identity silos," requiring manual user provisioning, deprovisioning, and password management within the application itself. **The Case for OIDC (Keycloak):** Implementing an OpenID Connect (OIDC) client would allow Databasus to integrate with enterprise identity providers like Keycloak, Okta, or Authelia. - Centralized Access Control: Admins can manage who has access to Databasus from a single point (SSO). - Security: Offload MFA (Multi-Factor Authentication) and password policies to a dedicated IAM (Identity and Access Management) tool. - Onboarding/Offboarding: Automatically grant or revoke access when a member joins or leaves the company via OIDC groups/claims. - Scalability: Essential for DevOps teams managing multiple environments where local user management becomes unfeasible. **Suggested Implementation:** Add configuration flags (or environment variables) for `OIDC_ISSUER_URL`, `OIDC_CLIENT_ID`, and `OIDC_CLIENT_SECRET`. Mapping OIDC groups to Databasus Workspaces/Roles would be the "gold standard." :)

MrUnknownDE closed this issue

2026-04-05 16:15:57 +02:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/databasus#194