Support OpenID Connect (OIDC) login to match the web plugin

[atamelo]

Summary

Please consider adding OIDC login to Piwigo NG. The web version already supports OIDC via the plugin; mobile should offer the same login option so instances protected by modern IdPs (Google, Azure AD, Keycloak, Authentik, Okta, Cloudflare Access, etc.) work seamlessly on mobile too.

Motivation

• Many Piwigo servers are behind an IdP or use the OIDC plugin as it provides better security. E.g. by putting it completely behind Cloudlflare Zero Trust the attack surface reduces significantly.
• Today, web works; mobile can’t log in to those servers.
• This can block real users from using the app at all.

Current behavior

Mobile only supports username/password against the Piwigo webservice. With OIDC-only servers, login is impossible.

Desired behavior

Offer an OIDC login option that works the same way as the web version (using the existing OIDC plugin on the server). No special workarounds needed.

Acceptance criteria

• From the login screen I can choose “Sign in with my Identity Provider (OIDC)”.
• I can authenticate with a chosen IdP’s normal flow and land in the app logged in.
• I stay signed in across app restarts until I explicitly sign out.
• Sign out works and takes me back to the login screen.
• Verified to work with at least two common IdPs (e.g., Cloudflare and Google).

References / Related

• iOS: long-standing request “Support for external authentication / OAuth2”
• Android: cross-posted

[EddyLB]

This plugin does not provide API methods for using it from a third party app.
The mobile apps cannot therefore be coded to exploit it.

According to the plugin description: The plugin supports both the authorization code flow, as well as the (legacy) resource owner credentials flow, otherwise known as the password flow. Although legacy and recommended against, by enabling this flow, login through the Piwigo webservice API is enabled.

So the 'solution' consists in enabling the password flow for now.

[atamelo]

This plugin does not provide API methods for using it from a third party app.
The mobile apps cannot therefore be coded to exploit it.

The point was not to "exploit something" but rather add the oidc flow that the plug-in implements (it's a standard flow).

[EddyLB]

Ok, understood. You wish us to implement OIDC in the app.

[atamelo]

Yes, exactly. That'd be a really nice feature to have.