Leveraging 3rd party sign-in

Developer help
1

Hello :wave: Ghost community,

I’ve spent a bit of time clicking through this great community and I’m specifically searching for some thoughts/ideas/solutions to this one burning question.

Can Ghost use an external party for sign-on for subscribers?

My use case. Allow subscribers the ability to sign up/sign in with 3rd party credentials - I’m thinking services similar to Auth0. Hoping this will also allow the user to seamlessly move to other services within my control, such as a forum, with the same credentials. This would also allow me (admin) more flexibility with the sign-up/sign-in controls such as what is on offer - eg. sign-in with Apple, Facebook, WebAuthn etc.

What I have found so far is conversation around a SSO beta for Pro users - which I’m of the understanding that the aim here is for admins etc to use external sign-on capabilities - eg. Okta, Azure AD etc.

I completely understand that isn’t a core feature however I’m really looking to validate this more before diving in further.

If it is viable, then I’d be happy to work on it.

2

I’m not sure what the Ghost team’s plans are for SSO, but I would find it useful to have SSO with Ghost and Discourse.

3

Exactly.

And without sounding terrible here, I’d prefer to have security handled by another party rather than my own Ghost instance.

4

I’ve seen the “SSO beta for Pro users” mentioned before, but I think Kevin’s response in another thread provides some clarification of that.

5

Just so there’s no confusion, that topic is about SSO for staff users, not members. Staff users and members are completely separate systems and do not share any authentication mechanisms.

6

Thanks @Kevin.

With a much better understanding of the core of Ghost than I do, is this something that is feasible? Or am I wasting my time on this?

7

Any thought on this?

9

The header says “development in progress. Do not use.” and it was last updated two years ago.

10

This has moved off of Github:

11

Is that code functional, @TheChocolateLife? On GitHub, the version tagged 2.3.1 is from 2017. I’m not sure why passport.js has it marked as being published three days ago.

Does it work? Beats me? I’d be interested to know the backstory for why it appears on passportjs now!

This seems unrelated to ghost-passport-sso, which was for signing into Ghost using SSO providers, not for using Ghost as an SSO provider (which is the point of passport-ghost, I think?)…