OpenID / OAuth Provider for Members SSO

Memberships & subscriptions
1

Posting in this topic, as I am not allowed to post to Ideas. (If an admin is willing to move this I’d be super thankful :slight_smile:)

I would love for Ghost to expose an OpenID Connect Provider for authenticating members.

Benefits

If this was implemented I believe it would lead to a lot of flexibility in how people utilize Ghost, as it allows unlimited extendability for custom use cases without bloating the Ghost code base with features that only apply to a nieche audience and without people having to run modified versions of Ghost to botch on additional features.

Example Use Cases

  • A blog doing moto tours (like what I plan to do) could link to an external download base for providing GPX tracks for members
  • A news blog may provide mini-games for members (similar to what New York Times is doing)
  • A creator could link a video platform providing early access to new videos to paying members

Flow Description

  1. User visits external service (ES)
  2. ES redirects user to Ghost
  3. Ghost authenticates the member
  4. Ghost redirects the member back to the ES callback URL including an ID Token (JWT)
  5. ES parses the JWT, which includes the member’s name, email address and membership tier
  6. ES can now provide the member features tailored to them and their membership

Notes and Stuff

  • Ghost could have this in the Custom Integrations
  • The feature could be implemented in steps, maybe first only allowing a subset of the OpenID Connect Specification
  • Maybe it’d be beneficial to expose membership labels as roles in the ID Token
  • Applications could also be limited to a subset of membership tiers with a notice being displayed if the member’s tier is not permitted to access the application

I’d love to hear what the community thinks of this! If you have any use case for this, feel free to share it so others can get an idea for what value this feature would bring for them and their publication!

2

It isn’t specifically OpenID standard, but you can actually already do this with Ghost. Check out the /members/api/entitlements jwt. Add a custom page on the Ghost site that gets it (client side javascript running in the browser) and sends the member to the external service with it. Use /members/.well-known/jwks.json to validate.

3

Wow, that’s actually really cool - thanks for pointing it out! Is there additional documentation available on this? I’ll leave this thread up, since I think a clean OpenID flow would still be a nice feature, but this already goes a long way. Thanks Cathy!