Authenticate with OAuth Protocol

Learn how to implement OAuth authentication in LogScale through supported providers like Google, GitHub, and BitBucket, and how to set up Auth0 integration. Undestand the steps for creating LogScale apps, configuring authentication settings, and mapping Auth0 roles to LogScale groups, with specific requirements for proper configuration of client IDs, secrets, and redirect URIs.

OAuth is an open standard that may be used to grant access to LogScale to applications and others without giving them your password.

The following diagram illustrates the standard OAuth 2.0 authentication flow between the user's browser, LogScale, and the OAuth provider:

sequenceDiagram participant User as User/Browser participant LS as LogScale participant Provider as OAuth Provider User->>LS: 1. Access LogScale LS->>User: 2. Redirect to login User->>Provider: 3. Request authorization Provider->>User: 4. Authentication prompt User->>Provider: 5. Provide credentials Provider->>User: 6. Authorization confirmation User->>Provider: 7. Confirm authorization Provider->>LS: 8. Send authorization code Note over Provider,LS: Callback to redirect_uri LS->>Provider: 9. Exchange code for access token Note over LS,Provider: Client ID & secret verification Provider->>LS: 10. Return access token LS->>Provider: 11. Request user information Provider->>LS: 12. Return user profile data LS->>User: 13. Create session & redirect to LogScale Note over User,LS: User now authenticated

The OAuth flow follows these key steps:

  1. User attempts to access LogScale application

  2. LogScale redirects to login page and offers OAuth provider options

  3. User selects an OAuth provider, and the browser is redirected to that provider

  4. OAuth provider displays authentication screen to the user

  5. User enters their credentials with the OAuth provider

  6. OAuth provider confirms user identity and asks for authorization

  7. User approves the authorization request

  8. OAuth provider sends an authorization code to LogScale via the configured redirect URI

  9. LogScale exchanges the authorization code for an access token using its client ID and client secret

  10. OAuth provider validates the request and returns an access token

  11. LogScale uses the access token to request user information from the provider

  12. Provider returns user profile data

  13. LogScale creates a session for the user and redirects them to the application

LogScale supports the OAuth 2.0 login flow for the following providers:

BitBucket

GitHub

Google

Auth0

Providers must be configured on the LogScale server as described in the section for each provider.

You can enable several providers at the same time by setting multiple provider configurations.

Before you can configure your identity provider in LogScale you must create OAuth Apps with the provider and get a client_id and client_secret, and configure your redirect_uri.

In order for OAuth authentication to work properly for all providers you must provide a URL where LogScale can be reached from the browser in the PUBLIC_URL environment variable.