Forward Auth adapter #32

New issue

Closed

opened 2026-07-24 10:16:04 +00:00 by frank · 0 comments

frank commented

2026-07-24 10:16:04 +00:00

Owner

Goal

Implement NiceOAuthForwardAuth, a Ghost SSO adapter that authenticates existing staff users from trusted forward-auth headers.

Requirements

Read the configured email, username and groups headers.
Require and normalize the email address.
Resolve an existing Ghost user with getUserByEmail.
Return null for missing, invalid, unauthorized or unknown identities.
Export the adapter through the package entrypoint.

Acceptance criteria

Authorized identities resolve to the matching Ghost staff user.
Missing email is rejected.
Missing required groups are rejected.
Unknown Ghost users are rejected.
Header names are configurable.

## Goal Implement `NiceOAuthForwardAuth`, a Ghost SSO adapter that authenticates existing staff users from trusted forward-auth headers. ## Requirements * Read the configured email, username and groups headers. * Require and normalize the email address. * Resolve an existing Ghost user with `getUserByEmail`. * Return `null` for missing, invalid, unauthorized or unknown identities. * Export the adapter through the package entrypoint. ## Acceptance criteria * [x] Authorized identities resolve to the matching Ghost staff user. * [x] Missing email is rejected. * [x] Missing required groups are rejected. * [x] Unknown Ghost users are rejected. * [x] Header names are configurable.

frank added this to the Forward Auth mode milestone

2026-07-24 10:16:04 +00:00

frank added the

type/feature

label

2026-07-24 10:16:04 +00:00

frank added the

area/core

security

labels

2026-07-24 11:21:59 +00:00

frank added reference feat/forward-auth-adapter