The problem:

Users are currently authenticating via OTP-based keys delivered via SMTP, while this does work, it is inefficient, and uses email resources excessively.

The current flow is: User navigates to site behind Pangolin → User enters email in email tab → Pangolin emails user with OTP → User enters OTP key → Pangolin permits access, and passes to application.

Proposed Solution:

Users will be provided with OIDC credentials, that will allow them to log in to assigned applications based on group membership. One set of credentials, or passkey → Many applications.

PocketID has been selected as the solution, as it offers a simplistic authentication product, whilst also syncing with LDAP to pull users, group memberships, and other attributes.

https://pocket-id.org/

Benefits:

By implementing OIDC in our environment, users will benefit from a seamless authentication experience, but also from an administrative perspective, benefit from a seamless credential management perspective.

On-boarding / Off-boarding users will be as easy as disabling their account in AD, syncing PocketID, and au-voila, sign-in is cut-off. User data persists, but account access is severed.

Future Plans:

This also supports future plans for additional services offered by PhoenixNet-Labs, i.e. Nextcloud, Telecommunications (PBX), and Jellyfin (Media, Plex alternative)

Implementation:

Deploy PocketID server on STLDC-SVR1

Use https://id.phoenixnet-labs.com as domain, and configure LDAP sync.

Route LDAP traffic back to HQ via Wireguard Site-to-Site VPN over STLDC-RTR1.

Create users in AD, assigning first, last, displayname, and email at minimum.

For extra-special touch, assign profile pictures based on Telegram / Discord user profiles.

User Account Creation:

File users under "PhoenixNet_Labs_Clients"

Create new user, assign first, last, displayname, and email (based on email provided via Plex)

Assign groups under Groups → PhoenixNet_Labs_Clients_Groups, picking what they need. (At minimum, they need PocketID_Users to sign-in)

Log into PocketID, Administration → Application Configuration → LDAP → Sync now

Verify users pull, and data is present.

Group Creation:

Create group under "PhoenixNet_Labs_Clients_Groups", ensuring name uses UNDERSCORES NOT HYPHENS.

Assign group as member of PhoenixNet_Labs_Clients_Groups so that it syncs. (Using filter so that not ALL groups are synced)

Assign users as needed.

Sync in panel (PocketID Admin → Application Configuration → LDAP → Sync now)

Assign group as "Allowed User Groups" under OIDC Clients.

Housekeeping:

Enroll users: 

This is a tricky one, don't just mass-enroll users and send emails, they need a 'warning' before it goes out.

Send email to all current users, informing of changes.

Give 1-2 hours, then start mass-enrolling users.

Add user using above steps, randomize password, and then from PocketID → Administration → Users, click the ... → Login Code → Expiration (1 week) → Send Email

Audit Users:

Verify users enroll:

In prior step, email covers sending users email, notifying that if they do not enroll by the time their key expires, account(s) will be disabled and pulled. Off-boarding email will be sent out shortly-after.

Verify user enrollment via Audit Log → Global, looking for "Token Sign In" and "Passkey Added" if not present, fail audit.

Send off-boarding email, or mark as OIDC Migrated on Discord with role, and on tab under this article.