Pomerium: internal/identity: add github auth provider

[caarlos0]

Describe the solution you'd like

I would like to be able to use github as provider on pomerium. As far as I've seen it's not implemented yet and I couldn't find an issue for it.

Describe alternatives you've considered

Using other SSO providers.

[travisgroth]

Hi @caarlos0. FYI, github doesn't provide oidc directly and Pomerium is currently designed with oidc integration in mind. Doing non-oidc providers is definitely possible (and seems a likely roadmap item) but hasn't been planned out yet.

In terms of what is supported right now, you might have luck using dex to provide an oidc layer in front of github. I believe Pomerium would be able to integrate with dex as a generic provider. It's more moving parts, but you'd be able to get going with Pomerium right away while other provider types are sorted out.

[desimone]

Sorry for the late update. Though I had a working PoC (#221) implemented in a similar fashion to dex, I was left unsatisfied with the way certain assumptions were being carried forward into our current security model (in particular, Github's access token's never expire).

I'd like to further investigate other oauth2 (only) providers to see what set of functionality is core across providers.

[desimone]

After speaking with @Lumexralph offline, I think we are going to take another look at adding github support.

As mentioned in my previous post, github does not support OIDC it only supports OAuth2, and has no mechanisms to do token refresh, as the access token does not expire by design.

I think it fine to support github, as long as during refresh we continue to refresh _all_ of the user details and gracefully handle when a token maybe revoked.

See also:

• https://github.community/t5/GitHub-API-Development-and/API-Access-Token-Expiry/td-p/41059