Google Oauth 2.0 for user login

[MrSamG]

Are there any plans to add Google Oauth 2.0 for user login to the content server? And if not specifically Google, are there any other authentication options?

Apologies I'd this has been asked and answered. I've searched around a lot and search returns are unfortunately overwhelmed with Calibre Web results.

[kovidgoyal]

No, no plans. OAuth only works with browsers, the server is designed to work with non-browser clients as well, hence it uses HTTP auth.

[MrSamG]

Thanks for the reply.

If it were an option, rather than enabled by default then content server would still work with non-browser clients. Some non-browser clients do get configured to accept it, even bypass it and use normal loggin.

I have OAuth enabled on Audiobookshelf and the app works okay with it.

Anyway, appreciate you response and thanks for all the work on Calibre. It's fantastic.

[Quoth]

OAuth is more about Google (or MS) tracking than adding real security.

[giganticfez]

Unfortunately, I just got an email for my Google Workspace saying they are doing away with the Less Secure Apps setting in September. So now I'm casting about for a solution that lets me keep using Calibre to email books to my kindles.

[kovidgoyal]

https://manual.calibre-ebook.com/faq...-using-calibre

[netchild]

Originally Posted by MrSamG

Are there any plans to add Google Oauth 2.0 for user login to the content server? And if not specifically Google, are there any other authentication options?

Apologies I'd this has been asked and answered. I've searched around a lot and search returns are unfortunately overwhelmed with Calibre Web results.

Try https://github.com/oauth2-proxy/oauth2-proxy
It sits between a webserver and calibre. It can authenticate against google, azure, and a lot of other oauth / oidc providers. I have it sort of working with a OSS OIDC provider (keycloak) with the caveat that the username is an UUID. No idea what Google will return as the ID of the user. See https://www.mobileread.com/forums/sh...d.php?t=360941 for more info about that.

[netchild]

Originally Posted by Quoth

OAuth is more about Google (or MS) tracking than adding real security.

Wrong in every aspect.

OAuth is a authorization protocol which can be and is implemented by more parties than just those two. There are even multiple OSS solutions which you can host yourself if you want to.

And it is real security on the protocol level (authorization against a 3rd party, in the sense of "not build-in authentication"). And it adds to authentication (which is not the same as authorization) when a multi-factor authentication is used (which is up to the config of the backend and doesn't need support at all in the client).

[Quoth]

Originally Posted by netchild

Wrong in every aspect.

OAuth is a authorization protocol which can be and is implemented by more parties than just those two. There are even multiple OSS solutions which you can host yourself if you want to.

And it is real security on the protocol level (authorization against a 3rd party, in the sense of "not build-in authentication"). And it adds to authentication (which is not the same as authorization) when a multi-factor authentication is used (which is up to the config of the backend and doesn't need support at all in the client).

It's not actually extra security and a big corporation is using it in most cases to track and control.

It's not needed.