0.36.0

[Freika]

OIDC and KML support release

So, you want to configure your OIDC provider. If not — skip to the actual changelog. You're going to need to provide at least 4 environment variables: OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, OIDC_ISSUER, and OIDC_REDIRECT_URI. Then, if you want to rename the provider from "OpenID Connect" to something else (e.g. "Authentik"), set OIDC_PROVIDER_NAME variable as well. If you want to disable email/password registration and allow only OIDC login, set ALLOW_EMAIL_PASSWORD_REGISTRATION to false. After just 7 brand new environment variables, you'll never have to deal with passwords in Dawarich again!

Jokes aside, even though I'm not a fan of bloating the environment with too many variables, this is a nice addition and it will be reused in the cloud version of Dawarich as well. Thanks for waiting more than a year for this feature!

To configure your OIDC provider, set the following environment variables:

OIDC_CLIENT_ID=client_id_example
OIDC_CLIENT_SECRET=client_secret_example
OIDC_ISSUER=https://authentik.yourdomain.com/application/o/dawarich/
OIDC_REDIRECT_URI=https://your-dawarich-url.com/users/auth/openid_connect/callback
OIDC_AUTO_REGISTER=true # optional, default is false
OIDC_PROVIDER_NAME=YourProviderName # optional, default is OpenID Connect
ALLOW_EMAIL_PASSWORD_REGISTRATION=false # optional, default is true

Added

• Support for KML file uploads. Support for .kml files #350
• Added a commented line in the docker-compose.yml file to use an alternative PostGIS image for ARM architecture.
• User can now create a place directly from the map and add tags and notes to it. If reverse geocoding is enabled, list of nearby places will be shown as suggestions.
• User can create and manage tags for places.
• Visits for manually created places are being suggested automatically, just like for areas.
• User can enable or disable places layers on the map to show/hide all or just some of their visited places based on tags.
• User can define privacy zones around places with specific tags to hide map data within a certain radius.
• If user has a place tagged with a tag named "Home" (case insensitive), and this place doesn't have a privacy zone defined, this place will be used as home location for days with no tracked data. How to set the default center position of the map #1659 Maps without data #1575

Fixed

• The map settings panel is now scrollable
• Fixed a bug where family location sharing settings were not being updated correctly. Family member can't enable location sharing #1940

Changed

• Internal redis settings updated to implement support for connecting to Redis via unix socket. Can't connect to Redis through a unix socket #1706
• Implemented authentication via GitHub and Google for Dawarich Cloud.
• Implemented OpenID Connect authentication for self-hosted Dawarich instances. FEATURE REQUEST: Implement OpenID/oAuth2 for account Signups/Logins #66

---

💙 This release is supported by Steven B., James Manolios, chenrik, aldumil, derpderpington, Chippie, dint, jhalpern, Lex Fradski, Schlufo, cyberswan.at, craftyklaus, Andre, hogenf, naraxius, Embrace, martin4861, Alex, evetters, GregF, Jon Coffee, Lukas, Robbie G, Kilian, Hans G, Chris, tabaha, Andre, Michael C, Chris, gesus, Jonah B., Dante, daallex, Tanner A., Matthias B., Milien M., Mathias, Travis S., Michael J., Matthew F., Johnathan D., bleibdirtroy, no1etal, dixet, Bailey J., Alex D., Benjamin M., Daniel A., Florian, BeeHappy, ChemistryDachshund, OrangeWindies, Roman G., Michelangelo V., Edward, Erazem Z., Wolfgang B., Denis Abt, Tony G., Andrew D., Lomky, Osamu Y., Simon van B., Linus T., Christian C., Sebastian, Jan K., Nathan T., Max G., Lars N., Karol B., Konstantin, Johannes H., t3hero, g3lin, nightsb on Patreon and KoFi 💙

---

What's Changed

• Feature/kml by @Freika in Feature/kml #1951
• Feature/omniauth by @Freika in Feature/omniauth #1880
• Fix family location sharing toggle by @Freika in Fix family location sharing toggle #1954
• Feature/places management by @Freika in Feature/places management #1955
• 0.36.0 by @Freika in 0.36.0 #1952

Full Changelog: 0.35.1...0.36.0

---

This discussion was created from the release 0.36.0.

[pelluch]

Awesome, thanks! Just tested OIDC and it works great. Dawarich was the one app remaining in my self-hosted stack which did not have OIDC, and it makes me happy to be able to have everything go through Authentik and not deal with managing users and passwords beyond that.

Also love creating a place from the map and all the new improvements related to this. Makes dawarich a lot more complete for me.

[lonestaritaly]

OIDC all good with Keycloak. Thanks a lot! This looks like a juicy release indeed ;-)

[nvdael]

I've just implemented OIDC with Authentik and it works, tnx!

How to handle with OIDC as default login provider and block login with email/password?
I've set following variables:
OIDC_AUTO_REGISTER=true
ALLOW_EMAIL_PASSWORD_REGISTRATION=false

Users are existing in Dawarich before login with Authentik.

[hogantg]

Another confirmation! OIDC setup and working with PocketID.

Also curious to @nvdael's point - if there is a way to disable email/pw authentication, and/or even forward the user straight to the oidc login.

[michaelcresswell]

Thank you for adding OIDC! If the “Sign In with OpenID Connect” button performed a GET instead of a POST it would be possible to link users straight to OIDC login (which would automatically go to the map if they’ve signed in elsewhere already). Just an approach I’ve seen a few services take instead of or in addition to environment variables for auto-login.

[kosli]

@hogantg I try to set it up with PocketID too but something goes wrong as I get an "Authentication failed: undefined method 'with_indifferent_access' for an instance of String" when I try to login on dawarich. What have you used as OIDC_ISSUER and OIDC_REDIRECT_URI (plz anoymize the host). Thanks

[hogantg]

@kosli - I ran into that exact same error at one point while setting up. Unfortunately I don't remember what was causing it specifically as it was not my only issue. Hope the issuer and redirect settings below help:

OIDC_ISSUER: https://pocketid.DOMAIN.com
OIDC_REDIRECT_URI: https://dawarich.DOMAIN.com/users/auth/openid_connect/callback

[kosli]

thanks @hogantg
Even after adapting it to your URLs, i obiously had a trailing slash at the ISSUER URL. Thanks to the error "Issuer mismatch" and some help from ChatGPT, i got to understand that the issuer provided by PocketID at https://pocketid.example.com/.well-known/openid-configuration is without the trailing slash and so they didn't match. Problem solved. Thanks.

[hogantg]

Glad I could be of some help.
Ironically, reading your process (checking the issuer at the /openid-configuration endpoint) jogged my memory and is the exact same steps I took when I had the "with_indifferent_access" issue.

[Syntoxr]

Did anyone managed to link their existing dawarich account with their OIDC account?
If I disallow registration, and try to log in through OIDC, I get the error, that registration is disabled.
And if I enable registration, I get 'Email has already been taken'.
Do I have to set a specific claim in my OIDC provider?

[pelluch]

@Syntoxr Yes, my pre-existing account was linked in with my OIDC account when I tried. I can give you the context I have:

• My OIDC provider is Authentik
• Within Authentik, the 'email', 'openid', and 'profile' claims were selected
• My Authentik email at the point of sign in was the same as my Dawarich email
• In Authentik for my Dawarich provider, I selected "User hash id" on the "Subject mode" option (but I'm fairly sure this is not relevant)

Because the only actual user identifier in Dawarich is the email, it stands to reason that it must've used that as the identifier to link the accounts. In that sense, I would suggest making sure the "email" claim is set. What is your OIDC provider, specifically?

[Syntoxr]

Thanks,
also using authentik, so claims and Subject mode are the same by default.
As I get 'Email has already been taken', I guess, the emails should also match.
One guess I have is that my authentik email has capital characters in it, while dawarich stores emails as lower case.

So maybe linking OIDC users fails, as the email strings are different, resulting in dawarich trying to register me as a new user, which then also fails because that check correctly compares email addresses and notices, that my user already exists?

Edit:
I think I can confirm this, as looking at the logs, an OIDC login results in the following 2 queries being run:
SELECT "users".* FROM "users" WHERE "users"."email" = $1 LIMIT $2
-> uses my email with upper case characters.
SELECT 1 AS one FROM "users" WHERE "users"."email" = $1 LIMIT $2
-> uses my lower case email

Edit 2:
I created #1983

[BeastleeUK]

Thank you for adding OIDC, this was one of 2 remaining apps that I needed it in.

Can the OIDC _CLIENT_ID and OIDC_CLIENT_SECRET be loaded as docker secrets (files) or via a mapped config file? please. An OIDC client/secret pair shouldn't be getting exposed in ENV variables that can be recovered relatively easily.