New Account Linkage System

Maybe authentik? I know a lot of folk (TG and CM) use this. This is a requirement to moving away from our current forums system.

Basically we need a means of linking accounts together, and it needs to support:

• Whatever forums we use (hopefully just a generic oauth connector we can use)
• BYOND
• Patreon
• GitHub
• SS14 accounts in the future (iirc we can do custom oauth on these too)

Authentik was indeed the move due to it being used in other places in the community and being quite usable as an IAM, especially compared to things like keycloak. This issue now serves as a tracker for everything that needs doing to NALS.

Progress Tracker

Phase 1

• Get authentik installed
• Test forums sign in and enrollment
• Add GitHub sign in
• Add Discord sign in
• Add BYOND sign in
• Add Patreon sign in
• Test authentik -> Mediawiki
• Test authentik -> TGS
• Migrate all forum accounts over
  • Make sure existing BYOND links are carried over
  • And Patreon
  • And GitHub
  • And Discord
• Disable all auth outbound from invision
• Make a wiki page explaining account links

Phase 2

• BYOND Linkage
  • Ingame changes
  • New automation for adding and removing Ingame Verified & Ingame Banned on the forums
  • Documentation updates
  • Retirement of existing web tooling
  • Migrate existing FUIDs to Authentik users in the game table
• Patreon Linkage
  • New automation for Patreon management
  • Documentation updates
• GitHub linkage
  • Documentation updates
  • ALICE tooling updates
• New automation for Discord role sync
  • IGV and IGB sync in ALICE
  • Support for GH contributor [authentik group]
  • Support for Patreon supporter [check holding table]
  • Support for Ingame Verified [check if they have a connection to BYOND]
  • All devteam roles [check internal table after migrating PR voting system]
  • Tie it all into the existing /syncme ALICE command - requires all of the above sorted first
    • Foundation has been laid
• Kibana access
  • New automation Kibana access - use a group within authentik and keep track based on existing ingame groups
  • Requires moving auth to nginxpm - proven to work, copy POC for other web utilities
  • Requires taskdaemon task to sort groups out for point 1
• Other web utilities
  • Map out existing roles that are used for various things (admin tools, PR tracker, etc) - manage groups within Authentik
  • POC of authentik access control on NGINXPM
  • New NGINX container for tooling server
  • Migrate what can be migrated away from the forum hell (see sub issue) #18
• Deprecate all account links on the forums
  • Patreon
  • BYOND
  • GitHub
  • Discord - cant fully deprecate due to it being a sign in method for many, but remove anything thats load bearing

Phase 3

• Annihilate the forums
• Do the nginx container
  • Suss out auth in that for restricted pages (admin, GH cont, etc)

Start with the unchecked items in the Progress Tracker, especially Discord role sync, migration of web utilities in #18, and forum account-link deprecation. Review the existing Authentik, ALICE, nginx container, and taskdaemon work described in the completed items; done means the remaining Phase 2 and Phase 3 checklist items are completed.