Add authentication support (local users, SAML SSO, user management UI)

[ViToRiO92]

Hi! I've been using OpenVox View and noticed that all API endpoints are publicly accessible without any authentication. For environments exposed beyond a trusted network — especially the Puppet CA endpoints that allow signing and revoking certificates — this is a security concern.

I've implemented authentication support in my fork and would like to contribute it upstream if there's interest. Here's an overview of what it covers:

Local User Authentication

• SQLite-based user store (using modernc.org/sqlite — pure Go, no CGO)
• Short-lived JWT access tokens + long-lived refresh tokens with rotation
• --create-admin CLI flag for bootstrapping the first user
• Configurable via auth.enabled toggle — existing deployments are unaffected

SAML 2.0 SSO (EntraID / ADFS)

• SP-initiated SSO using crewjam/saml
• Auto-provisioning of users on first SAML login
• Hourly IdP metadata refresh for certificate rotation
• --generate-saml-cert CLI flag for SP certificate generation
• Coexists with local auth (break-glass admin account)

User Management UI

• Admin-only page for managing users (create, edit, delete)
• Role-based access control via is_admin flag
• SAML user profiles shown as read-only (managed by IdP)
• Self-delete and self-demote guards
• i18n support (en-US, de-DE)

Security Hardening

• Admin-only middleware on user management endpoints
• Configurable CORS policy (default: no CORS headers)
• IDP-initiated SAML disabled (prevents assertion replay)
• SAML cookie with Secure + HttpOnly flags
• Password minimum length enforced on create and update
• Rate limiting on login endpoint

Documentation

• ADR documents for each feature (ADR-001 through ADR-004)
• Configuration documentation with EntraID/ADFS setup guides
• Manual test plan

The auth.enabled toggle defaults to false, so this is fully backwards-compatible. No changes to existing functionality when auth is disabled.

I'm happy to split this into smaller PRs if that's preferred (e.g., local auth first, then SAML, then UI). Let me know if this is something you'd be interested in merging, and if there are any concerns about the approach.

[sebastianrakel]

Hi thanks! There was a discussion about it, if openvoxview should implement authentication or if you should using authenticating proxies like traefik with keycloak or something like this.

but i would be happy to see your PR

[ViToRiO92]

Thanks for the fast reply. i opend the PR #153.

We also discussed at our company how we could handle authentification with openvox view and wanted to see if a implementation in the app is possible. I added some screenshots and did some tests. For now it works as designed. if you dont like something, please tell me and i will look into it.