In any large organization, managing user identities is a constant challenge of balancing security with user convenience. For an enterprise-grade workflow orchestration platform like Apache DolphinScheduler, robust and flexible authentication is not just a feature-it's a necessity.

Previously, DolphinScheduler offered several login options, including Password, LDAP, and Casdoor SSO. However, these methods had limitations, such as a high dependency on the Casdoor project or an inflexible OAuth implementation, making it challenging to integrate with diverse enterprise identity systems.

🤔 What is OIDC? A Simple Analogy

Think of OIDC as a universal digital passport. Instead of creating a new, separate account for every service you use (like DolphinScheduler), you present a trusted passport from an identity provider (like Google, Keycloak, or your company's internal login system) to prove who you are.

Technically, OIDC is a modern security standard that works as an identity layer on top of the OAuth 2.0 protocol. While

OAuth 2.0 is about authorization (what you're allowed to do), OIDC is about authentication (confirming who you are) .

This approach is ideal for DolphinScheduler because of its:

✨ Key OIDC Features Now in DolphinScheduler

This GSoC project brings several powerful, enterprise-focused features to DolphinScheduler.

How It Works: A Look Under the Hood

The OIDC integration follows the standard Authorization Code Flow, ensuring a secure and reliable authentication process.

🛠️ Step-by-Step Guide: How to Configure OIDC with Keycloak

Setting up OIDC is straightforward. Here’s a quick guide using Keycloak and Dex Idp.

Example 1: Using Keycloak

Here’s a quick guide using Keycloak, a popular open-source identity provider.

In your Keycloak instance, you'll need to register DolphinScheduler as a new client.

  1. Create a Client: Give it a Client ID (e.g., dolphinscheduler-client).

  1. Set Redirect URIs: This is crucial. Add the callback URL for your DolphinScheduler API server, which follows the format: http://{api-host:port}/dolphinscheduler/login/oauth2/code/{provider-id}. For a local setup, this would be http://localhost:12345/dolphinscheduler/login/oauth2/code/keycloak

  1. Get Credentials: Go to the "Credentials" tab and copy the Client Secret.

💡 Quick Start:

For testing, you can use the pre-configured realm-export.json file located at dolphinscheduler-api-test/dolphinscheduler-api-test-case/src/test/resources/docker/oidc-login/realm-export.json to spin up a Keycloak instance with all the necessary settings already in place!

Next, update the dolphinscheduler-api/src/main/resources/application.yamlfile with the credentials from Keycloak.

Example 2: Using Dexidp (to show generality)

Here is how you would configure Dex, another popular OIDC identity provider, demonstrating the system's flexibility.

Example Dex config.yaml :

After restarting the DolphinScheduler API server, the login page will now feature buttons for both "Login with Keycloak" and "Login with Dex".

The user flow is seamless for both!

  1. The user clicks the new login button.
  2. They are redirected to the Keycloak/Dex login page to enter their credentials.
  3. Upon success, they are sent back to the DolphinScheduler UI, fully authenticated.

👨‍💻 My GSoC Journey & Acknowledgements

This project was an incredible learning experience, focused on a single core principle: creating a truly generalized authentication solution for the enterprise. My journey began with a deep dive into DolphinScheduler's architecture while tackling the local environment setup. With invaluable guidance from my mentors, I adopted a backend-first approach, building a solid foundation with the robust Nimbus SDK to ensure the core OIDC logic was both reliable and standard-compliant.

A key design decision was to make the Identity Provider the single source of truth. This was essential for enabling the dynamic role-sync feature that re-evaluates a user's permissions on every login, not just the first one, ensuring that access control is always up-to-date. This required updating the core user service and ensures that a user's access is always in sync with your central identity system.

Proving the flexibility and reliability of this feature was the next major challenge. A top priority was quality assurance, which I addressed with a multi-layered strategy:

The journey didn't end with the backend. I also developed the complete frontend experience, implementing the API calls and creating the responsive UI components that allow users to log in with the configured OIDC providers.

Finally, to support future development and community adoption, I created extensive documentation. This includes a step-by-step developer guide for local testing with Keycloak and detailed configuration examples for enterprise integration, which are now part of the official DolphinScheduler documentation.

This project wouldn't have been possible without my fantastic mentors,

Gallardot and ZiHao Xiang (SbloodyS), who provided invaluable guidance, feedback, and support throughout the summer. I'm also immensely grateful to the Apache DolphinScheduler community and the Google Summer of Code program for this amazing opportunity.

🎯 Conclusion: The Impact

The introduction of generalized OIDC authentication is a significant step forward for Apache DolphinScheduler, delivering tangible benefits for everyone:

This feature makes DolphinScheduler more secure, user-friendly, and better prepared for the complex demands of modern data platforms.

🤝 Get Involved & Try It Out!

I encourage you to explore the new OIDC authentication feature! All the work was done in the open, and you can review the complete implementation in the official pull request.

Your feedback and contributions are always welcome! Thank you for being a part of this journey.