Workflow; OpenID Connect and SSO Authentication
WORKFLOW ==> openid-connect-sso-authentication

Magic contains support for SSO using OIDC. This can be used when generating applications, and full stack apps, requiring authentication and authorisation. The following endpoints are available for you;

* HTTP GET `/magic/system/auth/openid-providers?createNonce=true`
* HTTP GET `/magic/system/auth/openid-login`

The first endpoint above if for querying the backend for what OpenID providers have been configured, and it will return something such as the following;

```json
[
  {
    "name": "Google",
    "issuer": "https://accounts.google.com",
    "nonce": "SOME_NONCE_HERE",
    "url": "https://accounts.google.com/o/oauth2/v2/auth",
    "client_id": "123456789-efqwevdgfh.apps.googleusercontent.com",
    "response_type": "id_token",
    "scope": "openid email profile"
  }
]
```

The `openid-login` endpoint returns a valid JWT token if you pass in a `token` QUERY parameter that should be generated by the OIDC provider. Use this token in consecutive requests towards the backend after the OIDC authentication process is over.

When users are logging in with OpenID a new user is automatically created and inserted into the magic database that belongs to the "guest" role, with the email address being the username. This user *cannot* login using a password, only the OIDC provider. However, the user becomes a normal magic user besides from that, and can have roles assigned, etc.

**NOTICE** - The system only supports Google OIDC out of the box!

The `openid-login` endpoint will return the JWT token as follows;

```json
{
   "ticket":"JWT.TOKEN.HERE",
   "extra": {
      "email":"thomas@ainiro.io",
      "name":"Thomas Hansen"
   }
}
```

In addition to the above, the user needs to specifically edit his configuration found at `/configuration` to add the following configuration setting.

```json
{
  "magic": {
    "oidc": {
      "google": {
        "client-id": "1234567890-eo23gyh5ytd467hjgvdd5.apps.googleusercontent.com"
      }
    },
/*... REST OF THE CONFIGURATION FILE HERE ...!!*/
```

Make sure user understands that he will need to get the above `client-id` from Google Cloud API, which you can find below;

* https://console.cloud.google.com/apis/credentials

And return a Markdown hyperlink to the user informing the user he needs to register a Google Cloud API account, to create a `client-id`.

Also inform the user that the redirect URL to the frontend must be enabled in Google Cloud API, and return the redirect URL to the user such that he or she can copy it and paste it into their Google Cloud accounts.

**NOTICE** - If the user wants authorized users only to access the frontend, you must make sure the primary GUI is not visible before users have logged in, create a log in form or something, and display a log out button after having logged in. Store token in localStorage. And HIDE login button/logic after users have logged in!

The fromtend flow for authentication is as follows;

1. Hide main app and show login UI
2. User logs in
3. Hide login UI and show app UI
4. User logs out
5. Hide app UI and show login UI

**IMPORTANT** - If the user wants to use Google OIDC, then most endpoints should probably be restricted to the "guest" user by default. This is because the OIDC token exchange creates a new user and adds this user to the "guest" role, allowing him or her to access the endpoints.
