JWT Bearer Auth

If your team already signs in through an identity provider, a second Frappe password is one more thing to manage and leak. JWT Bearer Auth lets the identity provider in front of your site, such as Cloudflare Access, decide who someone is. Frappe reads the signed token that comes with each request and logs that person in, so users never see the Frappe login page. It targets Frappe v16.

Features

• Token login. The app reads the JWT from the cookie or header you name (for Cloudflare Access, CF_Authorization or Cf-Access-Jwt-Assertion) and logs in the user whose email it carries.

• Verified tokens. Tokens must be RS256, signed by a key from the provider's JWKS endpoint, and issued for your application's audience. With no audience set, every token is rejected.

• User registration. When enabled, a valid token for an email with no user creates a website user, filled in from a matching Contact where there is one. Otherwise the user is asked to complete their profile.

• Redirects. Optionally send signed-out visitors to the provider's login page. Logging out of Frappe also sends the user to the provider's logout URL, so both sessions end.

• Contact sync. Name and phone changes on a user's Contact are copied to the user.

Getting started

Install the app, then open JWT Auth Settings and enter the JWKS URL, the audience, the cookie or header name, and your login and logout URLs. The README explains each setting, with the Cloudflare Access values.

bench get-app https://github.com/Avunu/jwt_bearer_auth.git
bench --site <SITE_NAME> install-app jwt_bearer_auth