Answering the question in post #2 above: our use case, and which login sources we need.
We run a public community forum for an EU research initiative, on managed Discourse hosting inside the EU.
We need two OIDC providers enabled at the same time:
- EU Login, the European Commission’s identity provider. It is used by Commission staff, policy stakeholders, and participants in EU-funded projects. Standard OIDC, with its discovery document at
https://ecas.ec.europa.eu/cas/oauth2/.well-known/openid-configuration. - EGI Check-in, a federated academic identity proxy that fronts institutional accounts and ORCID. It is used across the European research infrastructures. Also standard OIDC.
Neither one covers the other’s users. A policy officer signs in with EU Login and has no institutional research identity. A researcher signs in with a university account or with ORCID via our proxy and has no EU Login. Our community is made up of both groups, so picking a single provider means turning away half the people the forum is for.
Both providers speak ordinary OIDC, and either one works on its own. What stops us is that discourse-openid-connect exposes a single, un-numbered settings namespace: openid_connect_client_id, rather than openid_connect_1_client_id and openid_connect_2_client_id. Only one OIDC provider can be configured per site.
We would like support for more than one. The most natural form would be a per-provider settings namespace, either numbered settings or an admin-managed list, where each provider has its own discovery document, client credentials, scope, and button title.
There is earlier prior art in Multiple openid-connect authentication providers from 2021, where the need was several Keycloak realms. That is the same limitation in a different form.
We can provide more information if needed, or test implementations if that can help.