Currently OSGEO provides an identity management service through LDAP. This service is described in the wiki here: https://wiki.osgeo.org/wiki/SAC:LDAP

The process of enroling users into LDAP requires some rather arcane process of acquiring a mantra: "NOTE: as of June 2016 the public user registration form may require entering a "mantra" (a pseudo-secret passphrase) - already registered trusted users can find out what the mantra is and how to share on https://gitea.osgeo.org/sac/userid-mantra/wiki (requires login and access grant, otherwise the page will appear as 404)."

Once armed with a mantra, a user can go here to sign up:

https://id.osgeo.org/ldap/create

In the modern web, nearly every user is already equipped with an account on one of Apple, Google, Microsoft, GitHub, GitLab, Facebook, etc. single sign on providers. And platforms such as keycloak (https://www.keycloak.org/) allow brokering of identity through these platforms.

Thus we have on the one hand a non standard, confusing and manual process for identity management and the other modern technologies that allow the user to authenticate into OSGEO services using an account they already have.

This discussion invites you to share your comments on the proposal to migrate OSGEO to use Keycloak for identity management (with a legacy fallback to the OSGEO LDAP service so that no existing accounts are affected) and support for every modern major identity provider that we can integrate with.

Key questions are:

1. Do you agree with this proposal in concept?

2. Can we appoint someone to do the work?

3. If we deploy this do we have the infrastructure available to host?

4. Do we have the resources to maintain it on an ongoing basis?

Advantages:

1. OSGEO users do not need to maintain an account on yet another platform (which btw lags behind also in terms of account security with mfa etc,)

2. OSGEO users joining are saved a lot of complexity in the sign up process.

3. SAC and OSGEO members are saved work in provisioning mantras and maintaining mantras.

4. OSGEO becomes more accessible with a low barrier to entry for account holders

5. Frankly the whole mantra thing is a source of embarassment and irritation to many OSGEO members - we get to replace it with something more mainstream and well understood.

6. It should make it easier for identify management services from OSGEO to be used in project web sites.

Disadvantages:

1. It requires a skilled maintainer to configure it.

2. It will require new resources for hosting

3. It will require change management as we introduce users to a new way of authenticating themselves.
   

No LLM was used in writing this motion.