We recently implemented OIDC on production datahub and auth/login seems to be working great.
However, there are some challenges with the user journey during login and logout that are specific to datahub. Due to the change, we see a couple of different login screens depending on where/how we log in, these are the expected SSO login page and the previous JAAS login page. Login in via http://datahub.wikimedia.org/login does not redirect us to the SSO login but instead takes us to the takes us to the previous user login page ie.
From this page, the login with SSO button works as expected, but login via the username and password fields is disabled also as expected. However, this is not ideal and the user journey is a bit confusing.
The native login interface is disabled as per datahub configure-oidc-react Which states "Note that by default, enabling OIDC will not disable the dummy JAAS authentication path, which can be reached at the /login route of the React app. To disable this authentication path, additionally specify the following config: AUTH_JAAS_ENABLED=false" and as implemented.
AUTH_JAAS_ENABLED: false AUTH_NATIVE_ENABLED: false
On logout, the user is also redirected to the previous login page, we might want to change the redirect on logout to go to a different screen.