feat: add generic OIDC provider for self-hosted identity providers

Adds support for any OpenID Connect compliant identity provider:
- Authentik
- Authelia
- Keycloak
- Okta
- Any other OIDC provider

Configuration via environment variables:
- SOCIAL_AUTH_OIDC_OIDC_ENDPOINT: Discovery endpoint
- SOCIAL_AUTH_OIDC_KEY: Client ID
- SOCIAL_AUTH_OIDC_SECRET: Client secret
- SOCIAL_AUTH_OIDC_NAME: Optional custom button text

Closes #140

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/tabby/app/api/auth.py

@@ -37,6 +37,12 @@ PROVIDER_CONFIG = {
         'cls': 'btn-dark',
         'env_prefix': 'SOCIAL_AUTH_AUTH0',
     },
+    'oidc': {
+        'name': 'SSO',  # Generic name, can be overridden via SOCIAL_AUTH_OIDC_NAME
+        'icon': 'openid',  # OpenID icon
+        'cls': 'btn-info',
+        'env_prefix': 'SOCIAL_AUTH_OIDC',
+    },
 }
 
 
@@ -48,9 +54,19 @@ def is_provider_configured(env_prefix: str) -> bool:
     if env_prefix == 'SOCIAL_AUTH_AUTH0':
         domain = getattr(settings, f'{env_prefix}_DOMAIN', None)
         return bool(key and secret and domain)
+    # For generic OIDC, also need OIDC_ENDPOINT
+    if env_prefix == 'SOCIAL_AUTH_OIDC':
+        endpoint = getattr(settings, f'{env_prefix}_OIDC_ENDPOINT', None)
+        return bool(key and secret and endpoint)
     return bool(key and secret)
 
 
+def get_provider_display_name(env_prefix: str, default_name: str) -> str:
+    """Get custom display name for a provider, if configured."""
+    custom_name = getattr(settings, f'{env_prefix}_NAME', None)
+    return custom_name if custom_name else default_name
+
+
 class LogoutView(APIView):
     def post(self, request, format=None):
         logout(request)
@@ -66,7 +82,9 @@ class ProvidersView(APIView):
             if is_provider_configured(config['env_prefix']):
                 providers.append({
                     'id': provider_id,
-                    'name': config['name'],
+                    'name': get_provider_display_name(
+                        config['env_prefix'], config['name']
+                    ),
                     'icon': config['icon'],
                     'cls': config['cls'],
                 })

backend/tabby/settings.py

@@ -141,6 +141,7 @@ AUTHENTICATION_BACKENDS = (
     "social_core.backends.microsoft.MicrosoftOAuth2",
     "social_core.backends.google.GoogleOAuth2",
     "social_core.backends.auth0.Auth0OAuth2",
+    "social_core.backends.open_id_connect.OpenIdConnectAuth",
     "django.contrib.auth.backends.ModelBackend",
 )
 
@@ -188,6 +189,10 @@ for key in [
     "SOCIAL_AUTH_AUTH0_DOMAIN",
     "SOCIAL_AUTH_AUTH0_KEY",
     "SOCIAL_AUTH_AUTH0_SECRET",
+    "SOCIAL_AUTH_OIDC_OIDC_ENDPOINT",
+    "SOCIAL_AUTH_OIDC_KEY",
+    "SOCIAL_AUTH_OIDC_SECRET",
+    "SOCIAL_AUTH_OIDC_NAME",
     "CONNECTION_GATEWAY_AUTH_CA",
     "CONNECTION_GATEWAY_AUTH_CERTIFICATE",
     "CONNECTION_GATEWAY_AUTH_KEY",