feat: add OIDC SSO support for Google Meet bot login

[degitgitagitya]

Background

Our company has been using Attendee in production and it has been a great foundation for our meeting bot infrastructure. One of the key requirements for our deployment is SSO support for Google Meet bot login — specifically via OIDC (OpenID Connect), which is simpler to set up compared to SAML (no certificate generation or xmlsec1 dependency required).

We've been running this feature in our internal fork for a while and would like to contribute it back to the community.

What this PR does

Adds OIDC as an alternative SSO method for GoogleMeetBotLogin, while keeping the existing SAML support fully intact. New deployments can opt into OIDC via a sso_mode field.

Changes:

• Add sso_mode field to GoogleMeetBotLogin model (default: "saml" for backwards compatibility)
• Implement full OIDC IdP: discovery, authorize, token (with PKCE), JWKS, and userinfo endpoints
• Add RSA key management for JWT signing (oidc_keys.py)
• Update bot adapter to branch Chrome options by sso_mode
• Add email entry automation for OIDC Google sign-in flow
• Update login creation UI with SAML/OIDC radio toggle
• Add OIDC credentials modal for auto-generated client_id/secret
• Add comprehensive OIDC test suite (17 tests) alongside existing SAML tests
• Update documentation with OIDC setup instructions
• Validate response_type=code and require redirect_uri per RFC
• Fail loudly when OIDC keys are not configured in production

Motivation: Google Workspace now supports custom OIDC profiles for SSO

As per the Google Workspace announcement (November 2025), Single Sign-On with custom OpenID Connect profiles is now generally available. Admins can now set up a custom OIDC profile for SSO with Google as the service provider — previously, only SAML and OIDC with pre-configured Microsoft Entra ID were supported.

This means Google Meet bot login via OIDC SSO is now a fully supported and recommended path for Google Workspace customers. This PR aligns Attendee with that capability, allowing bots to authenticate via a custom OIDC identity provider configured by the admin.

Backwards Compatibility

Fully backwards compatible — existing SAML configurations are unaffected. The default sso_mode is "saml".

[noah-duncan]

Hi @degitgitagitya, thanks for the PR!

When I first added the signed-in google bot feature, I was wondering if maybe OIDC was the way to go instead of SAML, glad to hear that it works. Will give this a more detailed review when we have more time.

[degitgitagitya]

Hi @degitgitagitya, thanks for the PR!

When I first added the signed-in google bot feature, I was wondering if maybe OIDC was the way to go instead of SAML, glad to hear that it works. Will give this a more detailed review when we have more time.

Hi @noah-duncan ,

Sure, take your time! Since custom OIDC SSO for Google is relatively new (GA'd November 2025), this might actually be one of the first implementations in a meeting bot use case.

[noah-duncan]

Hey @degitgitagitya thanks again for the PR. Just had a few questions on this before we incorporate it into our codebase.

1. Were you running this in your "main" google workspace instance that also has regular user accounts or a dedicated google workspace just for bots?
2. Did you have any issues with Google asking for SMS or 2fa verification?