feat: SSO/OIDC provider integration (Sprint 20)#136
Merged
Conversation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…y impl Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Implements all 7 methods of the OIDCProviderStore interface for the SQLite storage backend: CreateProvider, GetProvider, GetProviderByIssuer, ListProviders, ListEnabledProviders, UpdateProvider, and DeleteProvider. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add claims.go with Claims struct and MapRole function for IdP group-to-role mapping. Add provider.go wrapping coreos/go-oidc + oauth2 with NewProvider (OIDC discovery), AuthCodeURL, and Exchange methods. Includes mock OIDC server tests with RSA-signed JWTs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add a 30-second TTL cache for user active-status lookups in the session authentication path. Deactivated users are now blocked within 30 seconds of deactivation without adding a DB query per request. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Check local_auth_enabled setting before accepting password login. When disabled, returns 403 directing users to SSO. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add handleOIDCLogin (redirect to IdP), handleOIDCCallback (exchange code, JIT user provisioning, session creation), handleOIDCRefresh (silent re-auth), and handleListPublicProviders. Includes comprehensive test coverage. Also adds GetByOIDCIdentity to UserStore interface with implementations for memory, SQLite, and PostgreSQL stores. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add admin endpoints for managing OIDC provider configurations:
- GET/POST /api/v1/settings/oidc/providers (list, create)
- GET/PATCH/DELETE /api/v1/settings/oidc/providers/{id}
- POST /api/v1/settings/oidc/providers/{id}/test (discovery test)
Client secrets are encrypted at rest (AES-256-GCM) and masked in
API responses.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add useOIDCProviders hook to fetch enabled OIDC providers.
Show "Sign in with {name}" buttons below the login form when
OIDC providers are configured. Uses direct server redirect
to the identity provider's authorization endpoint.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Initialize OIDCProviderStore, encryption key, and OIDCServer. Register OIDC public routes and admin routes. Add OIDC paths to CSRF exemption list. Wire settingsStore into UserServer for local auth toggle. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace SSO/OIDC placeholder with full provider management: - Provider list with add/edit/delete - Provider config form (issuer, client ID/secret, scopes, roles) - Test Connection button per provider - Role mapping configuration - Local auth toggle with confirmation - Add local_auth_enabled to SecuritySettings type Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add useSessionRefresh hook that monitors session lifetime and triggers prompt=none re-auth when session enters last 20% of its lifetime. Update OIDC callback to detect iframe mode via Sec-Fetch-Dest header and return postMessage instead of redirect. Extend /auth/me response with auth_provider and session_expires_at. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…bles - HTML-escape errParam in OIDC callback iframe response to prevent reflected XSS (CodeQL go/reflected-xss) - URL-encode errParam in redirect to prevent parameter injection - Add users, sessions, and settings table creation to PostgreSQL migration 0017, since these tables only existed in SQLite migrations Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
coreos/go-oidc/v3+golang.org/x/oauth2with Authorization Code Flowprompt=nonehidden iframe for OIDC usersDualAuthMiddleware(30s TTL viasync.Map)New API Endpoints
GET /api/v1/auth/oidc/providers— list enabled providers (public)GET /api/v1/auth/oidc/login— initiate OIDC login flowGET /api/v1/auth/oidc/callback— handle IdP callback with JIT provisioningPOST /api/v1/auth/oidc/refresh— silent re-auth redirect URLGET/POST /api/v1/settings/oidc/providers— admin list/createGET/PATCH/DELETE /api/v1/settings/oidc/providers/{id}— admin CRUDPOST /api/v1/settings/oidc/providers/{id}/test— test provider discoveryNew Environment Variables
CLOUDPAM_OIDC_ENCRYPTION_KEY— 32-byte hex AES key (auto-generated if unset)CLOUDPAM_OIDC_CALLBACK_URL— callback URL (default:http://localhost:8080/api/v1/auth/oidc/callback)Test plan
go test ./... -count=1)golangci-lint run ./...)go build ./cmd/cloudpam)go build -tags sqlite ./cmd/cloudpam)npx tsc --noEmit)npm run build)Closes #130, closes #131
🤖 Generated with Claude Code