OIDC enabled #8554
Closed
OIDC enabled #8554
+882
−65
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
|
Contributor
|
Caution Review failedThe pull request is closed. 📝 WalkthroughWalkthroughThis PR adds comprehensive OpenID Connect (OIDC) authentication support to the platform. It includes a new OIDC provider implementation, admin configuration interface, user-facing login button, backend endpoints with state and nonce validation, and configuration management across frontend and backend services. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant WebApp as Web App
participant Backend as Backend
participant OIDCProvider as OIDC Provider
participant Redis
User->>WebApp: Click OIDC Login Button
WebApp->>Backend: GET /auth/oidc (with optional next_path)
Backend->>Backend: Generate state & nonce
Backend->>Redis: Store nonce (state-scoped)
Backend->>Backend: Store nonce in session
Backend->>WebApp: Redirect to OIDC authorization URL
WebApp->>OIDCProvider: GET authorization endpoint
OIDCProvider->>User: Display login & consent screen
User->>OIDCProvider: Authenticate & grant consent
OIDCProvider->>WebApp: Redirect to callback with code & state
WebApp->>Backend: GET /auth/oidc/callback?code=X&state=Y
Backend->>Backend: Validate state vs session
Backend->>OIDCProvider: POST token endpoint (code, client_id, secret)
OIDCProvider->>Backend: Return access_token, id_token, refresh_token
Backend->>Backend: Validate ID token (JWKS, audience, issuer, nonce)
Backend->>Backend: Extract user info from ID token claims
Backend->>Backend: Create/update user account
Backend->>Backend: Log in user (is_app=True)
Backend->>WebApp: Redirect to final destination
WebApp->>User: Display authenticated app
sequenceDiagram
participant Admin as Admin User
participant AdminUI as Admin UI
participant Backend as Backend
participant Database as Database
Admin->>AdminUI: Navigate to OIDC settings page
AdminUI->>Backend: GET instance config (SWR)
Backend->>Database: Query instance configurations
Database->>Backend: Return OIDC config state
Backend->>AdminUI: Return formatted config
AdminUI->>Admin: Render form with current values
Admin->>AdminUI: Toggle IS_OIDC_ENABLED or enter credentials
AdminUI->>Backend: POST updateInstanceConfigurations
Backend->>Database: Update instance configuration
Database->>Backend: Confirm update
Backend->>AdminUI: Return success + updated config
AdminUI->>Admin: Show success toast & reset form
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Poem
✨ Finishing touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
OIDC enabled
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.