cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

feat(oidc): add oidc method in OXICLOUD_AUTH_METHODS

Browse Source 
permit an admin to specify `oidc` only as the only method to login/register
note that if OIDC is enabled, the engine always append oidc in OXICLOUD_AUTH_METHODS
we could move to an explicit declaration in a major release
This commit is contained in:
Edouard Vanbelle
2026-08-03 00:11:49 +02:00
parent 02db85c040
commit b91f2fab2b
6 changed files with 144 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
example.env
+41 -24
View File
@@ -700,40 +700,57 @@ OXICLOUD_WOPI_ENABLED=false
#OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS=mycompany.com,mycompany-eu.com
# ---------------------------------------------------------------------------
# OXICLOUD_AUTH_METHODS — self-service authentication method allowlist.
# OXICLOUD_AUTH_METHODS — authentication method allowlist.
# ---------------------------------------------------------------------------
# Comma-separated list of `password` and/or `magic_link`. Controls which
# self-service authentication methods this deployment offers on the login
# page and accepts at the corresponding endpoints. OIDC is orthogonal —
# use `OXICLOUD_OIDC_ENABLED` for that.
# Comma-separated list of `password`, `magic_link`, and/or `oidc`. Controls
# which authentication methods this deployment offers on the login page
# and accepts at the corresponding endpoints.
#
# FAIL-FAST semantics — misconfiguration crashes the server at boot with
# a specific error, never silently degrades:
# * Unknown token (e.g. `password,sso2`) → panic on startup
# * Empty allowlist (e.g. `OXICLOUD_AUTH_METHODS=`) → panic
# * `oidc` in the list but `OXICLOUD_OIDC_ENABLED != true` → panic
# ("advertising a login method the server can't serve")
#
# LOOSE SEMANTIC (documented) — the reverse of the last bullet is NOT
# fatal today: when this list is explicitly set WITHOUT `oidc` but
# `OXICLOUD_OIDC_ENABLED=true`, OIDC is served in addition to the
# listed methods. The enabled flag wins. A warning is logged at boot
# telling the admin to reconcile. This will escalate to a fail-fast
# panic in the next major release — align configs now to avoid the
# breaking change.
#
# Semantics per configuration:
# * Empty (unset) or `password,magic_link` — both methods allowed
# (default). Matches pre-flag behaviour.
# * `password` — `POST /api/auth/login` OK,
# magic-link send / redeem
# return 403 `MagicLinkLoginDisabled`.
# * `magic_link` — `POST /api/auth/login`
# returns 403 `PasswordLoginDisabled`;
# password-based `register`
# returns 403 `PasswordRegistrationDisabled`.
# * Unset — permissive default
# (password + magic_link;
# OIDC gated by its own flag).
# * `password` — password login only.
# * `magic_link` — magic-link login only
# (requires SMTP; see gate below).
# * `oidc` — OIDC only, no local login.
# Cleanest "SSO-only" posture.
# * `password,oidc` — hybrid: local + SSO,
# no magic-link.
# * `password,magic_link,oidc` — everything on.
#
# SECURITY — startup gate. When `magic_link` is the ONLY method allowed
# but no SMTP transport is configured, the server refuses to start with a
# fatal message. A magic-link-only policy without a mail sender silently
# locks every user out of the deployment.
# SECURITY — startup gate. When `magic_link` is the ONLY working method
# (no `password`, no `oidc`) but no SMTP transport is configured, the
# server refuses to start. Prevents silently locking every user out.
#
# SECURITY — OIDC master rule. When `OXICLOUD_OIDC_ENABLED=true`, magic-
# link login is HARD-disabled regardless of what this list says. OIDC is
# the master identity provider; magic-link would sidestep any 2FA / step-
# up the IdP enforces. The startup gate above does NOT trigger in this
# case (OIDC provides a login path).
# SECURITY — OIDC master rule. When OIDC is enabled (either explicitly
# in this list or via `OXICLOUD_OIDC_ENABLED=true`), magic-link login is
# HARD-disabled regardless of what this list says. OIDC is the master
# identity provider; magic-link would sidestep any 2FA / step-up the
# IdP enforces.
#
# Legacy alias: `OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN=true` still removes
# `password` from this list. New deployments should prefer this env var.
#
# Default: password,magic_link
# Default (when unset): password + magic_link.
#OXICLOUD_AUTH_METHODS=password,magic_link
#OXICLOUD_AUTH_METHODS=oidc # OIDC-only (needs OIDC_ENABLED=true)
#OXICLOUD_AUTH_METHODS=password,oidc # hybrid local + SSO
# ---------------------------------------------------------------------------
# OXICLOUD_REQUIRE_VERIFIED_EMAIL — gate login on email verification.