cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

feat(oidc): deprecate OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN

Browse Source
This commit is contained in:
Edouard Vanbelle
2026-08-03 21:36:49 +02:00
parent ac32595846
commit d065f99952
5 changed files with 45 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/config/authentication.md
+1 -1
View File
@@ -65,7 +65,7 @@ Comma-separated allowlist of `password`, `magic_link`, and/or `oidc`. Default (w
**OIDC master rule.** When OIDC is enabled, magic-link login is **hard-disabled** regardless of this list. The IdP is the identity boundary; magic-link would bypass any 2FA / step-up policy the IdP enforces. The startup gate above does **not** trigger in this case — OIDC provides the login path.
Legacy alias: `OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN=true` still removes `password` from the effective allowlist.
**DEPRECATED** alias: `OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN=true` still removes `password` from the effective allowlist. Setting it emits a boot warning; the flag will be removed in the next major release. Migrate to `OXICLOUD_AUTH_METHODS=oidc` (and add `OXICLOUD_AUTH_POLICIES=auto_redirect_if_standalone_oidc` if you want the server-side `/login` redirect too).
### `OXICLOUD_REQUIRE_VERIFIED_EMAIL`