cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

feat(passwordless): pass4: add env variable to enable mgaiclink on account with password

Browse Source 
OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS (default false)
    For security I recommand to keep it false
    OIDC cannot be bypassed because OIDC may have MFA in place
This commit is contained in:
Edouard Vanbelle
2026-06-02 22:30:00 +02:00
parent 9a49ab44d8
commit 130ff363dc
4 changed files with 188 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
example.env
+14
View File
@@ -402,6 +402,20 @@ OXICLOUD_WOPI_ENABLED=false
# for client IP resolution. Default 200/hour.
#OXICLOUD_MAGIC_LINK_SEND_PER_IP_PER_HOUR=200
# Policy switch: should magic-link sign-in be offered to users who already
# have a password configured?
# false (default, strict) — users with a password are audit-logged
# `has_password` and receive no mail. Their password is the only
# authentication path; magic-link would weaken it to "mailbox
# compromise = account compromise".
# true (lenient) — users with a password can also request a
# magic-link as a sign-in path. Aligns with modern SaaS UX
# (Slack, Notion, etc.). Operators who already treat email as the
# canonical password-reset channel pick this.
# OIDC-linked users are ALWAYS rejected regardless of this flag — the
# IdP is the security boundary and may enforce MFA we shouldn't bypass.
#OXICLOUD_MAGIC_LINK_OPEN_TO_PASSWORD_USERS=false
# -----------------------------------------------------------------------------
# PROXY
# -----------------------------------------------------------------------------