cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

feat(oidc): add auto-redirect for OIDC

Browse Source 
add `auto_redirect_if_standalone_oidc` in `OXICLOUD_AUTH_POLICIES`
let admin decide to redirect immediately to IdP if OIDC is the only auth method enabled
This commit is contained in:
Edouard Vanbelle
2026-08-03 00:22:19 +02:00
parent b91f2fab2b
commit 5ebe2d3bae
12 changed files with 144 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/config/authentication.md
+1
View File
@@ -122,6 +122,7 @@ The verification-piggyback flow above deliberately **bypasses the `has_password`
| Token | Effect |
| --- | --- |
| `permit_magic_link_for_password_users` | Allow magic-link login for accounts that also have a password. OIDC-linked users are still refused. |
| `auto_redirect_if_standalone_oidc` | When OIDC is the ONLY working login method (no password, no magic-link — via allowlist or the OIDC-master rule), the login SPA auto-redirects to the IdP on page load instead of showing a click-to-continue SSO button. Off by default to avoid redirect loops on IdP failure and to preserve logout UX (logging out then visiting `/login` would otherwise bounce the user right back in). Silent no-op when other methods are also live. Frontend reads this via `auto_redirect_to_oidc` on `GET /api/auth/oidc/providers`. |
Unknown tokens are logged-and-skipped at startup so a typo doesn't silently zero the vector.