LeoVasanko/paskia
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

OAuth2 OpenID Connect provider support etc. #3

Merged
LeoVasanko merged 65 commits from oidconnect into main 2026-02-18 02:40:27 +00:00
Conversation 0 Commits 65 Files Changed 71
+3706 -805
LeoVasanko commented 2026-02-17 19:26:21 +00:00
Owner
Copy Link
Copy Source

Allows Paskia to authenticate the user to a client site.

  • User friendly client registration flow on the admin app
  • Redirect-based authentication flow (per spec)
  • Backchannel logout both ways to keep sessions synchronized
  • Groups integrated with Paskia's permission system- Adds email, preferred username and telephone fields on user profile
  • All new user basic info layout to show the new information, better looks
  • Various unrelated fixes to theming and layout
Allows Paskia to authenticate the user to a client site. - User friendly client registration flow on the admin app - Redirect-based authentication flow (per spec) - Backchannel logout both ways to keep sessions synchronized - Groups integrated with Paskia's permission system- Adds email, preferred username and telephone fields on user profile - All new user basic info layout to show the new information, better looks - Various unrelated fixes to theming and layout
LeoVasanko added 45 commits 2026-02-17 19:26:21 +00:00
Draft OpenID Connect support. b5a5f2707a
Stricter security. Moved to /auth/oidc/ 701b0810bd
Rename /auth/restricted/ to auth/restricted/{iframe,oidc} for clarity and separation. 8132189a04
Implement stateful OIDC as Session objects. Add refresh tokens and backchannel logout. 18722f0e01
Session keys hardened (namespaced hashes of tokens). Various cleanup. e59852b44c
Hardening OIDC verification. feeea30cb6
Database migration to add OIDC and convert to hardened sessions. d653a1db35
Route our new restricted endpoints correctly on vite dev. ebf5f6db2c
Remove some confusion between exchange and set-session endpoints, all using set-session now with a bearer code. Using codes in remote auth as well. Full separation of cookie and OIDC codes. eece6d4a21
Renamed OIDC permissions claim to more commonly used groups. Move jwtk to a more convenient location. Draft admin app OIDC client configuratioon. b73b2d6fe9
User friendly admin app OIDC Client dialog. Permissions domain scoping to OIDC Clients. e7e0097fba
[paskia-js] Inject styles when backdrop is needed for non-auth dialogs. 0081cc835b
Implement redirect URL autodiscovery (Trust On First Use - if none are manually defined). 09049d3094
Admin OIDC Client editing moved to its own page. 30aeb9a310
Add back missing ResetToken.delete() lost on earlier refactoring. 2a318adab4
Fix registration broken from earlier hardening. Streamline authentication and registration to avoid duplication of this. bcecb390e1
Correct OIDC mode handling in restricted app. ce68af5be3
Made PKCE and nonce optional, only when client wants them. fee833b908
Fix FastAPI token grant_type validation error when missing and form was sent by client. 21d1e123f5
Fix again, didn't work 72307fb7c3
Fix again, didn't work 5019cd13fe
Issuer problem debug. 5bc92ce983
Issuer problem debug. d0abd224f4
Issuer problem debug. 2e8439f876
Aud problem debug. ba3695cf88
OIDC authentication works, remove debug. b5e308d5df
Implement backchannel logout to client. f8c213c7dc
Fix tests for earlier changes. 627912fae5
Add preferred username and email to user data. 7523a49543
Group OIDC sessions correctly in profile view. d526b2a98d
Vite dev proxy ./well-known/openid-configuration 8c88e6e37c
Admin OIDC cleanup. 7c75947662
Consistent OIDC layout, admin app spacing. UX tuneup. 3a05120d06
Suggest icon URL for OIDC. 28f231da8e
Only use transparent background on the iframe. Restores default canvas color on forwarded and oidc where no original page exists behind. 239b9b436b
More robust/correct discovery and icon URL handling. fa53ba11f8
Note: icon optional a67fd77a32
New user basic info card and improved layout, telephone number and other contact details shown. 8128d40202
Simplified user info update APIs, DB and frontend to remove separate update functions for each property. Automatically choose preferred username for users as they register, based on display name. 7a09dbc040
Show credential UUID in logging as they are, no prettifying. 1800e4f295
Add theme toggles that were missing from forward and reset apps. 3f6b0de04c
Restore breadcrumb changes done a while back, lost in some edits. 6135bbd834
Remove top headers, cleanup. 72d2f3ac85
Final regression. 0dd169922f
Missing tooltip. 9ee6062484
LeoVasanko added 7 commits 2026-02-17 21:48:31 +00:00
Move __main__.py to paskia package, use samesite=strict for cookies. 69c456b0b3
More minimalistic light theme. UI hint for org admin user/role management. eafbdce4f8
API cleanup: msgspec structs for all JSON responses, aaguid icon normalization, User kw_only, migration v4. aae4117a38
Merge main into oidconnect (all main changes already applied or superseded) c79155a6eb
ruff check a52f1c318b
The pytest failures have been successfully resolved by fixing the API response structures, updating the test assertions to match the new nested response formats, and ensuring the database structs serialize correctly without breaking existing functionality. 9b23e7afbb
Fix earlier merges done from main which were incomplete. 04e7119ac8
LeoVasanko added 2 commits 2026-02-17 22:50:17 +00:00
Fix E2E tests, all passing. d330d98daf
Fix all remaining problems, pytest passing. 3e364e0b6f
LeoVasanko added 1 commit 2026-02-17 23:39:33 +00:00
Cleaner ed25519 key generation and storage in DB. Hide the value in DB logging and cleanup to remove non-color-support. 8d463e0118
LeoVasanko added 1 commit 2026-02-18 00:09:05 +00:00
Simpler migration, no support for dev versions. 1728aa1466
LeoVasanko added 3 commits 2026-02-18 01:03:32 +00:00
Don't use placeholder text for examples. 51f90d4c0d
Identify sessions by session key - a hash that can be safely shared. 99893fbb62
Identify sessions by session key - a hash that can be safely shared. 5750ae8e36
LeoVasanko added 2 commits 2026-02-18 01:41:09 +00:00
Combined admin/info endpoint, replaces old separate endpoints. 42dcb53577
GET user-info instead of POST 205e7afde2
LeoVasanko added 1 commit 2026-02-18 01:57:25 +00:00
Store Session.validated rather than Session.expires. Already handled in db migration that drops old sessions. 22b72b2d50
LeoVasanko added 1 commit 2026-02-18 02:05:10 +00:00
Fix passkey icons lost in refactoring. ee35e6b1ad
LeoVasanko added 1 commit 2026-02-18 02:23:42 +00:00
Fix a bug with moving users to different roles, still using old data structures. e02ec82ff3
LeoVasanko added 1 commit 2026-02-18 02:36:07 +00:00
Fix OIDC login that was still using old session key format. a0e09ebc71
LeoVasanko merged commit 4604a65646 into main 2026-02-18 02:40:27 +00:00
LeoVasanko deleted branch oidconnect 2026-02-18 02:40:27 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
LeoVasanko (Leo Vasanko)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LeoVasanko/paskia#3