OpenID Connect Support and Strict Mode #2144
Open
+5,978
−204
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #2097
🆑 Configuration
The new configuration version is 5.6.0.
Added
Security:OpenIDConnect
entries andSecurity:OidcStrictMode
. See the README for details.Security:OAuth:Keycloak
has been deprecated. Please migrate to an OIDC provider.Security:OAuth:TGForums
has been removed as the service is no longer provided./🆑
🆑
Added OpenID Connect support. See the README for details.
TGForums
OAuth has been removed as the service is no longer provided./🆑
🆑 REST API
Added
oidcProviderInfos
to server information model. These list afriendlyName
, user definablethemeColour
, and user definablethemeIconUrl
for indicating how to display OIDC providers. TheschemeKey
property is how authentication is performed. Send users to/oidc/{schemeKey}/signin
to start the OIDC flow. Users will be returned to a configured endpoint (/app
by default) with the query parameterstate
set tooidc.{schemeKey}
and either acode
indicating a TGS bearer token to use or a user readableerror
.Added
oidcConnections
to users, similar tooAuthConnections
with the only difference being that theprovider
is replaced with aschemeKey
string. Modifiable with the same right./:cl:
🆑 GraphQL API
Added OIDC related fields.
Renamed
adminUserCannotOAuth
toadminUserCannotHaveServiceConnection
.Renamed
editOwnOAuthConnections
toeditOwnServiceConnections
./:cl:
🆑 Nuget: API
Added
UserApiBase.OidcConnections
.Renamed
ErrorCode.AdminUserCannotOAuth
toAdminUserCannotHaveServiceConnection
.Renamed
AdministrationRights.EditOwnOAuthConnections
toEditOwnServiceConnections
.Made deprecated
OAuthProvider
sObsolete
.Added
OidcProviderInfos
andOidcStrictMode
toServerInformationResponse
./:cl:
🆑 Nuget: Client
Updated to API library version 18.0.0.
/:cl:
TODO: