lafleur
c46104ac0c
OIDC: fix build after rebase
2025-11-11 11:36:28 -05:00
lafleur
900ba33a4e
OIDC: impl client_registrar over db (sync impl)
2025-11-11 11:36:28 -05:00
lafleur
f2e696ae3e
OIDC auth flow: correct device registration
2025-11-11 11:36:04 -05:00
lafleur
1088aa5020
OIDC private clients: correct client secret
2025-11-11 11:36:04 -05:00
lafleur
5c2a5de7d3
unlimit log levels and update Cargo.lock
2025-11-11 11:36:04 -05:00
lafleur
600b8cb366
oidc: implement registering devices
2025-11-11 11:34:26 -05:00
lafleur
3bbbfcdd46
WIP: show discrepancy between device_id and client_id
2025-11-11 11:34:26 -05:00
lafleur
e9b387414f
add services::oidc::user_and_device_from_token(), use in auth
2025-11-11 11:34:26 -05:00
lafleur
426b113c30
OIDC: embed user_id in consent
2025-11-11 11:34:26 -05:00
lafleur
ddae8af99f
web::login: add form-data CSP rules for localhost
2025-11-11 11:34:26 -05:00
lafleur
769db9b818
add some OIDC docstrings
2025-11-11 11:34:26 -05:00
lafleur
27d9d1d78d
fix oxide-auth's redirect_uri comparison
...
oxide-auth's `RegisteredUrl::IgnorePortOnLocalhost` doesn't work when the host is 127.0.0.1 or [::1].
This commit lets the authentication process translate the host. The new registrar already supports this.
2025-11-11 11:34:26 -05:00
lafleur
2e34ac9f59
basic OIDC client registrar with auth tracing
2025-11-11 11:34:26 -05:00
lafleur
95632103bc
OIDC: make response_mode optional
...
Fractal omits the `response_mode` field when in an auth flow (its value must be
the literal "S256", so it's mainly here for OIDC compliance I guess). Accepting
this lets it proceed to the next authentication step.
2025-11-11 11:34:26 -05:00
lafleur
d916bb9f21
support OIDC private clients
2025-11-11 11:34:26 -05:00
lafleur
4e50064740
oidc: add debug/trace logs
2025-11-11 11:34:26 -05:00
lafleur
56bd11013f
oidc authorize: make response_mode optional
2025-11-11 11:34:26 -05:00
lafleur
8893bd1613
fix build warning : explicit cast
2025-11-11 11:34:26 -05:00
nexy7574
e7b9446b5a
fix build errors
2025-11-11 11:34:26 -05:00
Jade Ellis
bc23071dd4
fixup! fix OidcResponse: reimplement IntoResponse
2025-11-11 11:34:26 -05:00
lafleur
b602be0921
fix OidcResponse: reimplement IntoResponse
2025-11-11 11:34:26 -05:00
Jade Ellis
0c333c9a05
chore: fix up
2025-11-11 11:34:26 -05:00
lafleur
b9b3a466f4
oidc: small cosmetics + typos
2025-11-11 11:34:26 -05:00
lafleur
3803f06392
remove stale debugging logs
...
I don't have the hd space to do debug builds, so I use tracing::info to debug
on release builds. Silly, right ?
2025-11-11 11:34:26 -05:00
lafleur
cadcbd7d49
use config.server_name as title in OIDC pages
2025-11-11 11:34:26 -05:00
lafleur
144036f58b
fix oidc_provider discovery message and docstrings
2025-11-11 11:34:26 -05:00
lafleur
2afe656e12
typos oidc_provider discovery
2025-11-11 11:34:26 -05:00
lafleur
c89dfe38da
fix oidc_provider config section's doc generation
2025-11-11 11:34:26 -05:00
Jade Ellis
1ce1254514
fix: Don't crash when the client URL doesn't have a domain
...
Having a URL with an IP literal, for example, is allowed
2025-11-11 11:34:26 -05:00
Jade Ellis
5bd1bedad0
fix: Use correct CSP for login page
2025-11-11 11:34:26 -05:00
Jade Ellis
68ca6eabe3
chore: Ignore formatting PR in blame
2025-11-11 11:34:26 -05:00
Jade Ellis
e75f5cbbed
chore: Fix most clippy issue, format & typos
2025-11-11 11:34:26 -05:00
lafleur
97c692b052
remove stale dependency oxide-auth-axum
2025-11-11 11:34:26 -05:00
lafleur
a586ea390c
feat(oidc_provider) use askama templates
...
Implements a custom OidcResponse with CSP headers and oxide-auth processing
compatibility.
2025-11-11 11:34:26 -05:00
lafleur
dba528a5e0
rebase on current main
2025-11-11 11:34:26 -05:00
lafleur
aafc93f6fb
impl MSC2966: register clients dynamically
2025-11-11 11:34:26 -05:00
lafleur
cd0c3886fb
impl MSC2964: OIDC token flow
2025-11-11 11:34:26 -05:00
lafleur
be4ccbc11b
impl MSC2965: self-advertise as OIDC authentication provider
...
MSC2965 proposes to let the homeserver advertise its current OIDC authentication
issuer. These changes let conduwuit advertise itself as the issuer when
[global.auth.enable_oidc_login] is set. It also advertises its account management
endpoint if [global.auth.enable_oidc_account_management] is set.
None of these endpoints are implemented. This commit only implements the bare
advertisement, as requested by the MSC.
2025-11-11 11:34:26 -05:00
Ginger
9a5ba6171f
ci: Remove hardcoded default in setup-rust action
2025-11-11 10:37:03 -05:00
renovate
da3efa05b5
chore(Nix): Updated flake hashes
2025-11-11 15:07:05 +00:00
Ginger
b53ba2eef4
ci: Give flake hashes workflow permissions to push
2025-11-11 15:07:05 +00:00
Jade Ellis
33019c4529
chore: Update rust
2025-11-11 15:07:05 +00:00
Jade Ellis
f7bd9eaba8
chore(clippy): Remove old redundant lint
2025-11-11 13:59:12 +00:00
Jade Ellis
f9c42bbadc
refactor(clippy): Unused self
2025-11-11 13:59:12 +00:00
Jade Ellis
fe62c39501
style(clippy): Remove unneeded allocation
2025-11-11 13:59:12 +00:00
Jade Ellis
35320cf0d4
style(clippy): Elide lifetimes
2025-11-11 13:59:12 +00:00
Jade Ellis
eaf6a889c2
style(clippy): Unnecessary move
...
Function is used in a single place and the move doesn't seem to provide
any safety benefits, so 💨
2025-11-11 13:59:12 +00:00
Jade Ellis
b04f1332db
style(clippy): Remove dead code
...
Looks like this has been dead since we forked at least, seems pretty
safe to remove
2025-11-11 13:59:12 +00:00
Jade Ellis
9e4bcda17b
style(clippy): Make the event graph generic over the hasher
2025-11-11 13:59:12 +00:00
Jade
45e4053883
fix: Don't break when encountering the server user, as there may be real users after
2025-11-10 23:56:02 +00:00
lafleur
nexy7574
Jade Ellis
Ginger
renovate