lafleur
e9b387414f
add services::oidc::user_and_device_from_token(), use in auth
2025-11-11 11:34:26 -05:00
lafleur
426b113c30
OIDC: embed user_id in consent
2025-11-11 11:34:26 -05:00
lafleur
769db9b818
add some OIDC docstrings
2025-11-11 11:34:26 -05:00
lafleur
27d9d1d78d
fix oxide-auth's redirect_uri comparison
...
oxide-auth's `RegisteredUrl::IgnorePortOnLocalhost` doesn't work when the host is 127.0.0.1 or [::1].
This commit lets the authentication process translate the host. The new registrar already supports this.
2025-11-11 11:34:26 -05:00
lafleur
d916bb9f21
support OIDC private clients
2025-11-11 11:34:26 -05:00
lafleur
4e50064740
oidc: add debug/trace logs
2025-11-11 11:34:26 -05:00
Jade Ellis
0c333c9a05
chore: fix up
2025-11-11 11:34:26 -05:00
lafleur
b9b3a466f4
oidc: small cosmetics + typos
2025-11-11 11:34:26 -05:00
lafleur
3803f06392
remove stale debugging logs
...
I don't have the hd space to do debug builds, so I use tracing::info to debug
on release builds. Silly, right ?
2025-11-11 11:34:26 -05:00
lafleur
cadcbd7d49
use config.server_name as title in OIDC pages
2025-11-11 11:34:26 -05:00
lafleur
144036f58b
fix oidc_provider discovery message and docstrings
2025-11-11 11:34:26 -05:00
lafleur
2afe656e12
typos oidc_provider discovery
2025-11-11 11:34:26 -05:00
Jade Ellis
1ce1254514
fix: Don't crash when the client URL doesn't have a domain
...
Having a URL with an IP literal, for example, is allowed
2025-11-11 11:34:26 -05:00
Jade Ellis
e75f5cbbed
chore: Fix most clippy issue, format & typos
2025-11-11 11:34:26 -05:00
lafleur
97c692b052
remove stale dependency oxide-auth-axum
2025-11-11 11:34:26 -05:00
lafleur
a586ea390c
feat(oidc_provider) use askama templates
...
Implements a custom OidcResponse with CSP headers and oxide-auth processing
compatibility.
2025-11-11 11:34:26 -05:00
lafleur
aafc93f6fb
impl MSC2966: register clients dynamically
2025-11-11 11:34:26 -05:00
lafleur
cd0c3886fb
impl MSC2964: OIDC token flow
2025-11-11 11:34:26 -05:00
lafleur
be4ccbc11b
impl MSC2965: self-advertise as OIDC authentication provider
...
MSC2965 proposes to let the homeserver advertise its current OIDC authentication
issuer. These changes let conduwuit advertise itself as the issuer when
[global.auth.enable_oidc_login] is set. It also advertises its account management
endpoint if [global.auth.enable_oidc_account_management] is set.
None of these endpoints are implemented. This commit only implements the bare
advertisement, as requested by the MSC.
2025-11-11 11:34:26 -05:00
lafleur
Jade Ellis