nick/rfid-database
1
0
Fork 0
mirror of https://github.com/Chewbaccalakis/rfid-database.git synced 2026-09-09 16:01:56 -07:00
Code Issues Packages Projects Releases Wiki Activity

Fix OIDC: enable from runtime AUTH_OIDC_* (no NEXT_PUBLIC flag) (#5)

Browse Source 
The SSO button required NEXT_PUBLIC_AUTH_OIDC_ENABLED, which is baked
at build time and silently fails under Docker runtime env. Drive the
login button from server-side AUTH_OIDC_* instead, and document IdP
redirect URI + AUTH_URL setup.

Co-authored-by: Cursor Agent <[email protected]>
This commit is contained in:
Nick Trochalakis
2026-08-24 00:13:51 +00:00
committed by GitHub
co-authored by Cursor Agent
parent 0e50c537ee
commit 6d76fecde9
8 changed files with 213 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+30 -6
View File
@@ -30,13 +30,37 @@ Open http://localhost:3000 and sign in.
| Variable | Required | Description |
|----------|----------|-------------|
| `AUTH_SECRET` | yes | NextAuth secret |
| `AUTH_URL` | recommended | Public app URL (e.g. `https://rfid.example.com`) |
| `RFID_DB_PATH` | no | SQLite path (default `./data/rfid.db`) |
| `AUTH_OIDC_ISSUER` | no | OIDC issuer URL |
| `AUTH_OIDC_CLIENT_ID` | no | OIDC client id |
| `AUTH_OIDC_CLIENT_SECRET` | no | OIDC client secret |
| `AUTH_OIDC_NAME` | no | Button label (default `SSO`) |
| `NEXT_PUBLIC_AUTH_OIDC_ENABLED` | no | Set `1` to show SSO button |
| `NEXT_PUBLIC_AUTH_OIDC_NAME` | no | Public SSO button label |
| `AUTH_OIDC_ISSUER` | for OIDC | Issuer URL (must expose `/.well-known/openid-configuration`) |
| `AUTH_OIDC_CLIENT_ID` | for OIDC | OIDC client id |
| `AUTH_OIDC_CLIENT_SECRET` | for OIDC | OIDC client secret |
| `AUTH_OIDC_NAME` | no | SSO button label (default `SSO`) |
### Enabling OIDC
1. In your IdP, create a **confidential** OIDC application.
2. Set the redirect / callback URI to:
```
{AUTH_URL}/api/auth/callback/oidc
```
Example: `http://localhost:3000/api/auth/callback/oidc`
3. Put these in `.env` (Docker Compose reads `.env` automatically):
```bash
AUTH_URL=http://localhost:3000
AUTH_SECRET=...long random...
AUTH_OIDC_ISSUER=https://sso.example.com/application/o/rfid/
AUTH_OIDC_CLIENT_ID=...
AUTH_OIDC_CLIENT_SECRET=...
AUTH_OIDC_NAME=Authentik
```
4. Restart the app (`docker compose up -d` or restart `npm run dev`).
5. Open `/login` — you should see **Sign in with Authentik** (or your `AUTH_OIDC_NAME`).
Notes:
- `AUTH_OIDC_ISSUER` must be exactly the issuer value from discovery (trailing slash matters for some IdPs).
- The IdP must return an **email** claim; accounts are created/linked by email.
- Local password login stays available alongside SSO.
## REST API (`/api/v1`)