nick/rfid-database
1
0
Fork 0
mirror of https://github.com/Chewbaccalakis/rfid-database.git synced 2026-09-09 16:01:56 -07:00
Code Issues Packages Projects Releases Wiki Activity

Harden OIDC + auth config diagnostics endpoint (#6)

Browse Source 
Request openid email profile, use client_secret_post, surface OIDC
errors on /login, and expose a no-auth diagnostics endpoint so operators
can verify the running container sees AUTH_OIDC_* and the callback URL.

Co-authored-by: Cursor Agent <[email protected]>
This commit is contained in:
Nick Trochalakis
2026-08-24 03:57:29 +00:00
committed by GitHub
co-authored by Cursor Agent
parent 6d76fecde9
commit cd1a2fe808
5 changed files with 132 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+22 -12
View File
@@ -39,28 +39,38 @@ Open http://localhost:3000 and sign in.
### Enabling OIDC
1. In your IdP, create a **confidential** OIDC application.
2. Set the redirect / callback URI to:
1. **Pull latest and rebuild** (OIDC button detection changed recently):
```bash
git pull
docker compose up -d --build
```
2. In your IdP, create a **confidential** OIDC application.
3. Set the redirect / callback URI to **exactly**:
```
{AUTH_URL}/api/auth/callback/oidc
```
Example: `http://localhost:3000/api/auth/callback/oidc`
3. Put these in `.env` (Docker Compose reads `.env` automatically):
Example: `https://rfid.atlashorizon.net/api/auth/callback/oidc`
4. Put these in `.env`:
```bash
AUTH_URL=http://localhost:3000
AUTH_URL=https://rfid.atlashorizon.net
AUTH_SECRET=...long random...
AUTH_OIDC_ISSUER=https://sso.example.com/application/o/rfid/
AUTH_OIDC_CLIENT_ID=...
AUTH_OIDC_ISSUER=https://auth.atlashorizon.net
AUTH_OIDC_CLIENT_ID=rfiddb
AUTH_OIDC_CLIENT_SECRET=...
AUTH_OIDC_NAME=Authentik
AUTH_OIDC_NAME=AtlasHorizon
```
4. Restart the app (`docker compose up -d` or restart `npm run dev`).
5. Open `/login` — you should see **Sign in with Authentik** (or your `AUTH_OIDC_NAME`).
5. Restart, then verify the running app sees config (no secrets returned):
```bash
curl -s https://rfid.atlashorizon.net/api/v1/auth/config | jq
```
You want `"oidcEnabled": true` and `"callbackUrl"` matching your IdP.
6. Open `/login` — you should see **Sign in with AtlasHorizon**.
Notes:
- `AUTH_OIDC_ISSUER` must be exactly the issuer value from discovery (trailing slash matters for some IdPs).
- The IdP must return an **email** claim; accounts are created/linked by email.
- `AUTH_OIDC_ISSUER` must match discovery (`{issuer}/.well-known/openid-configuration`). Your AtlasHorizon issuer at `https://auth.atlashorizon.net` is valid.
- The IdP must return an **email** claim (we request `openid email profile`).
- Local password login stays available alongside SSO.
- If the button is missing, you are almost certainly on an old image — rebuild.
## REST API (`/api/v1`)