Add generic OpenID Connect external auth provider #6

Merged

cheapnud merged 2 commits from d/oidc-provider into master

2026-08-17 12:02:09 +00:00

cheapnud commented

2026-08-17 11:56:07 +00:00

Owner

No description provided.

cheapnud added 1 commit

2026-08-17 11:56:07 +00:00

add generic OpenID Connect external auth provider

Claude PR Review / AI Code Review (pull_request) Successful in 15s

Details

Build / Build and Test (pull_request) Successful in 2m19s

Details

9024d339b8

forgejo-actions commented

2026-08-17 11:56:37 +00:00

🤖 Claude AI Code Review

Summary
Adds a generic OIDC external auth provider with PKCE, group-to-role mapping, and discovery-based configuration. Clean integration into the existing OAuth extension pattern.

Code Quality ⭐⭐⭐⭐☆
Well-documented, sensible defaults, and thoughtful handling of userinfo claim quirks across IdPs.

Issues

🟡 OAuthBlazorExtensions.cs — AddOpenIdConnectAuth registers services.AddSingleton(oidcOptions) as OpenIdConnectAuthOptions, but calling it twice (multiple OIDC providers, which the docs explicitly encourage via unique schemes) will overwrite the singleton. MapOAuthEndpoints only resolves a single OpenIdConnectAuthOptions, so only the last-registered provider gets endpoints mapped. Either document single-provider only, or key the registration by scheme.

🟢 OpenIdConnectAuthOptions.cs — ClientSecret can be null/empty with no validation; only Authority is checked. For confidential clients using code flow this will fail at runtime with a less clear error. Minor, since public clients with PKCE are valid.

🟢 OAuthBlazorExtensions.cs — RoleClaimType/NameClaimType are set on TokenValidationParameters, but groups come from the userinfo endpoint (GetClaimsFromUserInfoEndpoint = true), not the id_token. The ClaimActions.MapJsonKey handles that mapping, so this is fine — just confirm groups actually land as expected given both paths are configured.

Verdict: REQUEST CHANGES

Fix the singleton registration/resolution so multiple OIDC providers (as the XML docs advertise) actually work, or explicitly restrict to a single OIDC provider and update the docs accordingly.

📊 Tokens: 5631 input + 654 output | 💰 Cost: ~$0.0445
Generated by Claude Opus 4.8 via Gitea Actions

## 🤖 Claude AI Code Review **Summary** Adds a generic OIDC external auth provider with PKCE, group-to-role mapping, and discovery-based configuration. Clean integration into the existing OAuth extension pattern. **Code Quality** ⭐⭐⭐⭐☆ Well-documented, sensible defaults, and thoughtful handling of userinfo claim quirks across IdPs. **Issues** 🟡 OAuthBlazorExtensions.cs — `AddOpenIdConnectAuth` registers `services.AddSingleton(oidcOptions)` as `OpenIdConnectAuthOptions`, but calling it twice (multiple OIDC providers, which the docs explicitly encourage via unique schemes) will overwrite the singleton. `MapOAuthEndpoints` only resolves a single `OpenIdConnectAuthOptions`, so only the last-registered provider gets endpoints mapped. Either document single-provider only, or key the registration by scheme. 🟢 OpenIdConnectAuthOptions.cs — `ClientSecret` can be null/empty with no validation; only `Authority` is checked. For confidential clients using code flow this will fail at runtime with a less clear error. Minor, since public clients with PKCE are valid. 🟢 OAuthBlazorExtensions.cs — `RoleClaimType`/`NameClaimType` are set on `TokenValidationParameters`, but groups come from the userinfo endpoint (`GetClaimsFromUserInfoEndpoint = true`), not the id_token. The `ClaimActions.MapJsonKey` handles that mapping, so this is fine — just confirm groups actually land as expected given both paths are configured. **Verdict**: REQUEST CHANGES - Fix the singleton registration/resolution so multiple OIDC providers (as the XML docs advertise) actually work, or explicitly restrict to a single OIDC provider and update the docs accordingly. --- 📊 **Tokens**: 5631 input + 654 output | 💰 **Cost**: ~$0.0445 *Generated by Claude Opus 4.8 via Gitea Actions*

cheapnud added 1 commit

2026-08-17 11:59:41 +00:00

state pkce explicitly, document scope and multi-provider caveats

Claude PR Review / AI Code Review (pull_request) Successful in 17s

Details

Build / Build and Test (pull_request) Successful in 2m25s

Details

4c37d0414e

cheapnud merged commit 022f7e86d6 into master

2026-08-17 12:02:09 +00:00

cheapnud deleted branch d/oidc-provider

2026-08-17 12:02:09 +00:00