gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-12 11:47:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(sso): harden Custom OIDC provider and SSO configuration (#630)

Browse Source 
- Add Host header injection validation for OAuth callback URL derivation
  when SSO_CALLBACK_URL is not set (extracted into shared getSSOBaseUrl helper)
- Add startup warning when OIDC providers are enabled without SSO_CALLBACK_URL
- Add diagnostic logging for claim fallback, email changes on re-login,
  and admin seat limit enforcement (gated behind Developer Mode)
- Add Custom OIDC environment variables to .env.example
- Fix stale AdmiralGate comment in SSOSection.tsx
- Fix .env.example section header referencing removed Admiral tier gate
- Fix docs: correct Custom OIDC display name default, replace nonexistent
  DEBUG=true env var reference with Developer Mode toggle
- Add tests for role enforcement (viewer 403), API token scope denial,
  OIDC claim edge cases, Custom OIDC test connection, callback error params
- Refresh SSO settings screenshots
This commit is contained in:
Anso
2026-04-16 08:10:28 -04:00
committed by GitHub
parent 9036096c02
commit 6890224903
10 changed files with 179 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/features/sso.mdx
+2 -2
View File
@@ -192,7 +192,7 @@ Environment variables are useful for initial deployment or infrastructure-as-cod
| Variable | Default | Description |
|----------|---------|-------------|
| `SSO_OIDC_CUSTOM_ENABLED` | `false` | Enable the custom OIDC provider |
| `SSO_OIDC_CUSTOM_DISPLAY_NAME` | `oidc_custom` | Label shown on the login button |
| `SSO_OIDC_CUSTOM_DISPLAY_NAME` | `Custom OIDC` | Label shown on the login button |
| `SSO_OIDC_CUSTOM_ISSUER_URL` | - | OIDC issuer URL (the base of the discovery endpoint) |
| `SSO_OIDC_CUSTOM_CLIENT_ID` | - | OAuth client ID from your identity provider |
| `SSO_OIDC_CUSTOM_CLIENT_SECRET` | - | OAuth client secret (encrypted at rest) |
@@ -298,7 +298,7 @@ Fix: set the Issuer URL to exactly match the `issuer` field returned by your pro
If users are created with incorrect usernames or missing emails:
- Enable debug mode (`DEBUG=true` environment variable) to see the raw claims Sencho receives from the provider
- Enable **Developer Mode** (Settings > Developer Mode toggle) to see the raw claims Sencho receives from the provider in the server logs
- Check your provider's documentation for which claims it includes in the ID token and userinfo response
- Verify that the scopes you configured include the necessary permissions (some providers require explicit `profile` or `email` scopes)
- Set the appropriate claim names in the Custom OIDC claim mapping fields