Add support for delegated authentication with OIDC #1886

Merged
ginger merged 21 commits from ginger/oidc into main 2026-07-04 15:18:03 +00:00
Owner

Warning

This pull request bumps the database version and therefore is not backwards compatible. Make a full database backup before testing it in a production environment.

This pull request adds support for delegating authentication to an external identity provider using OIDC. Only clients that natively support OAuth login can use this feature.

Closes #765.

Pull request checklist:

  • This pull request targets the main branch, and the branch is named something other than
    main.
  • I have written an appropriate pull request title and my description is clear.
  • I understand I am responsible for the contents of this pull request.
  • I have followed the contributing guidelines:
<!-- In order to help reviewers know what your pull request does at a glance, you should ensure that 1. Your PR title is a short, single sentence describing what you changed 2. You have described in more detail what you have changed, why you have changed it, what the intended effect is, and why you think this will be beneficial to the project. If you have made any potentially strange/questionable design choices, but didn't feel they'd benefit from code comments, please don't mention them here - after opening your pull request, go to "files changed", and click on the "+" symbol in the line number gutter, and attach comments to the lines that you think would benefit from some clarification. --> > [!WARNING] > This pull request bumps the database version and therefore is not backwards compatible. Make a full database backup before testing it in a production environment. This pull request adds support for delegating authentication to an external identity provider using OIDC. **Only clients that natively support OAuth login can use this feature.** <!-- Example: This pull request allows us to warp through time and space ten times faster than before by double-inverting the warp drive with hyperheated jump fluid, both making the drive faster and more efficient. This resolves the common issue where we have to wait more than 10 milliseconds to engage, use, and disengage the warp drive when travelling between galaxies. --> Closes #765. <!-- Fixes: #... --> <!-- Uncomment the above line(s) if your pull request fixes an issue or closes another pull request by superseding it. Replace `#...` with the issue/pr number, such as `#123`. --> **Pull request checklist:** <!-- You need to complete these before your PR can be considered. If you aren't sure about some, feel free to ask for clarification in #dev:continuwuity.org. --> - [x] This pull request targets the `main` branch, and the branch is named something other than `main`. - [x] I have written an appropriate pull request title and my description is clear. - [x] I understand I am responsible for the contents of this pull request. - I have followed the [contributing guidelines][c1]: - [x] My contribution follows the [code style][c2], if applicable. - [x] I ran [pre-commit checks][c1pc] before opening/drafting this pull request. - [x] I have [tested my contribution][c1t] (or proof-read it for documentation-only changes) myself, if applicable. This includes ensuring code compiles. - [x] My commit messages follow the [commit message format][c1cm] and are descriptive. <!-- Notes on these requirements: - While not required, we encourage you to sign your commits with GPG or SSH to attest the authenticity of your changes. - While we allow LLM-assisted contributions, we do not appreciate contributions that are low quality, which is typical of machine-generated contributions that have not had a lot of love and care from a human. Please do not open a PR if all you have done is asked ChatGPT to tidy up the codebase with a +-100,000 diff. - In the case of code style violations, reviewers may leave review comments/change requests indicating what the ideal change would look like. For example, a reviewer may suggest you lower a log level, or use `match` instead of `if/else` etc. - In the case of code style violations, pre-commit check failures, minor things like typos/spelling errors, and in some cases commit format violations, reviewers may modify your branch directly, typically by making changes and adding a commit. Particularly in the latter case, a reviewer may rebase your commits to squash "spammy" ones (like "fix", "fix", "actually fix"), and reword commit messages that don't satisfy the format. - Pull requests MUST pass the `Checks` CI workflows to be capable of being merged. This can only be bypassed in exceptional circumstances. If your CI flakes, let us know in matrix:r/dev:continuwuity.org. - Pull requests have to be based on the latest `main` commit before being merged. If the main branch changes while you're making your changes, you should make sure you rebase on main before opening a PR. Your branch will be rebased on main before it is merged if it has fallen behind. - We typically only do fast-forward merges, so your entire commit log will be included. Once in main, it's difficult to get out cleanly, so put on your best dress, smile for the cameras! --> [c1]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md [c2]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/docs/development/code_style.mdx [c1pc]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#pre-commit-checks [c1t]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#running-tests-locally [c1cm]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#commit-messages
feat: Initial implementation of OIDC
Some checks failed
Auto Labeler / Apply labels based on changed files (pull_request_target) Successful in 4s
Checks / Prek / Check changed files (pull_request) Successful in 6s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m18s
Checks / Changelog / Check changelog is added (pull_request_target) Failing after 6s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m27s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m50s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 9m59s
c604e80f80
ginger force-pushed ginger/oidc from c604e80f80
Some checks failed
Auto Labeler / Apply labels based on changed files (pull_request_target) Successful in 4s
Checks / Prek / Check changed files (pull_request) Successful in 6s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m18s
Checks / Changelog / Check changelog is added (pull_request_target) Failing after 6s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m27s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m50s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 9m59s
to 9008341b10
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Failing after 6s
Checks / Prek / Check changed files (pull_request) Successful in 5s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m13s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m37s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m48s
Checks / Prek / Clippy and Cargo Tests (pull_request) Failing after 5m10s
2026-06-30 13:48:54 +00:00
Compare
ginger force-pushed ginger/oidc from 9008341b10
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Failing after 6s
Checks / Prek / Check changed files (pull_request) Successful in 5s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m13s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m37s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m48s
Checks / Prek / Clippy and Cargo Tests (pull_request) Failing after 5m10s
to c8c629fce6
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Failing after 9s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m1s
Checks / Prek / Check changed files (pull_request) Successful in 5s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m31s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m6s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 9m27s
2026-06-30 13:56:30 +00:00
Compare
feat: Allow existing legacy accounts to be linked interactively
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Failing after 7s
Checks / Prek / Check changed files (pull_request) Successful in 7s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 54s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m18s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m22s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 9m50s
07733ab646
feat: Send account selection prompt to IDP when account switch link is clicked
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Failing after 7s
Checks / Prek / Check changed files (pull_request) Successful in 7s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 56s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m17s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m23s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 8m38s
69531a8107
feat: Add support for importing profile data from claims
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Has been cancelled
Documentation / Build and Deploy Documentation (pull_request) Has been cancelled
Checks / Prek / Pre-commit & Formatting (pull_request) Has been cancelled
Checks / Prek / Check changed files (pull_request) Has been cancelled
Checks / Prek / Clippy and Cargo Tests (pull_request) Has been cancelled
Update flake hashes / update-flake-hashes (pull_request) Has been cancelled
9ec4ddc081
fix: Adjust OIDC config section comment position
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Has been cancelled
Documentation / Build and Deploy Documentation (pull_request) Has been cancelled
Checks / Prek / Pre-commit & Formatting (pull_request) Has been cancelled
Checks / Prek / Check changed files (pull_request) Has been cancelled
Checks / Prek / Clippy and Cargo Tests (pull_request) Has been cancelled
Update flake hashes / update-flake-hashes (pull_request) Has been cancelled
6c381e7b69
ginger force-pushed ginger/oidc from 6c381e7b69
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Has been cancelled
Documentation / Build and Deploy Documentation (pull_request) Has been cancelled
Checks / Prek / Pre-commit & Formatting (pull_request) Has been cancelled
Checks / Prek / Check changed files (pull_request) Has been cancelled
Checks / Prek / Clippy and Cargo Tests (pull_request) Has been cancelled
Update flake hashes / update-flake-hashes (pull_request) Has been cancelled
to b1e46ad667
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Failing after 7s
Documentation / Build and Deploy Documentation (pull_request) Successful in 2m6s
Checks / Prek / Check changed files (pull_request) Successful in 7s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m31s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m29s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 8m6s
2026-07-01 01:44:24 +00:00
Compare
ginger changed title from WIP: Add support for delegated authentication with OIDC to Add support for delegated authentication with OIDC 2026-07-01 01:44:27 +00:00
ginger requested review from Owners 2026-07-01 01:44:36 +00:00
fix: Hide bare oidc config option
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Failing after 7s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m17s
Checks / Prek / Check changed files (pull_request) Successful in 8s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m21s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m27s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 7m40s
b376a9cda8
Jade requested changes 2026-07-01 18:52:41 +00:00
Dismissed
Jade left a comment

review 1

review 1
@ -54,15 +54,22 @@ impl Service {
async fn set_emergency_access(&self) -> Result {
let server_user = &self.services.globals.server_user;
Owner

Both methods here will fail if the server_user doesn't exist, ie on a fresh database

Both methods here will fail if the server_user doesn't exist, ie on a fresh database
Author
Owner

Creating the admin room and server user is done as part of creating a fresh database, so this can never fail

Creating the admin room and server user is done as part of creating a fresh database, so this can never fail
Jade marked this conversation as resolved
@ -821,0 +849,4 @@
assert!(hash.is_empty(), "non-empty hash {hash} for remote user {user_id}");
remoteuserid_remoteuser.insert(&user_id, "");
userid_password.remove(&user_id);
Owner

Uh, are we allowed to mutate the table while streaming it? feels sus

Uh, are we allowed to mutate the table while streaming it? feels sus
Author
Owner

Yes, rocksdb iterators create a snapshot of the column. Other migrations also do this.

Yes, rocksdb iterators create a snapshot of the column. Other migrations also do this.
Jade marked this conversation as resolved
@ -0,0 +302,4 @@
} else {
return Ok(SessionCompletionStatus::NeedsUserId);
}
} else if let Some(preferred_username) = all_claims.get(&config.preferred_username_claim)
Owner

Perform the unwrapping for preferred_username being a string here, to avoid panicking on unexpected data

Perform the unwrapping for preferred_username being a string here, to avoid panicking on unexpected data
ginger marked this conversation as resolved
fix: Miscellaneous fixes
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Failing after 5s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m10s
Checks / Prek / Check changed files (pull_request) Successful in 4s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m26s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m9s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 8m18s
85da8b36a0
feat: Add support for importing email addresses from the IDP
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Failing after 5s
Checks / Prek / Check changed files (pull_request) Successful in 4s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m19s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m9s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m30s
Checks / Prek / Clippy and Cargo Tests (pull_request) Has been cancelled
e7d7c902ef
chore: News fragment
Some checks are pending
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 5s
Checks / Prek / Check changed files (pull_request) Successful in 11s
Update flake hashes / update-flake-hashes (pull_request) Has started running
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m8s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m23s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 8m19s
d4b14ce359
ginger force-pushed ginger/oidc from d4b14ce359
Some checks are pending
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 5s
Checks / Prek / Check changed files (pull_request) Successful in 11s
Update flake hashes / update-flake-hashes (pull_request) Has started running
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m8s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m23s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 8m19s
to f57485b8b7
All checks were successful
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 5s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m5s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m9s
Checks / Prek / Check changed files (pull_request) Successful in 4s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m9s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 9m15s
2026-07-01 19:55:26 +00:00
Compare
feat: Add support for requesting additional scopes
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 6s
Checks / Prek / Check changed files (pull_request) Successful in 6s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m10s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m23s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m23s
Checks / Prek / Clippy and Cargo Tests (pull_request) Has been cancelled
6cbf092170
ginger force-pushed ginger/oidc from 6cbf092170
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 6s
Checks / Prek / Check changed files (pull_request) Successful in 6s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m10s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m23s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m23s
Checks / Prek / Clippy and Cargo Tests (pull_request) Has been cancelled
to a5ee1fb009
All checks were successful
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 6s
Checks / Prek / Check changed files (pull_request) Successful in 6s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m9s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m17s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m22s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 8m28s
2026-07-01 20:47:06 +00:00
Compare
fix: Config file formatting
All checks were successful
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 6s
Checks / Prek / Check changed files (pull_request) Successful in 6s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m8s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m23s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m25s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 8m25s
8c1ca272de
First-time contributor

hello :o ! Very excited for the oidc work thank y'all for this incredible piece of software !
I just wanted to point that there should probably be a client_secret_file in the config, as is done for the other secrets to ease its declaration in nixos/ansible types of setup where the repo might be public and the secret would be in an external file !

hello :o ! Very excited for the oidc work thank y'all for this incredible piece of software ! I just wanted to point that there should probably be a client_secret_file in the config, as is done for the other secrets to ease its declaration in nixos/ansible types of setup where the repo might be public and the secret would be in an external file !
feat: Add support for reading the OIDC client secret from a file
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 6s
Checks / Prek / Check changed files (pull_request) Successful in 6s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m7s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m23s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m24s
Checks / Prek / Clippy and Cargo Tests (pull_request) Has been cancelled
a615004a5e
fix: Prevent register page from being accessible when OIDC is enabled
All checks were successful
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 6s
Checks / Prek / Check changed files (pull_request) Successful in 6s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m6s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m17s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m23s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 8m32s
af29d7d1f0
Author
Owner

@LyesSaadi wrote in #1886 (comment):

hello :o ! Very excited for the oidc work thank y'all for this incredible piece of software ! I just wanted to point that there should probably be a client_secret_file in the config, as is done for the other secrets to ease its declaration in nixos/ansible types of setup where the repo might be public and the secret would be in an external file !

I've added a config option to do that, thank you for the suggestion!

@LyesSaadi wrote in https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1886#issuecomment-31040: > hello :o ! Very excited for the oidc work thank y'all for this incredible piece of software ! I just wanted to point that there should probably be a client_secret_file in the config, as is done for the other secrets to ease its declaration in nixos/ansible types of setup where the repo might be public and the secret would be in an external file ! I've added a config option to do that, thank you for the suggestion!
ginger force-pushed ginger/oidc from af29d7d1f0
All checks were successful
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 6s
Checks / Prek / Check changed files (pull_request) Successful in 6s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m6s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m17s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m23s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 8m32s
to 514c3bbcbf
All checks were successful
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 6s
Checks / Prek / Check changed files (pull_request) Successful in 6s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m9s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m18s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m24s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 9m1s
2026-07-02 20:57:35 +00:00
Compare
fix: Mobile styling improvements
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 6s
Checks / Prek / Check changed files (pull_request) Successful in 6s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m8s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m15s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m20s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 8m28s
Checks / Prek / Check changed files (push) Successful in 6s
Checks / Prek / Clippy and Cargo Tests (push) Has been cancelled
Release Docker Image / Build linux-arm64 (release) (push) Has been cancelled
Release Docker Image / Create Multi-arch Release Manifest (push) Has been cancelled
Release Docker Image / Build linux-amd64 (max-perf) (push) Has been cancelled
Release Docker Image / Build linux-arm64 (max-perf) (push) Has been cancelled
Release Docker Image / Create Max-Perf Manifest (push) Has been cancelled
Release Docker Image / Release Binaries (push) Has been cancelled
Release Docker Image / Mirror Images (push) Has been cancelled
Documentation / Build and Deploy Documentation (push) Has been cancelled
Release Docker Image / Build linux-amd64 (release) (push) Has been cancelled
Checks / Prek / Pre-commit & Formatting (push) Has been cancelled
f1b7710984
nex approved these changes 2026-07-04 14:46:18 +00:00
nex left a comment

ok

ok
Jade approved these changes 2026-07-04 15:12:28 +00:00
ginger merged commit f1b7710984 into main 2026-07-04 15:18:03 +00:00
ginger deleted branch ginger/oidc 2026-07-04 15:18:03 +00:00
ginger added this to the 26.6.0 milestone 2026-07-04 15:57:01 +00:00
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
4 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
continuwuation/continuwuity!1886
No description provided.