ebbe.bass/ping-mee-self-service-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add OIDC sign-in, roles, sessions and client address rule

Browse Source 
Authorization-code flow with PKCE through an idp adapter (with a fake), ID
token validation, identity and roles resolved from the directory with a short
cache, refusal of unknown, disabled and locked accounts with one generic page,
sessions that end when the account becomes unavailable, sign-out that ends the
server-side session, role decorators and the trusted-proxy client address rule.
Adds the OIDC_* and PUBLIC_BASE_URL configuration.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC
This commit is contained in:
ebbe.bass
2026-10-17 19:19:51 +02:00
co-authored by Claude Sonnet 5.5
parent 7458a2a815
commit 3c69c2a156
32 changed files with 1692 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+5 -1
View File
@@ -12,7 +12,11 @@ All configuration comes from environment variables, validated at startup. If any
| `ALLOWED_HOSTS` | yes | | Comma-separated host names |
| `DATA_DIR` | no | `/data` | Existing directory for the SQLite database |
| `DEBUG` | no | `false` | `true` or `false` |
| `TRUSTED_PROXIES` | no | empty | Comma-separated IP addresses or networks. Reserved for the client-IP rule in a later entry; currently has no effect |
| `TRUSTED_PROXIES` | no | empty | Comma-separated IP addresses or networks of the reverse proxies. The client address is taken from the last `X-Forwarded-For` entry only when the request comes from one of them |
| `OIDC_ISSUER` | yes | | Issuer address from the provider's OpenID configuration page, exactly as shown (https, keep the trailing slash) |
| `OIDC_CLIENT_ID` | yes | | Client ID of the provider's application |
| `OIDC_CLIENT_SECRET` | yes | | Client secret of the provider's application |
| `PUBLIC_BASE_URL` | yes | | Address users reach the portal at, scheme and host only. The provider's redirect address must be this plus `/auth/callback` |
| `LOG_LEVEL` | no | `INFO` | `DEBUG`, `INFO`, `WARNING`, `ERROR`, `CRITICAL` |
| `LDAP_SERVER` | yes | | Directory server host name (optionally `:port`); LDAPS on 636 is always used and the name must be in the server's certificate |
| `LDAP_USER_OU_DN` | yes | | Distinguished name of the OU whose users the portal may read and change |