feat(auth): add generic OpenID Connect (OIDC) single sign-on#3508

Open

holden093 wants to merge 30 commits into

odysseus-dev:devfrom

holden093:feat/oidc-sso

Commits on Jul 7, 2026

feat(auth): add generic OpenID Connect (OIDC) single sign-on

holden093
and
claude
committed
fix: add OIDC env vars to standalone GPU compose files

holden093
and
claude
committed
fix(oidc): address review items — aud arrays, JWKS cache, alg pinning, redirect_uri, stateless state, first-user-admin
holden093
committed
fix(oidc): address second-pass review — CSRF cookie, admin demotion, JWKS cooldown, secure cookies, dead code
holden093
committed
Potential fix for pull request finding

holden093
and
Copilot
committed
fix(oidc): address RaresKeY review — bootstrap gating and UserInfo sub protection
holden093
committed
fix(oidc): add missing OIDC_REDIRECT_URI and OIDC_FIRST_USER_IS_ADMIN to compose files
holden093
committed
fix(oidc): surface callback errors on login page from URL query param
holden093
committed
fix(oidc): address remaining review items — issuer fail-closed, multi-audience azp, OIDC 2FA guards
holden093
committed
fix(oidc): wrap JWKS errors as OidcError, bind token exchange to stored redirect_uri
holden093
committed
fix(oidc): offload code exchange off the event loop to avoid blocking
holden093
committed
fix(oidc): throttle failed JWKS refreshes and persist state key across workers
holden093
committed
fix(oidc): serialize admin bootstrap, atomic key creation, guard against silent demotion
holden093
committed
fix(oidc): serialize auth across workers, guard UserInfo demotion, atomic key creation
holden093
committed
fix(oidc): add intra-process lock to _interprocess_auth_lock
holden093
committed
fix(oidc): address four current-head blockers from RaresKeY review
holden093
committed
fix(oidc): serialize create_user() across workers
holden093
committed
fix(oidc): enforce reserved-username check in _create_user_locked
holden093
committed
fix(auth): serialize all auth.json writers under inter-process lock

holden093
and
antigravity
committed

Commits on Jul 8, 2026

Merge branch 'pewdiepie-archdaemon:dev' into feat/oidc-sso
holden093
authored

Commits on Jul 13, 2026

Merge branch 'pewdiepie-archdaemon:dev' into feat/oidc-sso
holden093
authored

Commits on Jul 14, 2026

Merge branch 'pewdiepie-archdaemon:dev' into feat/oidc-sso
holden093
authored

Commits on Jul 17, 2026

Merge branch 'odysseus-dev:dev' into feat/oidc-sso
holden093
authored

Commits on Jul 18, 2026