Commit Graph

10 Commits

Author SHA1 Message Date
LPW
02e203e8ee Add security measures for SSO-only users: block password resets, enforce SSO authentication, and refactor validations for JIT provisioning. (#569)
Co-authored-by: Josh Waldrep <joshua.waldrep5+github@gmail.com>
2026-01-07 20:17:23 +01:00
LPW
b23711ae0d Add configurable multi-provider SSO, SSO-only mode, and JIT controls via auth.yml (#441)
* Add configuration and logic for dynamic SSO provider support and stricter JIT account creation

- Introduced `config/auth.yml` for centralized auth configuration and documentation.
- Added support for multiple SSO providers, including Google, GitHub, and OpenID Connect.
- Implemented stricter JIT SSO account creation modes (`create_and_link` vs `link_only`).
- Enabled optional restriction of JIT creation by allowed email domains.
- Enhanced OmniAuth initializer for dynamic provider setup and better configurability.
- Refined login UI to handle local login disabling and emergency super-admin override.
- Updated account creation flow to respect JIT mode and domain checks.
- Added tests for SSO account creation, login form visibility, and emergency overrides.

# Conflicts:
#	app/controllers/sessions_controller.rb

* remove non-translation

* Refactor authentication views to use translation keys and update locale files

- Extracted hardcoded strings in `oidc_accounts/link.html.erb` and `sessions/new.html.erb` into translation keys for better localization support.
- Added missing translations for English and Spanish in `sessions` and `oidc_accounts` locale files.

* Enhance OmniAuth provider configuration and refine local login override logic

- Updated OmniAuth initializer to support dynamic provider configuration with `name` and scoped parameters for Google and GitHub.
- Improved local login logic to enforce stricter handling of super-admin override when local login is disabled.
- Added test for invalid super-admin override credentials.

* Document Google sign-in configuration for local development and self-hosted environments

---------

Co-authored-by: Josh Waldrep <joshua.waldrep5+github@gmail.com>
2025-12-24 00:15:53 +01:00
Zach Gollwitzer
f2739b79fb Improve password reset flow, normalize translations 2024-11-05 17:15:29 -05:00
Zach Gollwitzer
eef4c2643b Rubocop updates (#1118)
* Minimal code style enforcement

* Formatting and lint code updates (no change in functionality)
2024-08-23 10:06:24 -04:00
Duy Le
943972690e fix password resets (#741) 2024-05-13 13:23:24 -04:00
Zach Gollwitzer
0a0289846e Centralize auth (#598) 2024-04-03 10:35:55 -04:00
Dwight Watson
97789bc538 Fix arguments to find_by_token_for (#299) 2024-02-04 19:10:48 -06:00
Jose Farias
c5192ee424 Centralize auth messages (#269)
* Add i18n-tasks

* Add auth-related i18n

* Centralize auth messages

* Remove safe navigation

* Revert "Remove safe navigation"

This reverts commit 56b5e01e5e0ab9f54a9a5d9f5559e29897d239a4.

* Remove newline in Gemfile
2024-02-03 14:17:49 -06:00
Rob Zolkos
1cc9550c80 Lint files to rubocop omakase standards
root ➜ /workspace (fix-rubocop-issues) $ rubocop
Inspecting 54 files
......................................................

54 files inspected, no offenses detected
2024-02-02 16:07:29 +00:00
Josh Pigford
99de24ac70 Initial commit 2024-02-02 09:05:04 -06:00