mirror of
https://github.com/we-promise/sure.git
synced 2026-04-08 06:44:52 +00:00
b23711ae0d
* Add configuration and logic for dynamic SSO provider support and stricter JIT account creation - Introduced `config/auth.yml` for centralized auth configuration and documentation. - Added support for multiple SSO providers, including Google, GitHub, and OpenID Connect. - Implemented stricter JIT SSO account creation modes (`create_and_link` vs `link_only`). - Enabled optional restriction of JIT creation by allowed email domains. - Enhanced OmniAuth initializer for dynamic provider setup and better configurability. - Refined login UI to handle local login disabling and emergency super-admin override. - Updated account creation flow to respect JIT mode and domain checks. - Added tests for SSO account creation, login form visibility, and emergency overrides. # Conflicts: # app/controllers/sessions_controller.rb * remove non-translation * Refactor authentication views to use translation keys and update locale files - Extracted hardcoded strings in `oidc_accounts/link.html.erb` and `sessions/new.html.erb` into translation keys for better localization support. - Added missing translations for English and Spanish in `sessions` and `oidc_accounts` locale files. * Enhance OmniAuth provider configuration and refine local login override logic - Updated OmniAuth initializer to support dynamic provider configuration with `name` and scoped parameters for Google and GitHub. - Improved local login logic to enforce stricter handling of super-admin override when local login is disabled. - Added test for invalid super-admin override credentials. * Document Google sign-in configuration for local development and self-hosted environments --------- Co-authored-by: Josh Waldrep <joshua.waldrep5+github@gmail.com>
56 lines
2.3 KiB
YAML
56 lines
2.3 KiB
YAML
default: &default
|
|
local_login:
|
|
# When false, local email/password login is disabled for all users unless
|
|
# AUTH_LOCAL_ADMIN_OVERRIDE_ENABLED is true and the user is a super admin.
|
|
enabled: <%= ENV.fetch("AUTH_LOCAL_LOGIN_ENABLED", "true") == "true" %>
|
|
|
|
# When true and local_login.enabled is false, allow super admins to use
|
|
# local login as an emergency override. Regular users remain SSO-only.
|
|
admin_override_enabled: <%= ENV.fetch("AUTH_LOCAL_ADMIN_OVERRIDE_ENABLED", "false") == "true" %>
|
|
|
|
jit:
|
|
# Controls behavior when a user signs in via SSO and no OIDC identity exists.
|
|
# - "create_and_link" (default): create a new user + family when no match exists
|
|
# - "link_only": require an existing user; block JIT creation
|
|
mode: <%= ENV.fetch("AUTH_JIT_MODE", "create_and_link") %>
|
|
|
|
# Optional comma-separated list of domains (e.g. "example.com,corp.com").
|
|
# When non-empty, JIT SSO account creation is only allowed for these domains.
|
|
# When empty, all domains are allowed (current behavior).
|
|
allowed_oidc_domains: <%= ENV.fetch("ALLOWED_OIDC_DOMAINS", "") %>
|
|
|
|
providers:
|
|
# Generic OpenID Connect provider (e.g., Keycloak, Authentik, other OIDC issuers).
|
|
# This maps to the existing :openid_connect OmniAuth strategy and keeps
|
|
# backwards-compatible behavior for self-hosted setups using OIDC_* env vars.
|
|
- id: "oidc"
|
|
strategy: "openid_connect"
|
|
name: "openid_connect"
|
|
label: <%= ENV.fetch("OIDC_BUTTON_LABEL", "Sign in with OpenID Connect") %>
|
|
icon: <%= ENV.fetch("OIDC_BUTTON_ICON", "key") %>
|
|
|
|
# Optional Google OAuth provider. Requires the omniauth-google-oauth2 gem
|
|
# and GOOGLE_OAUTH_CLIENT_ID / GOOGLE_OAUTH_CLIENT_SECRET env vars.
|
|
- id: "google"
|
|
strategy: "google_oauth2"
|
|
name: "google_oauth2"
|
|
label: <%= ENV.fetch("GOOGLE_BUTTON_LABEL", "Sign in with Google") %>
|
|
icon: <%= ENV.fetch("GOOGLE_BUTTON_ICON", "google") %>
|
|
|
|
# Optional GitHub OAuth provider. Requires the omniauth-github gem and
|
|
# GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET env vars.
|
|
- id: "github"
|
|
strategy: "github"
|
|
name: "github"
|
|
label: <%= ENV.fetch("GITHUB_BUTTON_LABEL", "Sign in with GitHub") %>
|
|
icon: <%= ENV.fetch("GITHUB_BUTTON_ICON", "github") %>
|
|
|
|
development:
|
|
<<: *default
|
|
|
|
test:
|
|
<<: *default
|
|
|
|
production:
|
|
<<: *default
|