feat: generic OIDC configuration with local account support #3

Merged

twerner merged 4 commits from feature/generic-oidc-config into dev

2026-07-02 14:48:43 +00:00

coding-agent commented

2026-07-02 14:47:57 +00:00

Collaborator

Summary

Replaces the Auth0-specific authentication with a generic OIDC setup that works with any provider (Azure AD, Keycloak, Google, etc.) and adds optional local admin accounts.

Changes

Phase 1 — Generic OIDC

Config: Renamed Auth0 section → Oidc (keys: Authority, ClientId, ClientSecret, Audience)
Program.cs: Generic OIDC middleware with proper sign-out support via SignedOutCallbackPath and OnRedirectToIdentityProviderForSignOut
AccountController: Removed hardcoded Auth0 fallback credentials; proper OIDC sign-out via middleware (cookie + OIDC scheme)
Login.razor / Home.razor: Removed all Auth0 branding from UI

Phase 2 — Local Accounts

DataClasses/AdminUser.cs: New POCO entity for admin users
WebClient/AppDbContext.cs: PostgreSQL DbContext for the application database
AccountController: New POST Login endpoint for local credential validation; GET OidcLogin for explicit OIDC challenge
Login.razor: Local login form (username + password) alongside OIDC button; adapts UI based on what's configured
Program.cs: Seeds admin user from Oidc:AdminUsername/Oidc:AdminPassword on first startup

Configuration

docker-compose.yml: All Oidc__* env vars added; connection strings split into individual POSTGRES_*/MARIADB_* parts used by all services
.env.example: New file documenting all configuration options

Validation

OIDC registration is conditional — only enabled if Oidc:Authority + Oidc:ClientId are set
Startup throws if neither OIDC nor local admin is configured

## Summary Replaces the Auth0-specific authentication with a generic OIDC setup that works with any provider (Azure AD, Keycloak, Google, etc.) and adds optional local admin accounts. ## Changes ### Phase 1 — Generic OIDC - **Config**: Renamed `Auth0` section → `Oidc` (keys: `Authority`, `ClientId`, `ClientSecret`, `Audience`) - **Program.cs**: Generic OIDC middleware with proper sign-out support via `SignedOutCallbackPath` and `OnRedirectToIdentityProviderForSignOut` - **AccountController**: Removed hardcoded Auth0 fallback credentials; proper OIDC sign-out via middleware (cookie + OIDC scheme) - **Login.razor / Home.razor**: Removed all Auth0 branding from UI ### Phase 2 — Local Accounts - **DataClasses/AdminUser.cs**: New POCO entity for admin users - **WebClient/AppDbContext.cs**: PostgreSQL DbContext for the application database - **AccountController**: New `POST Login` endpoint for local credential validation; \(GET OidcLogin\) for explicit OIDC challenge - **Login.razor**: Local login form (username + password) alongside OIDC button; adapts UI based on what's configured - **Program.cs**: Seeds admin user from `Oidc:AdminUsername`/`Oidc:AdminPassword` on first startup ### Configuration - **docker-compose.yml**: All `Oidc__*` env vars added; connection strings split into individual `POSTGRES_*`/`MARIADB_*` parts used by all services - **.env.example**: New file documenting all configuration options ### Validation - OIDC registration is conditional — only enabled if `Oidc:Authority` + `Oidc:ClientId` are set - Startup throws if neither OIDC nor local admin is configured

coding-agent added 4 commits

2026-07-02 14:47:57 +00:00

Refactor Auth0-specific OIDC config to generic OIDC with local account support f0be02d390

- Rename Auth0 config section to Oidc (Authority, ClientId, ClientSecret, Audience)
- Add generic OIDC sign-out via middleware (SignedOutCallbackPath, OnRedirectToIdentityProviderForSignOut)
- Remove hardcoded Auth0 fallback credentials from AccountController
- Add local account support: AdminUser entity, AppDbContext (PostgreSQL), password hashing
- Add seed admin user from Oidc:AdminUsername/AdminPassword config
- Update login page with local form + OIDC button side by side
- Remove all Auth0-specific branding from UI and log messages

Make OIDC optional with validation, add admin credentials to config, add OIDC env vars to docker-compose d12fe0eae8

- Add Oidc:AdminUsername and Oidc:AdminPassword to appsettings.json (empty by default)
- Make OIDC registration conditional on Oidc:Authority and Oidc:ClientId being set
- Validate at startup that at least one auth method (OIDC or local admin) is configured
- Hide OIDC login button when OIDC is not configured
- Guard OidcLogin and Logout endpoints against missing OIDC config
- Add all Oidc__ env vars to docker-compose.yml

Add .env.example with all configuration options 2041008620

Split connection strings into individual env vars in .env.example and docker-compose.yml 9999a0cc43

- .env.example now uses individual POSTGRES_* and MARIADB_* variables
- docker-compose.yml composes connection strings from the individual parts
- Both DB containers and webclient use the same variables via interpolation
- All variables have fallback defaults (:-( syntax) in docker-compose.yml