Keep local recovery available during OIDC failures

jchapman commented

2026-10-25 15:38:18 +00:00

Owner

A saved issuer mismatch or provider outage previously made startup fail, taking the application and local administrator recovery login down with SSO. OIDC initialization now fails closed for SSO while Bridge and enabled local login remain available. Exact issuer matching (including trailing slashes), signature, audience, expiry, state, nonce and PKCE checks remain enabled.

Discovery is bounded to five seconds. One background worker checks one minute after each completed check, removes unavailable providers from new SSO requests, and restores SSO automatically after successful discovery. In-flight callbacks retain a provider snapshot and their existing 15-second timeout. The login page displays unavailability and refreshes options; administrators get fixed diagnostics and last/next check times without provider bodies, URLs or credentials.

Changed OIDC issuer/client/secret settings must pass discovery before saving. Preflight resolves retained/cleared secrets and runs outside the import admission lock; revision checks still prevent concurrent overwrites. Unrelated saves and disabling SSO remain possible during outages. Discovery does not validate a client secret, provider assignments or a complete login. Saved security changes still require a coordinated restart.

Validation completed locally:

Complete backend tests: go test -count=1 -timeout 120s ./cmd/... ./internal/... in a disposable Linux AMD64 container using the existing Go 1.27.3 test image.
Focused authentication/configuration/admin-settings race tests on the final source, plus go vet ./cmd/... ./internal/....
Regressions cover issuer/trailing-slash mismatch, unavailable/invalid discovery, missing/insecure endpoints and unsupported algorithms, timeout/shutdown, local recovery login, concurrent outage/recovery, a signed login after recovery, existing sessions, all token/correlation checks, administrator-only diagnostics and configuration save preflight/redaction.
UI lint and production build; focused Playwright browser regression for mobile local recovery, SSO outage/recovery refresh and administrator diagnostics. Screenshots inspected locally.
All nine CI contract/policy tests, documentation links/encoding and git diff --check.

The new auth race tests and browser regression are included in the existing CI gates. Native AMD64/ARM64 release gates, full container/production walkthroughs and the deployed provider walkthrough remain separate; they were not run as part of this local change. The UI build retains its existing large-chunk advisory. No services were deployed, restarted or interrupted.

Stacked on #15 (codex/issues-10-11-diagnostics) to preserve the current repository baseline and keep this review focused. After #15 merges, retarget this PR to main and verify the resulting diff and required native CI gates before merging. Keep #2 open pending review and verification; coordinate any later restart with active uploads/imports.

Refs #2 and #14.

A saved issuer mismatch or provider outage previously made startup fail, taking the application and local administrator recovery login down with SSO. OIDC initialization now fails closed for SSO while Bridge and enabled local login remain available. Exact issuer matching (including trailing slashes), signature, audience, expiry, state, nonce and PKCE checks remain enabled. Discovery is bounded to five seconds. One background worker checks one minute after each completed check, removes unavailable providers from new SSO requests, and restores SSO automatically after successful discovery. In-flight callbacks retain a provider snapshot and their existing 15-second timeout. The login page displays unavailability and refreshes options; administrators get fixed diagnostics and last/next check times without provider bodies, URLs or credentials. Changed OIDC issuer/client/secret settings must pass discovery before saving. Preflight resolves retained/cleared secrets and runs outside the import admission lock; revision checks still prevent concurrent overwrites. Unrelated saves and disabling SSO remain possible during outages. Discovery does not validate a client secret, provider assignments or a complete login. Saved security changes still require a coordinated restart. Validation completed locally: - Complete backend tests: `go test -count=1 -timeout 120s ./cmd/... ./internal/...` in a disposable Linux AMD64 container using the existing Go 1.27.3 test image. - Focused authentication/configuration/admin-settings race tests on the final source, plus `go vet ./cmd/... ./internal/...`. - Regressions cover issuer/trailing-slash mismatch, unavailable/invalid discovery, missing/insecure endpoints and unsupported algorithms, timeout/shutdown, local recovery login, concurrent outage/recovery, a signed login after recovery, existing sessions, all token/correlation checks, administrator-only diagnostics and configuration save preflight/redaction. - UI lint and production build; focused Playwright browser regression for mobile local recovery, SSO outage/recovery refresh and administrator diagnostics. Screenshots inspected locally. - All nine CI contract/policy tests, documentation links/encoding and `git diff --check`. The new auth race tests and browser regression are included in the existing CI gates. Native AMD64/ARM64 release gates, full container/production walkthroughs and the deployed provider walkthrough remain separate; they were not run as part of this local change. The UI build retains its existing large-chunk advisory. No services were deployed, restarted or interrupted. Stacked on #15 (`codex/issues-10-11-diagnostics`) to preserve the current repository baseline and keep this review focused. After #15 merges, retarget this PR to `main` and verify the resulting diff and required native CI gates before merging. Keep #2 open pending review and verification; coordinate any later restart with active uploads/imports. Refs #2 and #14.

jchapman added 1 commit

2026-10-25 15:38:18 +00:00