Repository navigation
OpenID Connect login plugin (6/7) - #896
Merged
Merged
Conversation
… for configuration and plugins
…arty and scope checks
…etadata endpoints
… conditions, scheme always registered The derived audience and resource_metadata URL come from the store resolved for the request, never from the Host header. Resources with account conditions are refused until those checks exist. With the resource server disabled the Oidc scheme is still registered with no issuer and no keys, so endpoints naming it answer 401. authorization_servers publishes the Authority as configured, an http Authority requires RequireHttpsMetadata=false, garbage tokens log at Information, and the startup skips an uninstalled database.
…rified e-mail or registration
…e request through a request customer resolver
…fier (install and migration)
…back-office accounts; one identity per customer
…ration off by default
…OpenID Connect scheme
…ic tokens to the OpenID Connect scheme
…, staff and unverified e-mails link by password
…entication cookie
…8 and Zitadel v4.19 Web API module flag, provider switch and identity links, Keycloak resource indicators accepted with the Audience mapper, Zitadel role assertion for user_grants, client_id instead of azp, project-wide aud, and the target reading user.human.is_email_verified.
… from the provider, no password
…ication needs a password sign-in
…g decision per request
… instead of repeating its rule
…isabled, before any customer is resolved
…ed resource by default
…tomer resolution, Deny defaults for the Web API
…s-e2e # Conflicts: # src/Business/Grand.Business.Core/Interfaces/Authentication/IJwtBearerAuthenticationService.cs # src/Business/Grand.Business.Core/Interfaces/Customers/IUserApiService.cs # src/Core/Grand.Domain/Customers/UserApi.cs # src/Web/Grand.Web/App_Data/appsettings.json
…mment names the Store URL
…e store's second factor after the provider sign-in, tell an identity linked to another account apart
KrzysztofPajak
added a commit
that referenced
this pull request
Oct 11, 2026
…ecting fails An identity whose e-mail the provider did not verify registers with a typed password and is not connected; it connects later with that password, like an existing account. Otherwise whoever holds that identity would keep the account once the owner of the address activates it, even after a password reset. A failed connection after registration now tells the customer. The random password of a connected account is 32 random bytes.
…ature/oidc-login-plugin
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| if (separator <= 0 || | ||
| !long.TryParse(marker.AsSpan(0, separator), NumberStyles.None, CultureInfo.InvariantCulture, out shown)) | ||
| return false; | ||
| subject = marker[(separator + 1)..]; |
…code), never replace another signed-in account, clear a stale pending identity on failure, always ask for openid, hide the button without a scheme
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Type: feature
Issue
A sign-in button for the identity provider next to the other external methods (Google, Facebook). Part 6 of the stack (base: PR 5).
Solution
New plugin
Authentication.OpenIdConnect(system nameExternalAuth.OpenIdConnect):Microsoft.AspNetCore.Authentication.OpenIdConnect, MIT): authorization code + PKCE, query response mode, user info endpoint, tokens not stored. The Authority, HTTPS metadata and claim names come fromOidcResourceServer; the client settings from the appsettings sectionOidcLogin(ClientId,ClientSecret,Scopes). Not configured: no scheme, a warning in the log, and the button leads to the failure page./oidc/login(local returnUrl only),/oidc/callback,/oidc/link(signs the visitor out and asks for one password sign-in),/oidc/link/complete(connects only an account signed in after the link page, with the same e-mail),/oidc/failed(fixed texts, details only in the log).Microsoft.IdentityModel.*comes from the host.Breaking changes
None (a new plugin, not installed by default).
Testing
dotnet test src/Tests/Grand.Modules.Tests- all pass.docs/oidc-resource-server.md11.3-11.5 (PR 7), install the plugin and activate it in External authentication methods./adminafter signing in; cancelling at the provider shows the failure page; an external returnUrl goes to the home page; unlinking in My account; an API token of a login-linked user maps to the same customer.