Repository navigation
Provider-only sign-in mode: storefront and panel login pages, My account, sign-out at the provider - #908
Merged
Conversation
KrzysztofPajak
force-pushed
the
feature/oidc-provider-only-web
branch
from
October 14, 2026 10:39
629fc99 to
55ffa9b
Compare
…ord recovery to the identity provider
…ssword form stays for break-glass accounts
… instead of a redirect loop through the provider
…e provider connection are managed by the identity provider
…provider when a provider exposes it
… authentication service from the panel home controllers
…ry value now binds as text: 1 or true)
…login gets a sign-out link instead of a loop through the provider - Login no longer redirects a registered, signed-in customer to the provider (which signed the same account in again and returned to the page that refused it); the page offers the sign-out instead - the provider sign-in address comes from the first active provider that returns a path - Cancel on the external registration form goes to the home page (Register would go back to the provider) - the disable two-factor test now proves the provider-only guard alone redirects
… access and the break-glass password form
… session), so existing implementations still build
…ns out locally only, never at the identity provider
… also when the store's registration is disabled
KrzysztofPajak
force-pushed
the
feature/oidc-provider-only-web
branch
from
October 14, 2026 14:30
f64af00 to
297b569
Compare
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
|
|
||
| var redirect = result as RedirectResult; | ||
| Assert.IsNotNull(redirect); | ||
| Assert.AreEqual("/shop/oidc/login?returnUrl=%2Fshop%2Fstore", redirect.Url); |
|
|
||
| var redirect = result as RedirectResult; | ||
| Assert.IsNotNull(redirect); | ||
| Assert.AreEqual("/shop/oidc/login?returnUrl=%2Fshop%2Fadmin", redirect.Url); |
Comment on lines
+36
to
+40
| catch (Exception ex) | ||
| { | ||
| //never keep the customer signed in because the provider could not be asked | ||
| logger.LogWarning(ex, "Could not get the sign-out URL of the identity provider"); | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves no public issue
Type: feature
Issue
With the provider-only sign-in mode (previous pull request in this stack), the storefront and the panels still showed password forms, registration, password recovery and "My account" password/two-factor pages that can no longer be used, and signing out ended only the GrandNode session while the identity provider kept the user signed in.
Second of four stacked pull requests (core → web → plugin → guide); based on the core branch.
Solution
/loginand/registergo straight to the identity provider and back to the page asked for (only local return URLs); password recovery goes to/login; registration is possible only through the provider's external registration form; a notice replaces the forms when no provider can sign in (no redirect loops); a signed-in account sent to/logingets a sign-out link instead of a loop through the provider./admin/login?password=1, which shows the password form for break-glass accounts; a signed-in account without panel access gets a notice and a sign-out link.IExternalSignOutProvider; inProviderOnly, when the cookie came from a provider sign-in, storefront and panel sign-out redirect to the provider's end-session URL (absolute http(s) only) after the local sign-out;IGrandAuthenticationService.HasOidcSession()(default implementation returns false).Mixedbehaves exactly as before.Breaking changes
IGrandAuthenticationServicegainsHasOidcSession()with a default implementation. The panelHomeControllers no longer takeIGrandAuthenticationServicein their constructors. InProviderOnly, panel sign-out ends on the storefront home page (the post-logout address registered at the provider).Testing
dotnet test GrandNode.slnx(new tests for the storefront and panel login pages, My account rules and provider sign-out).SignInMode=ProviderOnly:/login,/register,/admin/login,/store/login,/vendor/loginredirect to/oidc/login;/admin/login?password=1shows the password form; deactivating the OpenID Connect method shows a notice instead of redirecting.