Release 13.X might break OIDC

[p-fruck]

Hi all,

I noticed that the bug fix release 13.1 includes some changes that I would consider 'breaking'. Django-allauth has been updated from 0.54 to 0.59 and the library made a lot of progress during this timeframe. Notably, the CERN and Keycloak providers have been dropped in favor of OIDC and the notation of SOCIALACCOUNT_PROVIDERS has changed for OIDC which now uses the unified APPS structure (body of element changes too) instead of the previous custom SERVERS construct.

Is it possible to add a warning to the specific release such that users are aware of the potential issue?

[p-fruck]

Also looking at the changes made in #6099 to the sso.py it seems to me like the SOCIAL_BACKENDS cannot be used anymore. The code now requires the social app to be added to the database and the hybrid approach of configuring client and secret through settings and using the DB for the social app and assigned sites results in an error stating that multiple apps are provisioned (because mixing settings and DB is discouraged as also stated in the PR).
However, I'd be glad to configure my OIDC service in a declarative manner using (INVENTREE_)SOCIAL_BACKENDS

[SchrodingersGat]

@p-fruck ok, good point. I can see how these changes would impact this workflow. It was not the intent to force the SocialApp approach. Would you be willing to submit a PR to revert just this part of the change, and test on your end that the original workflow works? If so, I can backport to 0.13.x for the next bugfix release.

[p-fruck]

Actually I would not like to revert the changes as I don't think mixing settings and DB is a good approach. I would rather take the time to implement the logic required to fully configure Social Apps via settings without touching the database (which was not possible previously).

[SchrodingersGat]

@p-fruck thanks for pointing this out. The intent was not to enforce a breaking change here - that is not what we want for bugfix / patch releases. This has crept in unintentionally.

I have updated the release notes for 0.13.1 to indicate the breaking change.

[p-fruck]

@SchrodingersGat InventTree 13.3 breaks OIDC again. There is a small typo (0.6.1 instead of 0.60.1) in the release note. The 0.60.0 release defines a new SOCIALACCOUNT_OPENID_CONNECT_URL_PREFIX variable that defaults to oidc. Therefore, my OIDC redirect uri is accounts/oidc/oidc/login/callback with InvenTree 13.3 instead of accounts/oidc/login/callback with InvenTree 13.2.
The fix is to set the prefix to an empty string. Should this be done by every user in their local setup or should we include this setting in the InvenTree source code, so that OIDC works out of the box?

[SchrodingersGat]

There is a small typo (0.6.1 instead of 0.60.1) in the release note.

Thanks, I have fixed that now.

InventTree 13.3 breaks OIDC again.

Apologies, there are so many possible configurations here and while we try, it is hard to test and validate that fixing one bug does not introduce another.

Should this be done by every user in their local setup or should we include this setting in the InvenTree source code, so that OIDC works out of the box?

From the django-allauth notes, it would seem that explicitly setting the value to an empty string would be the simplest change, to maintain backwards compatibility.

[SchrodingersGat]

Ref: #6324

[p-fruck]

Sounds good, that would be my preferred fix too. Thanks for your time and effort!