Add an OIDC auto-login option for the web login pages - #2271
Open
huzama wants to merge 1 commit into
Open
Conversation
OIDC-only deployments skip the SFTPGo login page by rewriting it at the reverse proxy, which any query string bypasses and which loops logout and error redirects back into the provider. Handling it in the login handler lets the redirect be skipped while a flash message is pending and once after a logout, so errors stay visible and logging out works. Disabled by default. See drakkan#1646.
|
|
There was a problem hiding this comment.
Pull request overview
Adds an opt-in OIDC “auto-login” mode that can redirect WebAdmin and/or WebClient login pages directly to the OpenID Provider (instead of rendering the local login page), while preserving existing OIDC redirect/PKCE/next handling and preventing redirect loops after logout or when an auth error must be shown.
Changes:
- Introduces
oidc.auto_login(bitmask 0..3) in config/env and documents it in the sample JSON. - Implements conditional login-page redirects for WebAdmin/WebClient, with suppression when a flash error is present or immediately after logout via a short-lived one-shot cookie.
- Adds startup validation and tests covering redirect behavior,
nextpropagation, suppression paths, and env/config parsing.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| sftpgo.json | Adds oidc.auto_login to the sample configuration with default 0. |
| internal/httpd/server.go | Triggers OIDC redirect from login handlers when auto-login is enabled; sets no-auto-login cookie on logout. |
| internal/httpd/oidc.go | Adds AutoLogin field to OIDC configuration with in-code documentation. |
| internal/httpd/oidc_test.go | Adds tests for auto-login config validation, redirect behavior, and no-auto-login cookie semantics. |
| internal/httpd/httpd.go | Adds auto-login enablement checks and startup validation integration. |
| internal/httpd/auth_utils.go | Implements short-lived one-shot no_auto_login cookie helpers. |
| internal/config/config.go | Wires oidc.auto_login default and env var parsing. |
| internal/config/config_test.go | Extends env-binding tests to cover OIDC__AUTO_LOGIN. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+819
to
+827
| func (b *Binding) checkAutoLogin() error { | ||
| if b.OIDC.AutoLogin&1 != 0 && !b.isWebAdminAutoLoginEnabled() { | ||
| return errors.New("OIDC auto login is enabled for the WebAdmin UI but OIDC login is not available") | ||
| } | ||
| if b.OIDC.AutoLogin&2 != 0 && !b.isWebClientAutoLoginEnabled() { | ||
| return errors.New("OIDC auto login is enabled for the WebClient UI but OIDC login is not available") | ||
| } | ||
| return nil | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Checklist for Pull Requests
Adds
oidc.auto_login, an opt-in setting that sends the WebAdmin and WebClient login pages straight to the OpenID provider instead of rendering the SFTPGo login page.Why
With OIDC configured, reaching the provider always costs an extra click. Deployments that authenticate only through an identity provider work around this by rewriting the login path at the reverse proxy. That workaround is fragile: the rule is bypassed by any query string, it rewrites the login
POSTas well, and it traps the logout and OIDC error paths in a redirect loop, because both deliberately return the browser to the login page.Configuration
0123The selected UI needs a usable OIDC setup:
role_fieldorimplicit_rolesfor the WebAdmin UI, and OIDC login not turned off throughdisabled_login_methods. Invalid combinations are rejected at startup rather than leaving the login page unreachable.Behaviour
handleClientWebLoginandhandleWebAdminLogincalloidcLoginRedirectdirectly, so this is a single redirect and the existingnextvalidation and PKCE handling are reused unchanged.The login page is still rendered, without redirecting, in two cases:
HttpOnlycookie that the next render consumes and clears. Without it, logging out would start a new login flow against an identity provider session that normally outlives the SFTPGo one, and the user would be signed straight back in.The setting only controls presentation. It does not disable password authentication;
disabled_login_methodsremains the way to enforce OIDC-only access.Tests
TestOIDCAutoLogin,TestOIDCAutoLoginConfigandTestNoAutoLoginCookiecover both UIs,nextpropagation, the two suppression paths and the startup validation.