steve
3b1a35b7f2
Add OpenID Connect as an alternative login method. Users can sign in via an external identity provider (e.g., Authentik, Keycloak, Google). - OIDC settings configured in admin UI (discovery URL, client ID/secret, redirect URI, button label, enable/disable toggle) - PKCE-based authorization code flow with state and nonce validation - Admin can manually link any user's OIDC identity (sub/issuer fields) - Self-service linking: logged-in users can link/unlink their own account - SSO button conditionally shown on login page when OIDC is enabled - Username in header now clickable to open profile for all users - Callback errors/success communicated via URL hash fragments
12 lines
492 B
Bash
12 lines
492 B
Bash
# Copy to .env and fill in values before starting in production.
|
|
# Generate SESSION_SECRET with: openssl rand -hex 32
|
|
|
|
SESSION_SECRET=replace-with-a-random-64-character-hex-string
|
|
SESSION_MAX_AGE_HOURS=168 # default: 168 (7 days)
|
|
PORT=3000
|
|
DB_PATH=/app/data/check-printing.db
|
|
|
|
# OIDC settings are configured in the admin UI (Manage Users > Single Sign-On).
|
|
# No environment variables needed — discovery URL, client ID/secret, and
|
|
# redirect URI are stored in the database settings table.
|