Skip to main content

Module oidc

teamcraft

Module oidc 

Source
Expand description

OpenID Connect login (authorization code flow with PKCE), tested against Authentik but provider agnostic.

Flow:

  1. /auth/oidc/login stores state, nonce and a PKCE verifier in the oidc_states table and redirects to the provider.
  2. The provider redirects back to /auth/oidc/callback?code=…&state=….
  3. The code is exchanged for tokens at the token endpoint (back channel, authenticated with the client secret, over TLS).
  4. Claims are taken from the ID token and the userinfo endpoint. Because the ID token is received directly from the token endpoint over TLS, TLS server validation substitutes signature validation (OpenID Connect Core 1.0, section 3.1.3.7, step 6). iss, aud, exp and nonce are still verified.
  5. Groups are mapped to a TeamCraft role (see role_for_groups).

Structs§

OidcClient

Constants§

BACKCHANNEL_LOGOUT_EVENT
The event a back-channel logout token carries (OpenID Connect Back-Channel Logout 1.0, section 2.4).

Functions§

role_for_groups
Maps IdP groups to a role. None means the user may not log in.