Release v0.7.0 - #128
Merged
Merged
Conversation
Auth:Provider = oidc was the one value that did nothing. It now adds the OpenID Connect handler beside the existing cookie, so pages, [Authorize] and the cascading auth state are untouched — both schemes land on the same principal. Access is checked twice on purpose: the provider decides who may get a token, and Auth:Oidc:RequiredGroups re-checks the groups claim here. Neither layer relies on the other being right. Empty admits anyone the provider authenticated, so IdPs with no group model still work. /login challenges instead of showing a password box that cannot work, /logout is federated so the next visit does not sign straight back in, and first-run setup stops demanding an administrator that will never exist. Also fixes a regression from #122, released in v0.6.0: that diff moved the *arr env bootstrap under the `local` provider guard meant for the setup link, so the bootstrap silently did nothing unless local auth was configured. Closes #48 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
ChrisonSimtian
added
the
skip-changelog
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One change since v0.6.0, and it closes the last open issue.
Auth:Provider = oidcworks: the UI's sign-in can be delegated to Authentik, Keycloak, Authelia, Entra or anything else standards-based. OptionalAuth:Oidc:RequiredGroupsre-checks the groups claim as a second, independent layer. Federated sign-out, and first-run setup no longer demands an administrator that would never exist.It also fixes a regression released in v0.6.0: #122 had moved the
*arrenvironment bootstrap under thelocal-provider guard, so it silently did nothing unless local auth was configured.Minor bump — a new capability plus new configuration keys (
AUTH_PROVIDER,OIDC_*in the compose.env).Merge by fast-forward, not the button —
git merge --ff-only develop && git push origin main.