GradeShelf v1.2.0 - SSO login and account roles

GradeShelf 1.2.0 adds support for SSO login through OpenID Connect and role changes for existing accounts.

SSO login

• Configure an OpenID Connect (OIDC) provider under Admin → Advanced features → SSO login. Check the provider configuration and copy the callback URL directly from the dashboard.
• Connect an existing account under Settings → Security → SSO login, then use the SSO login button for future sign-ins.
• Keep using the same account, grades, files and preferences. Local username and password sign-in remains available, including when the provider is unavailable.
• Manage SSO settings and account connections in English or German.

Accounts are still created by administrators. SSO does not automatically create accounts, merge them by email or synchronize roles from the provider.

Account roles

• Change existing accounts between User and Administrator in account administration.
• Administrators cannot change their own role. The last active administrator is also protected from demotion, deactivation and deletion.
• Role changes end the affected account's sessions without changing grades, files or SSO connections.
• Successful changes appear as admin.role_changed in the application logs, including the acting administrator's ID, affected account ID and previous and new roles.

Administrator access does not grant access to another user's grades or files.

Security and sessions

Connecting or disconnecting SSO requires a recent local sign-in, including local 2FA when enabled. Client secrets are encrypted, and provider tokens are not retained in the account database.

Saving SSO settings revokes existing SSO sessions. Disconnecting SSO revokes that account's SSO sessions. Configure two-factor authentication for SSO at your provider; GradeShelf's own TOTP protection applies to local password sign-in.

Updating

Back up your installation and update from its directory:

sh scripts/backup.sh && docker compose pull && docker compose up -d --wait

Keep your existing .env and data/ directory. The container runs the database migration automatically during startup. It adds SSO settings and session metadata without deleting or replacing existing accounts, grades or uploads.

For a pinned installation, set GRADESHELF_IMAGE to ghcr.io/14flavius/gradeshelf:1.2.0 before updating.

The release workflow builds images for amd64 and arm64 and publishes them after its build and persistence checks succeed. Wait for the Publish Docker image workflow to finish before pulling the update.