Skip to content

v1.0.0

Choose a tag to compare

View all tags
@AYDEV-FR AYDEV-FR released this 01 Jun 11:15
v1.0.0
959408b

Initial stable release of the CTFd OIDC / OAuth2 Identity Provider plugin — turn a CTFd instance into an OpenID Connect / OAuth2 Identity Provider so other apps can offer "Log in with CTFd".

Features

  • Authorization Code grant with PKCE; optional refresh tokens
  • OpenID Connect id_tokens (RS256), userinfo, revocation, introspection, discovery + JWKS
  • Public and confidential clients; trusted (first-party) apps skip consent
  • Admin UI under the Plugins menu; user Authorized Apps tab on the Settings page
  • Declarative provisioning of applications from a mounted YAML file
  • Claims for profile, email, CTFd team and admin / role

Deployment

  • Classic CTFd plugin install (requirements.txt)
  • Plugin-only OCI image for Kubernetes volume mounting:
    ghcr.io/aydev-fr/ctfd-oidc-provider:1.0.0
  • GitHub Actions: multi-arch OCI build/push to GHCR + CI
  • Docker Compose stack with a demo relying-party for local testing

Security hardening

  • PKCE enforced for public clients on both the GET and POST authorize paths
  • Startup warning when OIDC_PROVIDER_ISSUER is unset (spoofable Host header)
  • Client secrets are never auto-generated or written to logs
  • At least one absolute http(s) redirect URI required per app
  • client_uri restricted to http(s) (no javascript: on the consent screen)

See the README for installation, configuration and usage.

Assets 2
Loading