Skip to content

v1.10.0 — Native OIDC login

Choose a tag to compare

View all tags
@msmcpeake msmcpeake released this 02 Jul 18:33
· 8 commits to main since this release
v1.10.0
fab6241

Native OpenID Connect login, replacing reverse-proxy forward auth.

  • Auth: built-in OIDC client (Authorization Code + PKCE, confidential client, backchannel token exchange, userinfo claims) with server-side sessions and real logout
  • Auth: optional group restriction via PATCHKIT_OIDC_REQUIRED_GROUP
  • Auth: fully opt-in through PATCHKIT_OIDC_* env vars — with none set, PatchKit runs open (or via legacy forward auth) and pulls in no extra dependencies (stdlib only)
  • Auth: the proxy-IP allowlist now defaults to open; set PATCHKIT_TRUSTED_PROXIES when running behind a reverse proxy so fresh installs aren't locked out
  • Frontend bounces to login on 401 and shows a logout control; added oidc.env.example and documented the systemd unit
Assets 2
Loading