Add OIDC authentication error response support #516

New Issue

MrUnknownDE · 2026-04-05T17:15:08+02:00

MrUnknownDE commented

2026-04-05 17:15:08 +02:00

Originally created by @buggystick on 12/10/2025

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

Surface any OIDC provider errors returned via query parameters (error, error_description, error_uri) by passing them to ValidateOidcToken, skipping the backend call, and rendering the provider’s own message
as the primary alert so users immediately see why the login stopped.
Tidy the callback UI so provider-supplied errors fully replace the generic “problem connecting” copy, while retaining the fallback text for errors we generate ourselves.
Wrap /api/v1/auth/idp/:id/oidc/validate-callback in targeted error handling for OAuth2RequestError, UnexpectedResponseError, UnexpectedErrorResponseBodyError, and ArcticFetchError, logging structured details
and returning meaningful HTTP codes/messages instead of a generic 500.
Add guardrails for missing authorization code or state so we display actionable guidance when the IdP doesn’t return the expected parameters.

How to test?

npm install
npm run set:oss && npm run set:sqlite
Configure config/config.yml (e.g., dashboard URL http://localhost:3002), then run npm run db:sqlite:generate and npm run db:sqlite:push.
Start the stack with npm run dev.
Configure an OIDC identity provider (tested with Auth0: authorization URL https://.auth0.com/authorize, token URL https://.auth0.com/oauth/token, redirect http://localhost:3002/auth/idp//
oidc/callback).
From the dashboard login, authenticate with an account that the IdP blocks (e.g., email not verified). The callback page should display the provider’s error description verbatim, with no extra generic text,
and the browser should remain on the callback page.
Authenticate with an allowed account. The standard code exchange path should complete, creating a session and redirecting to your requested resource.

*Originally created by @buggystick on 12/10/2025* ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description - Surface any OIDC provider errors returned via query parameters (error, error_description, error_uri) by passing them to ValidateOidcToken, skipping the backend call, and rendering the provider’s own message as the primary alert so users immediately see why the login stopped. - Tidy the callback UI so provider-supplied errors fully replace the generic “problem connecting” copy, while retaining the fallback text for errors we generate ourselves. - Wrap /api/v1/auth/idp/:id/oidc/validate-callback in targeted error handling for OAuth2RequestError, UnexpectedResponseError, UnexpectedErrorResponseBodyError, and ArcticFetchError, logging structured details and returning meaningful HTTP codes/messages instead of a generic 500. - Add guardrails for missing authorization code or state so we display actionable guidance when the IdP doesn’t return the expected parameters. ## How to test? 1. npm install 2. npm run set:oss && npm run set:sqlite 3. Configure config/config.yml (e.g., dashboard URL http://localhost:3002), then run npm run db:sqlite:generate and npm run db:sqlite:push. 4. Start the stack with npm run dev. 5. Configure an OIDC identity provider (tested with Auth0: authorization URL https://<tenant>.auth0.com/authorize, token URL https://<tenant>.auth0.com/oauth/token, redirect http://localhost:3002/auth/idp/<id>/ oidc/callback). 6. From the dashboard login, authenticate with an account that the IdP blocks (e.g., email not verified). The callback page should display the provider’s error description verbatim, with no extra generic text, and the browser should remain on the callback page. 7. Authenticate with an allowed account. The standard code exchange path should complete, creating a session and redirecting to your requested resource.

MrUnknownDE closed this issue

2026-04-05 17:15:08 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#516