Repository navigation
feat(stack): let stacklets sign in through an OIDC provider - #123
Merged
Merged
Conversation
A stacklet can now use single sign-on from another stacklet without
either one naming the other.
- A client declares `[oidc]` (name, callbacks) and reads
`{oidc_issuer}`, `{oidc_client_id}` and `{oidc_client_secret}`. All
three stay empty until a provider has registered it, so the service
keeps its own login until then.
- A provider declares `[oidc_provider]`. Its hooks list the clients
with `ctx.stack.oidc_clients()` and store what the identity service
issued with `ctx.stack.store_oidc_client()`.
- `stack doctor` warns about a running client that the running
provider has not registered, and about a second provider that is
ignored.
Credentials live in the provider's secret namespace, so destroying the
provider switches every client back to its own login.
When a stacklet that provides OpenID Connect is installed and has registered the docs stacklet, Paperless shows a "Sign in with family account" button next to the password form. Without a provider the login is unchanged. - A first login creates the Paperless account; an existing account is linked by verified email. - New accounts join the `all_documents` group, which sees and edits the whole archive. The group and a one-time grant over existing documents are set up on the next `./stack up docs` after the provider exists. - The provider entry keeps the id `pocketid`, which Paperless stores on every linked account. A second entry for the same client breaks the signup step in allauth, so there is exactly one.
arthware-dev
force-pushed
the
feat/oidc-contract
branch
from
September 23, 2026 14:29
7c09c39 to
f138f19
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
[oidc]and reads{oidc_issuer},{oidc_client_id}and{oidc_client_secret}; a provider declares[oidc_provider]and registers clients throughctx.stack.oidc_clients()andctx.stack.store_oidc_client(). Credentials stay in the provider's secret namespace, so destroying the provider switches every client back to its own login.stack doctorwarns about a running client the provider has not registered, and about a second provider that is ignored.all_documentsgroup.