mraible opened a new pull request, #155: URL: https://github.com/apache/roller/pull/155
Stacked on #154 (1/3 in the stack); after it merges, this retargets to master. Replaces the obsolete OpenID 2.0 authentication (removed in Spring Security 6) with OAuth 2.0/OIDC login using `spring-security-oauth2-client`. Phase 3 of the Jakarta EE 10 migration ([ROL-2183](https://issues.apache.org/jira/browse/ROL-2183)). **Removed / changed behavior** — read before merging: - The `openid` and `db-openid` values of `authentication.method` no longer exist; configs using them must move to `oidc` or `db-oidc`. OpenID 2.0 relay support does not survive in any form (the protocol is dead and Spring Security dropped it upstream). - `users.oidc.autoProvision.enabled` defaults to true: anyone the identity provider authenticates gets a Roller account on first login. Set it to false to require pre-created accounts. Linking to an existing account additionally requires the provider to assert a verified email matching that account. - docker-compose now defaults `AUTHENTICATION_METHOD` to `oidc`, so the demo signs in through the bundled Keycloak by default; set `db` for the old form-login demo or `db-oidc` for both side by side. - This adds OAuth 2.0 for browser login only. It does not restore the AtomPub API's removed OAuth 1.0a option (see #154); AtomPub remains basic/wsse. How it works: - `RollerClientRegistrationRepository` reads provider config (client-id, client-secret, issuer-uri) from Roller properties, with OIDC discovery at startup - `RollerOidcUserService` resolves the Roller account behind an authenticated OIDC user via the existing `openIdUrl` column (stores `issuer#sub`) and provisions accounts just in time, so the principal carries Roller roles from the first request - The returned principal is named after the resolved Roller account. Roller looks users up by principal name throughout (rendering models, filters, Struts actions), and the default OidcUser name is the opaque `sub` claim, which made every rendered weblog page fail with a Velocity error for signed-in OIDC users - `AuthMethod` gains `OIDC`/`DB_OIDC`, and Login.jsp shows provider buttons built from the resolved registrations, so it never advertises a provider whose discovery failed - docker-compose gains Keycloak seeded with admin/admin and user/user, and the image builds from the working tree instead of a cloned release tag - 19 unit tests cover the new classes, including regressions for the principal name and the provisioning policy To try it: add `127.0.0.1 keycloak` to /etc/hosts, then `docker compose up -d` and log in at http://localhost:8080/ as admin/admin or user/user. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
