guymoyo opened a new pull request, #818:
URL: https://github.com/apache/fineract-backoffice-ui/pull/818
## What and why
Adds an opt-in "Sign in with your identity provider" path to the login page:
authorization-code flow with PKCE (S256) as a public client, driven by an
`oidc` block in `config.json` (`oidcLoginEnabled`, `oidc.issuer`,
`oidc.clientId`, `oidc.scopes`, `passwordLoginEnabled`). Without those keys the
login page is unchanged, and password login stays on unless a deployment turns
it off (which is ignored unless OIDC is fully configured). No new dependency;
`offline_access` is never requested.
The UI loads the user context from `GET /v1/userdetails` with the Bearer
token and maps it to the same session a Basic login produces, so menus, guards
and `rbacEnabled` work unchanged. **Platform note:** in Fineract 1.15.0 that
endpoint is only loaded with `fineract.security.oauth2.enabled`, so with OIDC
federation (`fineract.security.oidc-federation.enabled`) alone it answers 404.
Fineract needs a change to also load it under the federation flag; that
upstream work is tracked separately (Jira to be filed). The UI does not fail
open: on a 404 it drops the tokens, opens no session and shows a clear message
on the callback page.
`DOCS/OIDC.md` documents the config keys, the Keycloak client settings
(public client, PKCE S256, exact redirect URIs, no `offline_access`, audience
mapper) and the userdetails requirement.
Closes #370
## Verification
- `npm ci`, `npm run lint` (0 errors, no change to the suppressions
baseline), `npm run test:unit` (312 files, 2546 tests), `npm run build`, `npm
run i18n:check`, `check:icons`, `check:a11y-names`, `check:route-permissions`
all pass.
- Mocked Playwright (`--project=mocked e2e/login.spec.ts
e2e/oidc-login.spec.ts`) passes. The OIDC spec covers the config matrix
(absent, wrong-typed or incomplete config shows nothing new), password form
hiding, the full round trip against a mocked provider (discovery, PKCE S256
redirect, code exchange, Bearer `/v1/userdetails`), the 404 case, and a
mismatched `state`.
- Not run here: the `backend` Playwright project
(`oidc-login-backend.spec.ts` was updated for the new behaviour but needs
Docker).
- Verified by hand end to end against Fineract 1.15.0 + Keycloak 26, with
the platform change described above applied.
## Screenshots
Available on request.
## Checklist
- [x] I did not hand-edit generated files under `src/app/api/`.
- [x] New component or service code uses the adapter boundary in
`src/app/core/adapters/` instead of direct browser globals or imperative
third-party APIs.
- [x] User-facing strings use translation keys.
- [x] I added or updated tests appropriate to this change, or explained why
tests were not needed.
- [x] UI workflow changes include suitable e2e coverage, including
real-backend testing where relevant.
- [x] Commits are signed — see [Commit
Signing](CONTRIBUTING.md#commit-signing) in CONTRIBUTING.md.
- [ ] I followed the [AI-assisted contributions
guidance](CONTRIBUTING.md#ai-assisted-contributions).
- [ ] If this adds a feature or changes a workflow, I raised it on
[[email protected]](https://lists.apache.org/[email protected])
first —
or it is a bug fix, refactor or test change, where that does not apply.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
