nagisa-kunhah opened a new pull request, #1542: URL: https://github.com/apache/dubbo-admin/pull/1542
**Please provide a description of this PR:** This PR adds configurable GitHub OAuth and OpenID Connect (OIDC) login support to the Dubbo Admin Console while preserving the existing username/password login flow. The backend now provides a unified authentication model based on `Principal`. Password, GitHub, and OIDC identities are stored in the existing Admin session using the same representation. Existing sessions containing the legacy `user` value remain supported and are converted to a local `Principal` when read. The Console authentication configuration now supports: - Explicit login methods, with password login enabled by default for backward compatibility. - Multiple named GitHub or OIDC providers. - Provider display names, client credentials, redirect URLs, post-login redirect URLs, and scopes. - A configurable session secret and secure-cookie option. - Validation for provider IDs, provider types, callback URLs, OIDC issuers, scopes, and production session secrets. The following Console APIs are added: - `GET /api/v1/auth/providers` - `GET /api/v1/auth/providers/:provider/login` - `GET /api/v1/auth/providers/:provider/callback` - `GET /api/v1/auth/userinfo` The OAuth/OIDC flow includes state validation, PKCE with S256, single-use login transactions, and OIDC nonce validation. GitHub identities are loaded from the GitHub user APIs, including verified-email fallback. OIDC providers are discovered from their issuer metadata, and their ID Tokens are validated before claims are mapped to a `Principal`. The Vue login page now loads the enabled login methods from the Console, conditionally displays the password form, and renders buttons for configured providers. After authentication, the UI reads the current identity from `/auth/userinfo` so the header displays the authenticated provider username. Empty or `null` provider responses are handled safely for password-only deployments. This change does not add AI-service authentication, Admin-issued access tokens, JWKS endpoints, RBAC, refresh tokens, or user-specific AI session isolation. Backward compatibility is preserved: - Password login remains the default when `methods` is omitted. - Existing password-only deployments may continue using the legacy default session secret. - OAuth/OIDC configuration is optional. - Existing legacy Admin sessions remain readable. Validation performed: - `go test ./...` - Focused Vue unit tests for the login page and authentication session utilities. - ESLint and Prettier checks for the changed frontend files. - `git diff --cached --check` **To help us figure out who should review this PR, please put an X in all the areas that this PR affects.** - [ ] Docs - [ ] Installation - [x] User Experience - [ ] Dubboctl - [x] Console - [ ] Core Component **Please check any characteristics that apply to this pull request.** - [x] Adds a backward-compatible feature - [x] Adds or changes Console configuration - [x] Changes authentication or security-sensitive behavior - [x] Adds backend tests - [x] Adds frontend tests - [ ] Introduces a breaking change - [ ] Requires a data migration - [ ] Changes Dubboctl behavior - [ ] Changes Core Component behavior -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
