Skip to content

feat: auto-redirect to OIDC IdP (#991) - #1029

Merged
jmattheis merged 3 commits into
gotify:masterfrom
DerDummePunkt:github_1007_option_to_redirect_to_idp_when_logged_out
Aug 20, 2026
Merged

feat: auto-redirect to OIDC IdP (#991)#1029
jmattheis merged 3 commits into
gotify:masterfrom
DerDummePunkt:github_1007_option_to_redirect_to_idp_when_logged_out

Conversation

@DerDummePunkt

Copy link
Copy Markdown
Contributor

This PR attempts to implement the missing part of #991

Add GOTIFY_OIDC_AUTO_REDIRECT (with default false) to skip the login page and redirect straight to the configured OIDC provider. Only takes effect when local auth is disabled, since local login would otherwise be unreachable.

Add GOTIFY_OIDC_AUTO_REDIRECT_REQUIRE_REAUTH (default false) to send prompt=login on that redirect, so logging out of Gotify doesn't silently log the user back in via an existing IdP session. Does not end that IdP session, so other apps using it are unaffected.

Wire both flags through gotifyinfo/injected UI config and the WebUI login page, which now redirects instead of showing the OIDC button when enabled.

Added helperfunction to emit warnigns via FutureLog in config builder/parser

@DerDummePunkt
DerDummePunkt requested a review from a team as a code owner August 15, 2026 10:11
@codecov

codecov Bot commented Aug 15, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 96.55172% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 75.47%. Comparing base (8af44e0) to head (82856b6).

Files with missing lines Patch % Lines
api/oidc.go 88.88% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #1029      +/-   ##
==========================================
+ Coverage   74.78%   75.47%   +0.69%     
==========================================
  Files          66       66              
  Lines        3541     3556      +15     
==========================================
+ Hits         2648     2684      +36     
+ Misses        688      662      -26     
- Partials      205      210       +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@DerDummePunkt
DerDummePunkt force-pushed the github_1007_option_to_redirect_to_idp_when_logged_out branch from 69d7eb8 to d764fd9 Compare August 15, 2026 12:35

@jmattheis jmattheis left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the contribution.

Comment thread gotify-server.env.example Outdated
Comment thread gotify-server.env.example Outdated
Comment thread ui/src/user/Login.tsx
Comment thread model/gotifyinfo.go
Comment thread config/config.go Outdated
@DerDummePunkt

DerDummePunkt commented Aug 15, 2026

Copy link
Copy Markdown
Contributor Author

Im pretty confident the prompt params are correct and to spec, but I'm having trouble testing value combinations, it seems I have discovered a bug in authelia 🤷‍♂️

I will test mutliple prompt values against one of my dev keycloak instances later, but configuring keycloak is always such a pain in the a**, I doint have time for that right now

@jmattheis
jmattheis force-pushed the github_1007_option_to_redirect_to_idp_when_logged_out branch from 5ae0c1e to 82856b6 Compare August 19, 2026 19:06
@jmattheis

jmattheis commented Aug 19, 2026

Copy link
Copy Markdown
Member

I've made some changes, notably:

  • Made the prompt a text-list
  • Added the prompt parameter to the external auth flow
  • The login form is always shown (no login spinner), and no redirect is done when oidc is disabled or there is a connection error

I'll test this some more this week.

@jmattheis

Copy link
Copy Markdown
Member

I've tested with dex, authelia, keycloak and authentik. Authentik didn't seem to use the prompt parameter, but didn't error when it was set. I tried using multiple prompt values like login consent, but this didn't seem to make any difference on the listed IdPs. authelia prompt for consent anyway when using prompt=login.

@jmattheis
jmattheis added this pull request to the merge queue Aug 20, 2026
Merged via the queue into gotify:master with commit 6933034 Aug 20, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants