Register OIDC providers through the Icinga Web login button hook - #31
Open
lippserd wants to merge 4 commits into
Open
Register OIDC providers through the Icinga Web login button hook#31lippserd wants to merge 4 commits into
lippserd wants to merge 4 commits into
Conversation
Replace deprecated `PDO::MYSQL_*` constant usage with the driver-specific `Pdo\Mysql::ATTR_*` constants introduced in PHP 8.4. This prepares the code for PHP 8.5, where accessing MySQL driver constants through the generic `PDO` class is deprecated. This change requires a compatibility shim on older PHP versions to provide `Pdo\Mysql` for runtimes that do not expose the driver-specific class yet. The shim is provided in `ipl-sql`. Because of this change, the Icinga PHP Library requirement is raised from 0.13.0 to 0.19.0 and the documented PHP requirement is raised from 7.3 to 8.2. Co-authored-by: Eric Lippmann <eric.lippmann@icinga.com>
PHP emits the whitespace between `?>` and `<?php` as HTTP output. When Icinga Web later attempts to send headers (e.g. for redirects or session cookies), this already-sent output causes "headers already sent" errors. Removing the open/close tag pairs and the trailing `?>` prevents premature output from the module configuration file.
Register provider login buttons through the Icinga Web 2.13 hook and move backend setup into run.php. Remove the legacy route and view integration. Preserve safe redirects and relogin behavior, and surface provider failures without exposing exception details. Co-authored-by: Alexander Rieß <alexander.riess@icinga.com>
Store only a module-local provider route and validate both new and legacy cookie values before resolving an enabled provider. Rebuild every redirect from the provider name so reverse-proxy scheme differences and stale or hostile cookie URLs cannot escape the login flow. Malformed and stale values are discarded while transient database failures retain the cookie and surface the existing generic login error.
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.






This PR registers OIDC provider buttons through the login button hook introduced in Icinga Web 2.13. It replaces the legacy login route and view override, as well as the optional
loginhooksintegration, while preserving provider captions, colors, and logos.It also:
run.phpand removes PHP tag boundaries fromconfiguration.phpto prevent premature output.Pdo\Mysql::ATTR_INIT_COMMANDand raises the minimum requirements to Icinga Web 2.13, PHP 8.2, and Icinga PHP Library 0.19.One important note for you to consider:
The repository currently mixes line endings. In this PR,
AuthenticationController.php,doc/02-Installation.md,module.info, andrun.phpuse CRLF, while the newLoginButtonHook.phpuses LF. Consequently,git diff --check origin/main...HEADreports 58 added lines as trailing whitespace.I recommend normalizing line endings in a separate commit or PR so further changes remain easy to review. Add
* text=auto eol=lfto.gitattributes, configure the editor to save LF, and rungit add --renormalize .. Avoid* -text, because that disables Git's text normalization and preserves the current inconsistency.