Skip to content

Register OIDC providers through the Icinga Web login button hook - #31

Open
lippserd wants to merge 4 commits into
RISE-GmbH:mainfrom
lippserd:login-button-hook
Open

Register OIDC providers through the Icinga Web login button hook#31
lippserd wants to merge 4 commits into
RISE-GmbH:mainfrom
lippserd:login-button-hook

Conversation

@lippserd

@lippserd lippserd commented Jul 30, 2026

Copy link
Copy Markdown
Collaborator

This PR registers OIDC provider buttons through the login button hook introduced in Icinga Web 2.13. It replaces the legacy login route and view override, as well as the optional loginhooks integration, while preserving provider captions, colors, and logos.

It also:

  • Preserves internal return redirects while rejecting external and logout redirects.
  • Stores relogin state as a module-local provider route, validates current and legacy cookie values, expires invalid or stale references, and reconstructs redirects from enabled provider names.
  • Reports authentication failures without exposing exception details and destroys Jumbojett sessions after both successful and failed authentication.
  • Moves backend registration to run.php and removes PHP tag boundaries from configuration.php to prevent premature output.
  • Uses Pdo\Mysql::ATTR_INIT_COMMAND and raises the minimum requirements to Icinga Web 2.13, PHP 8.2, and Icinga PHP Library 0.19.

One important note for you to consider:

The repository currently mixes line endings. In this PR, AuthenticationController.php, doc/02-Installation.md, module.info, and run.php use CRLF, while the new LoginButtonHook.php uses LF. Consequently, git diff --check origin/main...HEAD reports 58 added lines as trailing whitespace.

I recommend normalizing line endings in a separate commit or PR so further changes remain easy to review. Add * text=auto eol=lf to .gitattributes, configure the editor to save LF, and run git add --renormalize .. Avoid * -text, because that disables Git's text normalization and preserves the current inconsistency.

TheSyscall and others added 4 commits July 3, 2026 15:00
Replace deprecated `PDO::MYSQL_*` constant usage with the driver-specific
`Pdo\Mysql::ATTR_*` constants introduced in PHP 8.4.

This prepares the code for PHP 8.5, where accessing MySQL driver constants
through the generic `PDO` class is deprecated.

This change requires a compatibility shim on older PHP versions to provide
`Pdo\Mysql` for runtimes that do not expose the driver-specific class yet. The
shim is provided in `ipl-sql`.

Because of this change, the Icinga PHP Library requirement is raised from
0.13.0 to 0.19.0 and the documented PHP requirement is raised from 7.3 to 8.2.

Co-authored-by: Eric Lippmann <eric.lippmann@icinga.com>
PHP emits the whitespace between `?>` and `<?php` as HTTP output. When
Icinga Web later attempts to send headers (e.g. for redirects or session
cookies), this already-sent output causes "headers already sent" errors.
Removing the open/close tag pairs and the trailing `?>` prevents premature
output from the module configuration file.
Register provider login buttons through the Icinga Web 2.13 hook and move
backend setup into run.php. Remove the legacy route and view integration.

Preserve safe redirects and relogin behavior, and surface provider failures
without exposing exception details.

Co-authored-by: Alexander Rieß <alexander.riess@icinga.com>
Store only a module-local provider route and validate both new and legacy
cookie values before resolving an enabled provider. Rebuild every redirect
from the provider name so reverse-proxy scheme differences and stale or
hostile cookie URLs cannot escape the login flow.

Malformed and stale values are discarded while transient database failures
retain the cookie and surface the existing generic login error.
@moreamazingnick

moreamazingnick commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Thank you for your contribution.

It seems a bit off:

Bildschirmfoto 2026-08-03 um 16 38 31

in contrast to:
Bildschirmfoto 2026-08-03 um 16 46 53

@DeadHunter

Copy link
Copy Markdown
/* public/css/module.less */
&:is(button)[name="btn_submit"] {
  display: flex;
  flex-direction: row;
  align-items: center;
  justify-content: center;
  gap: 1em;
  padding: .5em .75em;
  height: fit-content !important;
  font-weight: bold;
  font-size: 1.25em;
  flex-grow: 1;

  transition: filter ease-in-out 75ms;
  filter: saturate(.5);
  &:hover, &:focus {
    filter: saturate(1);
  }
}

Example with Image:
image

Example without image:
image

Example with long caption:
image

Maybe even larger text if a icon is present:
image

&:is(button)[name="btn_submit"] {
  /* ... */
  &:has(img) {
    font-size: 1.5em;
  }
  /* ... */
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants