Repository navigation
feat(oidc): OIDC authentification - #23
Closed
mohamedalibarkailluin wants to merge 1 commit into
Closed
mohamedalibarkailluin wants to merge 1 commit into
mohamedalibarkailluin wants to merge 1 commit into
Conversation
eledhwen
requested changes
Oct 23, 2026
| <div class="notice-title">Signed out</div> | ||
| <div class="notice-body"> | ||
| Your Wombat session has been cleared and coming back will ask which Google account to use. Your | ||
| Google account itself stays signed in on this device — only Google can end that session. |
|
|
||
| ## Access control | ||
|
|
||
| The whole HTTP surface (UI and REST) can be restricted to Illuin Google Workspace accounts. There is **no |
Collaborator
There was a problem hiding this comment.
Clear the AI generated comments + there should be no mention of ILLUIN-specific assets, this should be a generic OIDC integration
| application-type: hybrid # browsers use the code flow, API clients may pass a bearer token | ||
| token: | ||
| required-claims: | ||
| hd: illuin.tech # rejected at token validation if absent or different |
Collaborator
There was a problem hiding this comment.
Again, shouldn't reference illuin assets
| secret: <client-secret> | ||
| ``` | ||
|
|
||
| ### Why `hd` is the claim that matters |
Collaborator
There was a problem hiding this comment.
This smells of AI generated documentation, you should get rid of it.
|
|
||
| # Access control. `quarkus.oidc.tenant-enabled` is the only switch: false (the default set in | ||
| # application.yaml) contacts no provider and leaves every request anonymous. Uncomment the block below to | ||
| # require a Google Workspace account — the provider, the `hd: illuin.tech` claim requirement and the |
| # credentials are environment-specific. Create them in the Google Cloud console (APIs & Services > | ||
| # Credentials > OAuth client ID > Web application) and register http://localhost:8080/auth/callback there. | ||
| # Startup fails fast if the credentials are missing. | ||
| #quarkus: |
Collaborator
There was a problem hiding this comment.
Such standard but commented-out options should be in the base application.yml (there are already a few examples)
application-dev.yaml.dist should be for samples especially relevant for local development
+ maybe we should consider using a profile for that given there is so much configuration with gotchas for the integration to work? need feedback on this @theo-malka
mohamedalibarkailluin
force-pushed
the
oidc-authentification
branch
from
October 26, 2026 08:31
b47c338 to
6c03ff4
Compare
Collaborator
|
superseded by #30 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.