SSO using OpenID Connect (#3899)

* Add SSO functionality using OpenID Connect

Co-authored-by: Pablo Ovelleiro Corral <mail@pablo.tools>
Co-authored-by: Stuart Heap <sheap13@gmail.com>
Co-authored-by: Alex Moore <skiepp@my-dockerfarm.cloud>
Co-authored-by: Brian Munro <brian.alexander.munro@gmail.com>
Co-authored-by: Jacques B. <timshel@github.com>

* Improvements and error handling

* Stop rolling device token

* Add playwright tests

* Activate PKCE by default

* Ensure result order when searching for sso_user

* add SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION

* Toggle SSO button in scss

* Base64 encode state before sending it to providers

* Prevent disabled User from SSO login

* Review fixes

* Remove unused UserOrganization.invited_by_email

* Split SsoUser::find_by_identifier_or_email

* api::Accounts::verify_password add the policy even if it's ignored

* Disable signups if SSO_ONLY is activated

* Add verifiedDate to organizations::get_org_domain_sso_details

* Review fixes

* Remove OrganizationId guard from get_master_password_policy

* Add wrapper type OIDCCode OIDCState OIDCIdentifier

* Membership::confirm_user_invitations fix and tests

* Allow set-password only if account is unitialized

* Review fixes

* Prevent accepting another user invitation

* Log password change event on SSO account creation

* Unify master password policy resolution

* Upgrade openidconnect to 4.0.0

* Revert "Remove unused UserOrganization.invited_by_email"

This reverts commit 548e19995e141314af98a10d170ea7371f02fab4.

* Process org enrollment in accounts::post_set_password

* Improve tests

* Pass the claim invited_by_email in case it was not in db

* Add Slack configuration hints

* Fix playwright tests

* Skip broken tests

* Add sso identifier in admin user panel

* Remove duplicate expiration check, add a log

* Augment mobile refresh_token validity

* Rauthy configuration hints

* Fix playwright tests

* Playwright upgrade and conf improvement

* Playwright tests improvements

* 2FA email and device creation change

* Fix and improve Playwright tests

* Minor improvements

* Fix enforceOnLogin org policies

* Run playwright sso tests against correct db

* PKCE should now work with Zitadel

* Playwright upgrade maildev to use MailBuffer.expect

* Upgrades playwright tests deps

* Check email_verified in id_token and user_info

* Add sso verified endpoint for v2025.6.0

* Fix playwright tests

* Create a separate sso_client

* Upgrade openidconnect to 4.0.1

* Server settings for login fields toggle

* Use only css for login fields

* Fix playwright test

* Review fix

* More review fix

* Perform same checks when setting kdf

---------

Co-authored-by: Felix Eckhofer <felix@eckhofer.com>
Co-authored-by: Pablo Ovelleiro Corral <mail@pablo.tools>
Co-authored-by: Stuart Heap <sheap13@gmail.com>
Co-authored-by: Alex Moore <skiepp@my-dockerfarm.cloud>
Co-authored-by: Brian Munro <brian.alexander.munro@gmail.com>
Co-authored-by: Jacques B. <timshel@github.com>
Co-authored-by: Timshel <timshel@480s>

src/static/scripts/admin.js

@@ -28,11 +28,11 @@ function msg(text, reload_page = true) {
     reload_page && reload();
 }
 
-function _post(url, successMsg, errMsg, body, reload_page = true) {
+function _fetch(method, url, successMsg, errMsg, body, reload_page = true) {
     let respStatus;
     let respStatusText;
     fetch(url, {
-        method: "POST",
+        method: method,
         body: body,
         mode: "same-origin",
         credentials: "same-origin",
@@ -65,6 +65,14 @@ function _post(url, successMsg, errMsg, body, reload_page = true) {
     });
 }
 
+function _post(url, successMsg, errMsg, body, reload_page = true) {
+    return _fetch("POST", url, successMsg, errMsg, body, reload_page);
+}
+
+function _delete(url, successMsg, errMsg, body, reload_page = true) {
+    return _fetch("DELETE", url, successMsg, errMsg, body, reload_page);
+}
+
 // Bootstrap Theme Selector
 const getStoredTheme = () => localStorage.getItem("theme");
 const setStoredTheme = theme => localStorage.setItem("theme", theme);
@@ -146,4 +154,4 @@ document.addEventListener("DOMContentLoaded", (/*event*/) => {
         navItem[0].className = navItem[0].className + " active";
         navItem[0].setAttribute("aria-current", "page");
     }
-});
+});

src/static/scripts/admin_users.js

@@ -24,6 +24,28 @@ function deleteUser(event) {
     }
 }
 
+function deleteSSOUser(event) {
+    event.preventDefault();
+    event.stopPropagation();
+    const id = event.target.parentNode.dataset.vwUserUuid;
+    const email = event.target.parentNode.dataset.vwUserEmail;
+    if (!id || !email) {
+        alert("Required parameters not found!");
+        return false;
+    }
+    const input_email = prompt(`To delete user "${email}", please type the email below`);
+    if (input_email != null) {
+        if (input_email == email) {
+            _delete(`${BASE_URL}/admin/users/${id}/sso`,
+                "User SSO Associtation deleted correctly",
+                "Error deleting user SSO association"
+            );
+        } else {
+            alert("Wrong email, please try again");
+        }
+    }
+}
+
 function remove2fa(event) {
     event.preventDefault();
     event.stopPropagation();
@@ -246,6 +268,9 @@ function initUserTable() {
     document.querySelectorAll("button[vw-delete-user]").forEach(btn => {
         btn.addEventListener("click", deleteUser);
     });
+    document.querySelectorAll("button[vw-delete-sso-user]").forEach(btn => {
+        btn.addEventListener("click", deleteSSOUser);
+    });
     document.querySelectorAll("button[vw-disable-user]").forEach(btn => {
         btn.addEventListener("click", disableUser);
     });
@@ -263,6 +288,8 @@ function initUserTable() {
 
 // onLoad events
 document.addEventListener("DOMContentLoaded", (/*event*/) => {
+    const size = jQuery("#users-table > thead th").length;
+    const ssoOffset = size-7;
     jQuery("#users-table").DataTable({
         "drawCallback": function() {
             initUserTable();
@@ -275,10 +302,10 @@ document.addEventListener("DOMContentLoaded", (/*event*/) => {
         ],
         "pageLength": -1, // Default show all
         "columnDefs": [{
-            "targets": [1, 2],
+            "targets": [1 + ssoOffset, 2 + ssoOffset],
             "type": "date-iso"
         }, {
-            "targets": 6,
+            "targets": size-1,
             "searchable": false,
             "orderable": false
         }]
@@ -303,4 +330,4 @@ document.addEventListener("DOMContentLoaded", (/*event*/) => {
     if (btnInviteUserForm) {
         btnInviteUserForm.addEventListener("submit", inviteUser);
     }
-});
+});