Replace OpenID 2.0 with OAuth 2.0/OIDC login - #3
Closed
mraible wants to merge 3 commits into
Closed
Conversation
mraible
force-pushed
the
feature/oidc-login
branch
5 times, most recently
from
August 12, 2026 15:48
fe9347d to
da4c868
Compare
Replace the obsolete OpenID 2.0 authentication (removed in Spring Security 6) with modern OAuth 2.0/OIDC login using spring-security-oauth2-client. OIDC providers are configured via roller-custom.properties with issuer discovery. The existing openIdUrl column is reused to store OIDC subjects (formatted as issuer#sub), avoiding schema changes. New OIDC users are redirected to registration with claims pre-populated; returning users go straight to the menu. AuthMethod enum values updated from OPENID/DB_OPENID to OIDC/DB_OIDC.
…est users The Dockerfile previously cloned the roller-6.1.0 tag from GitHub, so local changes never made it into the image; it now builds from the checkout. The Keycloak realm import gains an administrator (admin/admin) and a regular user (user/user) so both roles can be tried right after docker compose up, and the compose file accepts AUTHENTICATION_METHOD=db-oidc to offer form login next to the provider buttons.
…form registration Roller looks users up by principal name throughout the rendering layer and servlet filters, but an OidcUser's default name is the sub claim, an opaque provider ID that matches no Roller account; every rendered weblog page then failed with a Velocity NullPointerException for a signed-in OIDC user. The principal returned by RollerOidcUserService is now named after the resolved Roller account. Provisioning moves into the user service so the principal carries Roller roles from the first request, gets its own users.oidc.autoProvision.enabled toggle (default true, mirroring users.ldap.autoProvision.enabled) instead of piggybacking on the runtime form-registration setting that is off by default and blocked every provider user after the first, and requires a verified matching email before linking an existing account. Discovery needs jackson-databind on the classpath, and the login page lists providers from the resolved client registrations so it never advertises one whose discovery failed.
mraible
force-pushed
the
feature/oidc-login
branch
from
August 12, 2026 19:37
da4c868 to
acdf650
Compare
Owner
Author
|
Moved to apache#155 now that the whole stack lives in the main repository. Review and discussion continue there. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on apache#154 (1/3 in the stack); after that merges, this retargets to apache/roller:master. Replaces the obsolete OpenID 2.0 authentication (removed in Spring Security 6) with OAuth 2.0/OIDC login using
spring-security-oauth2-client. Phase 3 of the Jakarta EE 10 migration (ROL-2183).Removed / changed behavior — read before merging:
openidanddb-openidvalues ofauthentication.methodno longer exist; configs using them must move tooidcordb-oidc. OpenID 2.0 relay support does not survive in any form (the protocol is dead and Spring Security dropped it upstream).users.oidc.autoProvision.enableddefaults to true: anyone the identity provider authenticates gets a Roller account on first login. Set it to false to require pre-created accounts. Linking to an existing account additionally requires the provider to assert a verified email matching that account.AUTHENTICATION_METHODtooidc, so the demo signs in through the bundled Keycloak by default; setdbfor the old form-login demo ordb-oidcfor both side by side.How it works:
RollerClientRegistrationRepositoryreads provider config (client-id, client-secret, issuer-uri) from Roller properties, with OIDC discovery at startupRollerOidcUserServiceresolves the Roller account behind an authenticated OIDC user via the existingopenIdUrlcolumn (storesissuer#sub) and provisions accounts just in time, so the principal carries Roller roles from the first requestsubclaim, which made every rendered weblog page fail with a Velocity error for signed-in OIDC usersAuthMethodgainsOIDC/DB_OIDC, and Login.jsp shows provider buttons built from the resolved registrations, so it never advertises a provider whose discovery failedTo try it: add
127.0.0.1 keycloakto /etc/hosts, thendocker compose up -dand log in at http://localhost:8080/ as admin/admin or user/user.