Mirrors/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-07-22 07:29:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 16

Merge 8c5b637278 into 048308511c

Browse source
This commit is contained in:
maxpetrusenkoagent 2026-07-03 08:00:41 -04:00 • committed by GitHub
commit 5636689e5f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 13 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
hscontrol/oidc.go
View file

@ -100,6 +100,12 @@ func NewAuthProviderOIDC(
Scopes: cfg.Scope,
}
// Some OIDC providers (e.g. GitHub Actions) omit authorization_endpoint
// from their discovery document. Allow users to override it explicitly.
if cfg.AuthorizationEndpoint != "" {
oauth2Config.Endpoint.AuthURL = cfg.AuthorizationEndpoint
}
authCache := expirable.NewLRU[string, AuthInfo](
authCacheMaxEntries,
nil,

8
hscontrol/types/config.go
View file

@ -239,6 +239,11 @@ type OIDCConfig struct {
EmailVerifiedRequired bool
UseExpiryFromToken bool
PKCE PKCEConfig
// AuthorizationEndpoint allows overriding the authorization endpoint
// returned by the OIDC provider discovery document. This is required
// for providers (such as GitHub Actions OIDC) that do not include
// authorization_endpoint in their discovery metadata.
AuthorizationEndpoint string
}
type DERPConfig struct {
@ -1275,7 +1280,8 @@ func LoadServerConfig() (*Config, error) {
AllowedUsers: viper.GetStringSlice("oidc.allowed_users"),
AllowedGroups: viper.GetStringSlice("oidc.allowed_groups"),
EmailVerifiedRequired: viper.GetBool("oidc.email_verified_required"),
UseExpiryFromToken: viper.GetBool("oidc.use_expiry_from_token"),
UseExpiryFromToken: viper.GetBool("oidc.use_expiry_from_token"),
AuthorizationEndpoint: viper.GetString("oidc.authorization_endpoint"),
PKCE: PKCEConfig{
Enabled: viper.GetBool("oidc.pkce.enabled"),
Method: viper.GetString("oidc.pkce.method"),