oidc: add AuthorizationEndpoint config override for non-compliant providers

Some OIDC providers (e.g. GitHub Actions at token.actions.githubusercontent.com)
do not include authorization_endpoint in their /.well-known/openid-configuration
discovery document. This causes oidcProvider.Endpoint().AuthURL to be empty,
which makes oauth2.Config.AuthCodeURL() produce an empty redirect URL.

Add an optional oidc.authorization_endpoint config field that lets users
explicitly specify the authorization endpoint URL when the discovery
document is missing it.

Fixes #2168.

Signed-off-by: maxpetrusenkoagent <max.petrusenko.agent@gmail.com>

hscontrol/oidc.go

@@ -98,6 +98,12 @@ func NewAuthProviderOIDC(
 		Scopes:       cfg.Scope,
 	}
 
+	// Some OIDC providers (e.g. GitHub Actions) omit authorization_endpoint
+	// from their discovery document. Allow users to override it explicitly.
+	if cfg.AuthorizationEndpoint != "" {
+		oauth2Config.Endpoint.AuthURL = cfg.AuthorizationEndpoint
+	}
+
 	authCache := expirable.NewLRU[string, AuthInfo](
 		authCacheMaxEntries,
 		nil,

hscontrol/types/config.go

@@ -229,6 +229,11 @@ type OIDCConfig struct {
 	EmailVerifiedRequired      bool
 	UseExpiryFromToken         bool
 	PKCE                       PKCEConfig
+	// AuthorizationEndpoint allows overriding the authorization endpoint
+	// returned by the OIDC provider discovery document. This is required
+	// for providers (such as GitHub Actions OIDC) that do not include
+	// authorization_endpoint in their discovery metadata.
+	AuthorizationEndpoint string
 }
 
 type DERPConfig struct {
@@ -1266,7 +1271,8 @@ func LoadServerConfig() (*Config, error) {
 			AllowedUsers:          viper.GetStringSlice("oidc.allowed_users"),
 			AllowedGroups:         viper.GetStringSlice("oidc.allowed_groups"),
 			EmailVerifiedRequired: viper.GetBool("oidc.email_verified_required"),
-			UseExpiryFromToken:    viper.GetBool("oidc.use_expiry_from_token"),
+			UseExpiryFromToken:   viper.GetBool("oidc.use_expiry_from_token"),
+			AuthorizationEndpoint: viper.GetString("oidc.authorization_endpoint"),
 			PKCE: PKCEConfig{
 				Enabled: viper.GetBool("oidc.pkce.enabled"),
 				Method:  viper.GetString("oidc.pkce.method"),