From 8c5b6372789388faf0bbbb28b0ae5b2a5d42fb0e Mon Sep 17 00:00:00 2001 From: maxpetrusenkoagent Date: Mon, 22 Jun 2026 09:56:47 -0400 Subject: [PATCH] oidc: add AuthorizationEndpoint config override for non-compliant providers Some OIDC providers (e.g. GitHub Actions at token.actions.githubusercontent.com) do not include authorization_endpoint in their /.well-known/openid-configuration discovery document. This causes oidcProvider.Endpoint().AuthURL to be empty, which makes oauth2.Config.AuthCodeURL() produce an empty redirect URL. Add an optional oidc.authorization_endpoint config field that lets users explicitly specify the authorization endpoint URL when the discovery document is missing it. Fixes #2168. Signed-off-by: maxpetrusenkoagent --- hscontrol/oidc.go | 6 ++++++ hscontrol/types/config.go | 8 +++++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/hscontrol/oidc.go b/hscontrol/oidc.go index 7f1e3fae5..b80683407 100644 --- a/hscontrol/oidc.go +++ b/hscontrol/oidc.go @@ -98,6 +98,12 @@ func NewAuthProviderOIDC( Scopes: cfg.Scope, } + // Some OIDC providers (e.g. GitHub Actions) omit authorization_endpoint + // from their discovery document. Allow users to override it explicitly. + if cfg.AuthorizationEndpoint != "" { + oauth2Config.Endpoint.AuthURL = cfg.AuthorizationEndpoint + } + authCache := expirable.NewLRU[string, AuthInfo]( authCacheMaxEntries, nil, diff --git a/hscontrol/types/config.go b/hscontrol/types/config.go index 6a6d59dcb..9887974da 100644 --- a/hscontrol/types/config.go +++ b/hscontrol/types/config.go @@ -229,6 +229,11 @@ type OIDCConfig struct { EmailVerifiedRequired bool UseExpiryFromToken bool PKCE PKCEConfig + // AuthorizationEndpoint allows overriding the authorization endpoint + // returned by the OIDC provider discovery document. This is required + // for providers (such as GitHub Actions OIDC) that do not include + // authorization_endpoint in their discovery metadata. + AuthorizationEndpoint string } type DERPConfig struct { @@ -1266,7 +1271,8 @@ func LoadServerConfig() (*Config, error) { AllowedUsers: viper.GetStringSlice("oidc.allowed_users"), AllowedGroups: viper.GetStringSlice("oidc.allowed_groups"), EmailVerifiedRequired: viper.GetBool("oidc.email_verified_required"), - UseExpiryFromToken: viper.GetBool("oidc.use_expiry_from_token"), + UseExpiryFromToken: viper.GetBool("oidc.use_expiry_from_token"), + AuthorizationEndpoint: viper.GetString("oidc.authorization_endpoint"), PKCE: PKCEConfig{ Enabled: viper.GetBool("oidc.pkce.enabled"), Method: viper.GetString("oidc.pkce.method"),