Add OpenID Connect by aaronschif · Pull Request #5351 · FreshRSS/FreshRSS

aaronschif · 2023-04-28T02:02:57Z

Hello, word of warning, this is maybe the first PHP I have written, so I hope that I haven't done anything too crazy.

I realize that env vars are not so common a configuration practice in PHP land, but it did seem a logical way of handling things in this case since all the config is actually in apache. I will add docs and more testing to make sure that this doesn't break anything. Tested with keycloak.

Changes proposed in this pull request:

Fix install issue that stopped auth-type from being set.
Add oidc support.

Todo

Tests
Docs

How to test the feature manually:

Pull request checklist:

clear commit messages
code manually tested
unit tests written (optional if too hard)
documentation updated

Additional information can be found in the documentation.

aaronschif · 2023-04-29T01:40:47Z

Closes #3001

docs/en/admins/16_Oidc.md

Docker/FreshRSS.Apache.conf

Docker/Dockerfile

Alkarex · 2023-05-03T13:58:44Z

There were some changes in install.php from another PR, which I have merged. Please test

Alkarex · 2023-05-10T21:53:02Z

Still not in Alpine 3.18 unfortunately #5383

Alkarex · 2023-05-10T21:56:19Z

Please check my changes https://github.com/FreshRSS/FreshRSS/pull/5351/files/1bdc2c168f587a453306b0b90cbc226512f94ee0..14dee94df255e3a64cceaf904b80ea5c89a9d74f

Alkarex · 2023-05-10T22:17:10Z

What is the plan during the installation process? Is the expectation that the admin picks "HTTP Auth"?

app/layout/aside_configure.phtml

Docker/FreshRSS.Apache.conf

Alkarex · 2023-06-09T07:01:20Z

All good @aaronschif ?

Only enable the Apache auth_openidc module when actually used Fix FreshRSS#5460 Follow-up of FreshRSS#5351

Alkarex · 2023-06-13T14:21:40Z

Regression: #5460
Work-around: #5463

Only enable the Apache auth_openidc module when actually used Fix #5460 Follow-up of #5351

Alkarex · 2023-06-19T07:06:18Z

#5481

* Add OIDC * Update documentation. * Update apache conf adding IfModule * Use IfDefine for OIDC in apache conf * Fix non-oidc support * Fix typing * Use IfDefine to enable OIDC * Add OIDC support to all dockerfiles * Re add apache Require option * Fixes and documentation * A few more fixes * A bit more doc * Change type of environment variable * Update readme * Correct apache config for OIDC support. * Fix README formatting * Update oidc control path * Fix oidc endpoint being cached * A bit more review * Simplify ExpiresActive * Add session refresh and improve caching * Allow more different setups * A bit more documentation * A bit more readme --------- Co-authored-by: Aaron Schif <aschif@netdevgroup.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> Co-authored-by: maTh <math-home@web.de>

Only enable the Apache auth_openidc module when actually used Fix FreshRSS#5460 Follow-up of FreshRSS#5351

Hani-K · 2023-09-17T15:44:01Z

OpenID doesn't seem to work with Docker.
I spent a day and a half trying to get it working with Authentik. All environment variables are properly set, using a docker container that's pulling the Debian version of FreshRSS. The default values of OIDC_REMOTE_USER_CLAIM and OIDC_SCOPES variables were already accepted by Authentik, yet I tried different combinations and values with no luck.

The problem: I couldn't find anyway to login using OpenID from FreshRSS login panel. The default username and password text-boxes only accept locally created users from the DB. Usually in apps that support OIDC, once enabling the feature, a link is shown in the login panel to "Login with OpenID". There was nothing of that sort in FreshRSS frontend.

I didn't test with manually running an apache instance, but I ended up switching to Miniflux with the same Authentik provider setup that was intended for FreshRSS (Using the same environment variable values) and it worked flawlessly. I'll keep using Miniflux for now, just thought you might wanna know, since I haven't seen anyone testing it.

Good luck.

Frenzie · 2023-09-17T15:57:43Z

Also see #5523 and #5646

Alkarex · 2023-09-17T16:13:27Z

@Hani-K Did you use the freshrss/freshrss:edge image?

Hani-K · 2023-09-18T09:24:54Z

@Alkarex I did try with the edge branch and it didn't work for me at all, I ran into a series of problems.

After setting all environment variables as in the documentation, I keep getting the following error:

./Docker/entrypoint.sh: 15: [: Illegal number: 172.16.0.1/12 192.168.0.1/16
Enabling module auth_openidc.
OIDC_ENABLED): -c: line 2: unexpected EOF while looking for matching )' ./Docker/entrypoint.sh: 15: [: Illegal number: 172.16.0.1/12 192.168.0.1/16 OIDC_ENABLED): -c: line 2: unexpected EOF while looking for matching )'
./Docker/entrypoint.sh: 15: [: Illegal number: 172.16.0.1/12 192.168.0.1/16
OIDC_ENABLED): -c: line 2: unexpected EOF while looking for matching )' ./Docker/entrypoint.sh: 15: [: Illegal number: 172.16.0.1/12 192.168.0.1/16 OIDC_ENABLED): -c: line 2: unexpected EOF while looking for matching )'
./Docker/entrypoint.sh: 15: [: Illegal number: 172.16.0.1/12 192.168.0.1/16
OIDC_ENABLED): -c: line 2: unexpected EOF while looking for matching )' ./Docker/entrypoint.sh: 15: [: Illegal number: 172.16.0.1/12 192.168.0.1/16 OIDC_ENABLED): -c: line 2: unexpected EOF while looking for matching )'
./Docker/entrypoint.sh: 15: [: Illegal number: 172.16.0.1/12 192.168.0.1/16
OIDC_ENABLED): -c: line 2: unexpected EOF while looking for matching `)'

After a few seconds, the container loses network connection and keeps runing without an IP.
I tried changing the TRUSTED_PROXY variable value to include the whole RFC1918 Private Address Space, which includes everything I have in my network, but the same error persists.

I found this #5611, and I realized the issue must be triggered by using portainer, so I created the container manually. The log was still showing that the issue wasn't completely solved:

./Docker/entrypoint.sh: 15: [: Illegal number: 172.16.0.1/12 192.168.0.1/16

But at least the container stays connected to the network.

Then I hit another error: Authentik wasn't accepting the callback/redirect link:

Redirect URI Error
The request fails due to a missing, invalid, or mismatching redirection URI (redirect_uri).

I was using https://<mydomain.tld>/i/oidc/
which didn't work (same implementation worked with Miniflux using their callback/redirect link).
I also tried locally by using local IP addresses instead of domains, and I end up with the same error.

I tried re-running the whole thing with NginX conf to see if it was setup to only run that way. I started getting header request errors, which I did pass using Nginx.

I did look into @Frenzie's suggestion:

Also see #5523 and #5646

But that didn't seem to be the issue.

At this point, I started looking for alternatives.

P.S. In FreshRSS OIDC documentation, there is no mention of using the edge branch to get the feature, which I realized after a good while of testing. Maybe it should be mentioned there since the default installation is "latest".

Alkarex · 2023-10-04T16:06:48Z

Additional discussion and troubleshooting: #5684

Alkarex · 2023-10-25T14:01:21Z

./Docker/entrypoint.sh: 15: [: Illegal number: 172.16.0.1/12 192.168.0.1/16

Fixed in #5733

* delete theme BlueLagoon * delete theme Screwdriver * phpstan level 7 for feedController.php (#5373) * phpstan level 7 for feedController.php * phpstan level 7 for feedController.php * phpstan level 7 for feedController.php * phpstan level 7 for feedController.php * A few fixes --------- Co-authored-by: Luc <sanchezluc+freshrss@gmail.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * phpstan level 7 for updateController.php (#5376) * phpstan level 7 for updateController.php * phpstan level 7 for updateController.php * Minor array syntax --------- Co-authored-by: Luc <sanchezluc+freshrss@gmail.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * docs: language table added (#5375) * docs: language table added * Update 05_Configuration.md * Update 05_Configuration.md * french docs * Unicode quote and a few fixes (Same search&replace aslo applied to a few other files) --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Share in anonymous mode (#5261) #fix #5248 Co-authored-by: maTh <math-home@web.de> * Minor development config fixes (#5379) * Add compatibility with MacOS for `paste` command * Addition to .editorconfig * Fix markAsReadUponGone (#5382) Fix regression from #5315 which indroduced a bug for cached feeds. We now update the `lastSeen` property of entries to account for the fact that they are unchanged but still existing. * phpstan level 7 for indexController.php (#5384) Co-authored-by: Luc <sanchezluc+freshrss@gmail.com> * Improved: "Mark an article as read…" text area. Added a link to the documentation (#5349) * i18n * Update sub.php * Update app/i18n/fr/sub.php Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * fix target="_blank" --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Update Docker image Alpine 3.18 (#5383) https://alpinelinux.org/posts/Alpine-3.18.0-released.html Minor updates with Apache 2.4.57 and PHP 8.1.19 * Docs: delete 04_Changing_source_code.md (#5391) * delete 04_Changing_source_code.md * make pot --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Typed view model classes (#5380) * Typed view model classes * Add ability to provide a typed view model class to a controller * Use `::class` instead of string for referring to classes * Examplified with `stats` and `javascript` controllers / views (more to do) * Also useful for extensions (my usecase today), which did not have the ability to define own view model attributes before. * Typo * A few additional PHPStan rules (#5388) A subset of https://github.com/phpstan/phpstan-strict-rules * Improved: Install process: give more infos (#5350) * comments added for each step * infos about FreshRSS added in first step * Remove reference to Kriss and Leed from install page I do not find that informative, and quite confusing. Moved to readme instead. --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * PHPMailer 6.8.0 (#5389) * PHPMailer 6.8.0 https://github.com/PHPMailer/PHPMailer/releases/tag/v6.8.0 https://github.com/PHPMailer/PHPMailer/releases * Exclude unused DSNConfigurator * fix: docs: array syntax (#5392) * Link configuration to proper parameter (#5394) Before, the system configuration was linked to the user parameter while the user configuration was linked to the system parameter. This was an issue when trying to retrieve some kind of configuration value in an extension. Now, the configurations are properly linked to their parameters. * PHPStan Level 7 for Share userController logs_pagination (#5393) * fix: "for" attribute in config display (#5398) * move darkMode_auto from body to html root (#5397) * CSS: refactor of a.btn (#5401) * Fix logs pagination (#5403) * Fix logs pagination Regression from #5269 * Add better default * PHPStan Level 7 for Minz_Request, FreshRSS_Feed, Minz_Error (#5400) * PHPStan Level 7 for Minz_Request * PHPStan Level 7 for FreshRSS_Feed * PHPStan Level 7 for Minz_Error * Fix again updateLastSeenUnchanged (#5404) * Fix again updateLastSeenUnchanged #5382 was not good enough to fix markAsReadUponGone and introduced a regression in `entry.lastSeen`. New approach. Follow-up of #5315 * Minor change of mind * Fix handling of lastSeen entry.lastSeen was not always correctly initialised, and sometimes overriden * Remove debug line Forgotten from #5404 * Avoid falsy guid (#5412) Whitespace strings, empty strings, 0 are all problematic when working with GUIDs. so avoid them. * PHPStan Level 7 complete (#5406) * PHPStan Level 7 complete * Start PHPStan Level 8 * Forgot exclude .phtml * Fix favicon fetching while using proxies (#5421) * Fix favicon fetching while using proxies This ensures that if curl_options are defined in config.php, those settings are respected while fetching favicons. Fixes #4951 * Change options priority * Credits keep alphabticorder --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Fixed: i18n extensions: 'en' as fallback (#5426) * Update Translate.php * Small improvements --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Improve Dev Container (#5423) * Improve Dev Container PHPStan was failing in Dev Container * Update Docker to Alpine Linux 3.18 * New DATA_PATH environment variable * README * Update of Spanish translation (#5408) * Update admin.php Update Spanish * Update conf.php Spanish update * Fix --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Linkding share now passes title #5432 (#5433) * phpstan-8 typehinting (#5429) Co-authored-by: Luc <sanchezluc+freshrss@gmail.com> * Forgotten debug line #5404 * phpstan-9 for Share.php (#5431) * phpstan 9 for Search.php phpstan 9 for Share.php * phpstan-9 for Search.php * Better consistency for search results --------- Co-authored-by: Luc <sanchezluc+freshrss@gmail.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Pull request of spanish translation (#5436) * Update sub.php Update spanish translation * Update conf.php Update Spanish translation * Update gen.php Update spanish translation * Update index.php Update spanish translation * Update admin.php update spanish translation * Fix ignore --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * improved background colors (#5437) * phpstan-8 for category class (#5434) * phpstan-8 for category class * Another approach to nullable #5434 (comment) --------- Co-authored-by: Luc <sanchezluc+freshrss@gmail.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Docker example of PostgreSQL tuning (#5446) Provide example of how to easily tune selected PostgreSQL settings https://wiki.postgresql.org/wiki/Tuning_Your_PostgreSQL_Server * Update SECURITY.md (#5448) Link to GitHub security advisory process + PGP key * fix: new article banner in Ansum/mapco theme (#5453) * fix * rtl * Update dark theme css to lower brightness to all icons (#5439) * Update dark.css to lower brightness to all icons * Update dark.rtl.css to lower brightness to all icons * re-add p.help .icon * re-add p.help .icon * Remove core extensions Google Groups and Tumblr (#5457) * Remove core extensions Google Groups and Tumblr * Google Groups seems to have remove support for RSS/ATOM #2838 (see e.g. https://www.theregister.com/2021/08/16/google_groups_rss/ ) * Tumblr seems to have fixed their RSS/ATOM post-GDPR #1924 So for both of thems, the extensions have become irrelevant. * Cleaning * Clarify that maximum number to keep is per feed (#5458) * Clarify that maximum number to keep is per feed Signed-off-by: Christian König <ckoenig@posteo.de> * Append //DIRTY Signed-off-by: Christian König <ckoenig@posteo.de> * make fix-all * Revert wrong whitespace * Amend Credits.md Signed-off-by: Christian König <ckoenig@posteo.de> --------- Signed-off-by: Christian König <ckoenig@posteo.de> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Add OpenID Connect (#5351) * Add OIDC * Update documentation. * Update apache conf adding IfModule * Use IfDefine for OIDC in apache conf * Fix non-oidc support * Fix typing * Use IfDefine to enable OIDC * Add OIDC support to all dockerfiles * Re add apache Require option * Fixes and documentation * A few more fixes * A bit more doc * Change type of environment variable * Update readme * Correct apache config for OIDC support. * Fix README formatting * Update oidc control path * Fix oidc endpoint being cached * A bit more review * Simplify ExpiresActive * Add session refresh and improve caching * Allow more different setups * A bit more documentation * A bit more readme --------- Co-authored-by: Aaron Schif <aschif@netdevgroup.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> Co-authored-by: maTh <math-home@web.de> * Fix OpenID Connect crash on ARM (#5463) Only enable the Apache auth_openidc module when actually used Fix #5460 Follow-up of #5351 * Readme minor typo * Fix: conf.php (German i18n) (#5468) * Improved: update page (#5420) * prependTitle() * do not need the "damn" in the alert * update page layout improved * release channel * i18n labels * add log messages while updating * Delete updatee.php * Update updateController.php * Update updateController.php * Update updateController.php * Update updateController.php * add getCurrentGitBranch() * Update updateController.php * state2 buttons * i18n * loading * Update feedback.php * Update feedback.php * Update feedback.php * Update extra.js * Apply suggestions from code review Co-authored-by: Luc SANCHEZ <4697568+ColonelMoutarde@users.noreply.github.com> * Update updateController.php * Update terminology * update button is now armed --------- Co-authored-by: Luc SANCHEZ <4697568+ColonelMoutarde@users.noreply.github.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Allow deep link to extension configuration (#5449) * Allow deep link to extension configuration Full screen * Support slider * Add aside_configure Fix #5449 (comment) * category title improved * Feed title: better HTML structure + have a correct semantic <a> * feed title: CSS * feed title special cases * improved feed mouseover titles * cog icon half transparent. Shining while hovering * i18n labels * improve hover of more menu * Update gen.php * fix * i18n: fr --------- Signed-off-by: Christian König <ckoenig@posteo.de> Co-authored-by: Luc SANCHEZ <4697568+ColonelMoutarde@users.noreply.github.com> Co-authored-by: Luc <sanchezluc+freshrss@gmail.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> Co-authored-by: Alexis Degrugillier <aledeg@users.noreply.github.com> Co-authored-by: vrachnis <vrachnis@users.noreply.github.com> Co-authored-by: LleanaRuv <133794633+LleanaRuv@users.noreply.github.com> Co-authored-by: acbgbca <60839662+acbgbca@users.noreply.github.com> Co-authored-by: Alwaysin <adrien@demma.fr> Co-authored-by: yubiuser <ckoenig@posteo.de> Co-authored-by: Aaron Schif <aaronschif@gmail.com> Co-authored-by: Aaron Schif <aschif@netdevgroup.com> Co-authored-by: math-gh <>

Alkarex · 2025-04-01T23:40:04Z

#7489

Alkarex · 2025-09-29T08:01:11Z

Help welcome:

Rewrite OpenID Connect using native PHP instead of mod_auth_openidc #8031

Add OIDC

a245f03

Update documentation.

4217d8c

math-GH reviewed Apr 29, 2023

View reviewed changes

docs/en/admins/16_Oidc.md Outdated Show resolved Hide resolved

Alkarex added the Security 🛡️ label Apr 29, 2023

Alkarex reviewed Apr 29, 2023

View reviewed changes

Docker/FreshRSS.Apache.conf Outdated Show resolved Hide resolved

Alkarex reviewed Apr 29, 2023

View reviewed changes

Docker/Dockerfile Outdated Show resolved Hide resolved

Aaron Schif and others added 2 commits May 2, 2023 20:18

Update apache conf adding IfModule

dabc801

Merge branch 'edge' into oidc

772e08b

Aaron Schif and others added 7 commits May 3, 2023 20:21

Use IfDefine for OIDC in apache conf

67729e7

Merge branch 'edge' into oidc

4e09b24

Fix non-oidc support

39050c4

Fix typing

da562be

Use IfDefine to enable OIDC

ed07118

Add OIDC support to all dockerfiles

dc25527

Re add apache Require option

1bdc2c1

aaronschif marked this pull request as ready for review May 5, 2023 23:47

Alkarex mentioned this pull request May 10, 2023

LDAP/Active Directory #1053

Open

Merge branch 'edge' into oidc

7926d4b

Alkarex added 2 commits May 10, 2023 23:55

Fixes and documentation

5dedc04

Merge branch 'edge' into oidc

838b43a

Alkarex changed the title ~~Draft: Add OIDC~~ Add OpenID Connect May 10, 2023

Alkarex added this to the 1.22.0 milestone May 10, 2023

Alkarex added 2 commits May 11, 2023 00:05

A few more fixes

b8458e5

A bit more doc

2de2b07

Change type of environment variable

14dee94

Add session refresh and improve caching

641caa1

Alkarex reviewed Jun 8, 2023

View reviewed changes

app/layout/aside_configure.phtml Outdated Show resolved Hide resolved

Alkarex reviewed Jun 8, 2023

View reviewed changes

Docker/FreshRSS.Apache.conf Show resolved Hide resolved

Alkarex added 4 commits June 8, 2023 22:24

Allow more different setups

ad5736a

A bit more documentation

1aa889d

Merge branch 'edge' into pr/aaronschif/5351

9e6c6ab

A bit more readme

1a75d03

Alkarex approved these changes Jun 9, 2023

View reviewed changes

Alkarex merged commit 58b254f into FreshRSS:edge Jun 12, 2023

Alkarex mentioned this pull request Jun 13, 2023

[BUG] docker status Restarting (135) #5460

Closed

Alkarex added a commit to Alkarex/FreshRSS that referenced this pull request Jun 13, 2023

Fix OpenID Connect crash on ARM

460a171

Only enable the Apache auth_openidc module when actually used Fix FreshRSS#5460 Follow-up of FreshRSS#5351

Alkarex mentioned this pull request Jun 13, 2023

Fix OpenID Connect crash on ARM #5463

Merged

Alkarex added a commit that referenced this pull request Jun 13, 2023

Fix OpenID Connect crash on ARM (#5463)

ae8dfc1

Only enable the Apache auth_openidc module when actually used Fix #5460 Follow-up of #5351

This was referenced Jun 16, 2023

OpenID Connect AuthN #3001

Closed

Allow choosing the OIDC remote user claim and scopes to request from the identity provider #5481

Merged

math-GH pushed a commit to math-GH/FreshRSS that referenced this pull request Jul 4, 2023

Fix OpenID Connect crash on ARM (FreshRSS#5463)

be17171

Only enable the Apache auth_openidc module when actually used Fix FreshRSS#5460 Follow-up of FreshRSS#5351

Alkarex mentioned this pull request Apr 1, 2025

Use HTTP POST for logout #7489

Merged

Uh oh!

Conversation

aaronschif commented Apr 28, 2023

Uh oh!

aaronschif commented Apr 29, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Alkarex commented May 3, 2023

Uh oh!

Alkarex commented May 10, 2023

Uh oh!

Alkarex commented May 10, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Alkarex commented May 10, 2023

Uh oh!

Uh oh!

Uh oh!

Alkarex commented Jun 9, 2023

Uh oh!

Alkarex commented Jun 13, 2023

Uh oh!

Alkarex commented Jun 19, 2023

Uh oh!

Hani-K commented Sep 17, 2023

Uh oh!

Frenzie commented Sep 17, 2023

Uh oh!

Alkarex commented Sep 17, 2023

Uh oh!

Hani-K commented Sep 18, 2023

Uh oh!

Alkarex commented Oct 4, 2023

Uh oh!

Alkarex commented Oct 25, 2023

Uh oh!

Alkarex commented Apr 1, 2025

Uh oh!

Alkarex commented Sep 29, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Alkarex commented May 10, 2023 •

edited

Loading