Support toml config and config social auth by hmpf · Pull Request #3889 · Uninett/nav

hmpf · 2026-03-20T07:21:39Z

Scope and purpose

Depends on #3924

Setting up social providers (like saml, oidc, github, google, facebook..) with NAV-config isn't supported very well with today's nav config infrastructure, so here's an attempt at using toml instead.

The new TOMLConfigParser-class does not support everything the old class does. It does not support writing out toml-files, because we'd need an additional library for that if we don't want to roll our own.

It does not support multiple files per config section, as I couldn't find that this feature was used anywhere in the existing code.

It does support predefining a default-config section, and we need that for any None-value since toml does not support None as a value on principle. We can have 'em in default config anyway.

This pull request

adds/changes/removes a dependency
tomli, so that tests pass on Python < 3.11

How to test

This involves a new config file, "/etc/nav/webfront/authentication.toml". Make sure a copy is in the right location when testing. If using "docker compose" it might be easiest to copy the new file manually to the correct location, the container "config" should always be up and running.

It is necessary to have a client id and secret from "some" provider for a full manual test.

Contributor Checklist

Every pull request should have this checklist filled out, no matter how small it is.
More information about contributing to NAV can be found in the
Hacker's guide to NAV.

github-actions · 2026-03-20T07:23:35Z

Test results

7 files 7 suites 13m 28s ⏱️
2 980 tests 2 980 ✅ 0 💤 0 ❌
8 757 runs 8 757 ✅ 0 💤 0 ❌

Results for commit 240a4c2.

♻️ This comment has been updated with latest results.

codecov · 2026-03-20T07:24:05Z

Codecov Report

❌ Patch coverage is 87.35632% with 22 lines in your changes missing coverage. Please review.
✅ Project coverage is 64.13%. Comparing base (234c86d) to head (3f86990).
⚠️ Report is 109 commits behind head on master.

Files with missing lines	Patch %	Lines
python/nav/web/auth/allauth/__init__.py	80.85%	18 Missing ⚠️
python/nav/config/toml.py	93.93%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3889      +/-   ##
==========================================
+ Coverage   63.83%   64.13%   +0.29%     
==========================================
  Files         624      625       +1     
  Lines       46174    46530     +356     
  Branches       43       43              
==========================================
+ Hits        29476    29840     +364     
+ Misses      16688    16680       -8     
  Partials       10       10

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

lunkwill42 · 2026-03-23T09:16:02Z

The new TOMLConfigParser-class does not support everything the old class does. It does not support writing out toml-files, because we'd need an additional library for that if we don't want to roll our own.

That may be built-in to Python's ConfigParser (which NAV's is based on), but I don't think we use it to write config files anywhere in the codebase - we only care about reading.

lunkwill42 · 2026-03-23T09:16:58Z

The new TOMLConfigParser-class does not support everything the old class does. It does not support writing out toml-files, because we'd need an additional library for that if we don't want to roll our own.

That may be built-in to Python's ConfigParser (which NAV's is based on), but I don't think we use it to write config files anywhere in the codebase - we only care about reading.

If we, at some point, want to migrate existing config files from .ini to .toml, however, we may need write functionality.

hmpf · 2026-03-23T11:26:49Z

If we, at some point, want to migrate existing config files from .ini to .toml, however, we may need write functionality.

Sounds like a future problem.

There is one feature missing: SAML-support (out of scope, will take some effort), and there should probably be docs.

hmpf · 2026-03-23T11:36:15Z

The provider "openid" need extra models (tables!) That seems to be the only one among the ones bundled with allauth.

lunkwill42

I find this PR a bit hard to follow at first - I wanted to play around with it, but we should probably get my questions out of the way first :)

python/nav/config/toml.py

python/nav/config/utils.py

python/nav/config/toml.py

hmpf · 2026-03-24T08:08:39Z

I'm thinking self.data is a good candidate for frozendict when Python 3.15 is out.

python/nav/django/settings.py

python/nav/etc/webfront/authentication.toml

python/nav/config/toml.py

github-actions · 2026-03-26T10:53:56Z

Warning

5 of 12 new test names are missing convention keywords (given/when/then/it_should)

File	Test name
`tests/unittests/config_toml_test.py`	`test_merge_with_default_returns_the_combined_output`
`tests/unittests/config_toml_test.py`	`test_if_section_is_set_and_no_default_config_get_item_fetches_from_inputted_subdict`
`tests/unittests/config_toml_test.py`	`test_if_section_is_set_and_no_input_get_item_fetches_from_default_subdict`
`tests/unittests/config_toml_test.py`	`test_golden_path`
`tests/unittests/config_toml_test.py`	`test_deeper_recursion`

Why am I seeing this?

Test names should follow a loose given/when/then pattern with keywords like given, when, then, or it_should. This is a suggestion, not a blocker. The check runs on new test methods added in this PR.

Examples:

test_when_no_incidents_then_returns_empty_list
test_it_should_create_incident_with_set_description
test_given_expired_token_when_refreshing_then_raises_error

doc/reference/social-account.rst

python/nav/config/toml.py

python/nav/web/auth/allauth/__init__.py

python/nav/etc/webfront/authentication.toml

python/nav/web/auth/allauth/__init__.py

lunkwill42

The functionality works for me now; I am able to configure both MFA and OIDC for Feide quite easily.

However, I found the tests are broken. In fact, all the test files in the tests/unittests/web/auth/ (including the pre-existing ones) are named incorrectly, so they are not collected by a full test run, only if run explicitly as arguments to pytest.

Test files should end in _test.py, not _tests.py (or they should start with test_).

lunkwill42 · 2026-03-27T09:29:54Z

Added #3944 to fix the pre-existing test files

lunkwill42 · 2026-03-27T09:46:30Z

Pushed fixups for the incorrectly named test file, and also for fixing the failing tests in it.

lunkwill42 · 2026-03-27T10:01:08Z

Since @hmpf is busy with other things, I've fixed all my issues and nitpicks and pushed fixups myself.

Use the `test_when_<condition>_then_<subject>_should_<assertion>` pattern to match the project's test naming standard.

The passkey/webauthn feature doesn't work end-to-end yet: `MFAConfigParser.get_MFA_SUPPORTED_TYPES_setting()` appends `"passkeys"` to the list, but allauth expects `"webauthn"`, and the webauthn URLs, views, and templates are never activated. Remove user-facing references to avoid confusion. The config parser plumbing can stay for future use.

sonarqubecloud · 2026-03-27T10:20:49Z

Quality Gate passed

Issues
0 New issues
3 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

hmpf marked this pull request as draft March 20, 2026 08:19

hmpf self-assigned this Mar 20, 2026

hmpf added allauth NAV settings Needs/changes INI-style setting in settings-file in /etc labels Mar 20, 2026

hmpf force-pushed the support-toml-config branch 5 times, most recently from 873f30b to a45eb50 Compare March 20, 2026 13:33

lunkwill42 requested changes Mar 23, 2026

View reviewed changes

hmpf marked this pull request as ready for review March 24, 2026 11:10

hmpf requested review from a team and lunkwill42 March 24, 2026 12:20

hmpf commented Mar 26, 2026

View reviewed changes

python/nav/django/settings.py Show resolved Hide resolved

python/nav/etc/webfront/authentication.toml Outdated Show resolved Hide resolved

python/nav/config/toml.py Show resolved Hide resolved

hmpf commented Mar 26, 2026

View reviewed changes

doc/reference/social-account.rst Show resolved Hide resolved

hmpf force-pushed the support-toml-config branch from e599b23 to bb30661 Compare March 26, 2026 12:03

lunkwill42 requested changes Mar 26, 2026

View reviewed changes

python/nav/config/toml.py Outdated Show resolved Hide resolved

lunkwill42 requested changes Mar 26, 2026

View reviewed changes

python/nav/web/auth/allauth/__init__.py Outdated Show resolved Hide resolved

python/nav/etc/webfront/authentication.toml Outdated Show resolved Hide resolved

lunkwill42 requested changes Mar 26, 2026

View reviewed changes

python/nav/web/auth/allauth/__init__.py Outdated Show resolved Hide resolved

hmpf force-pushed the support-toml-config branch from eb11aac to a1c2901 Compare March 26, 2026 19:56

hmpf requested a review from lunkwill42 March 26, 2026 19:56

lunkwill42 requested changes Mar 27, 2026

View reviewed changes

lunkwill42 approved these changes Mar 27, 2026

View reviewed changes

hmpf and others added 6 commits March 27, 2026 11:19

Support config as toml files, with example

1b4dfa5

Add NAV config for social auth

e6b2d0b

Add changelog fragment

4a86f21

Add docs for social account config

e4d00fc

Adopt test naming convention in allauth tests

cd38fc7

Use the `test_when_<condition>_then_<subject>_should_<assertion>` pattern to match the project's test naming standard.

lunkwill42 force-pushed the support-toml-config branch from ee43df4 to 3f86990 Compare March 27, 2026 10:19

lunkwill42 merged commit d00f150 into master Mar 27, 2026
14 of 15 checks passed

lunkwill42 deleted the support-toml-config branch March 27, 2026 10:20

Conversation

hmpf commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Scope and purpose

This pull request

How to test

Contributor Checklist

Uh oh!

github-actions bot commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test results

Uh oh!

codecov bot commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

lunkwill42 commented Mar 23, 2026

Uh oh!

lunkwill42 commented Mar 23, 2026

Uh oh!

hmpf commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hmpf commented Mar 23, 2026

Uh oh!

lunkwill42 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hmpf commented Mar 24, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lunkwill42 left a comment

Choose a reason for hiding this comment

Uh oh!

lunkwill42 commented Mar 27, 2026

Uh oh!

lunkwill42 commented Mar 27, 2026

Uh oh!

lunkwill42 commented Mar 27, 2026

Uh oh!

Uh oh!

sonarqubecloud bot commented Mar 27, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hmpf commented Mar 20, 2026 •

edited

Loading

github-actions bot commented Mar 20, 2026 •

edited

Loading

codecov bot commented Mar 20, 2026 •

edited

Loading

hmpf commented Mar 23, 2026 •

edited

Loading

github-actions bot commented Mar 26, 2026 •

edited

Loading