#830 auth: OIDC support for osctrl-api + React SPA Pull request opened by alvarofraguas Summary • Adds OIDC authentication to

osctrl-api

using the

pkg/auth/oidc

provider from #829 • New endpoints:

GET /api/v1/auth/methods

,

GET /auth/oidc/login

,

GET /auth/oidc/callback

,

POST /api/v1/logout

• JIT user provisioning on first OIDC login (creates user with

auth_source: oidc

) • SPA login page shows "Continue with SSO" button when OIDC is configured •

/api/v1/logout

clears the DB token and returns IdP end-session URL (

id_token_hint

for Okta,

client_id

for Keycloak) •

state

and

nonce

are independent values (OIDC defense-in-depth — state for CSRF, nonce for replay) • Unauthenticated

/logout

no longer leaks IdP tenant URL or client_id Depends on • #829 (pkg/auth shared package) Test plan • OIDC login against Keycloak — full flow including callback, JIT provisioning, session • OIDC login against Auth0 —

nickname

claim,

id_token_hint

logout • 11/11 OIDC pentest checks pass • Local credentials login still works when OIDC is configured •

go test ./...

passes • Frontend builds clean (

npm run typecheck && npm run build

) jmpsec/osctrl