#932 Fix for authentication config in `osctrl-api` Pull request opened by javuto Fix for authentication config in osctrl-api Problem When

osctrl-api

was launched with

--config

(the path used by the provisioned systemd unit and containers), the SAML and OIDC sections of the YAML file were silently dropped.

loadedYAMLToServiceParams

never copied

cfg.SAML

or

cfg.OIDC

into the

ServiceParameters

struct, so federated login stayed off no matter what the operator configured — with no error logged anywhere. The SPA kept advertising password-only auth via

/api/v1/auth/methods

. A second, related bug:

saml.forceAuthn

defaulted to

false

on the YAML path, while the

--saml-force-authn

flag defaults to

true

. Operators read the resulting behavior as "logout didn't work" — the IdP silently re-authenticated from its own SSO cookie. Changes • `cmd/api/utils.go`: carry

SAML

and

OIDC

from the parsed YAML into

ServiceParameters

so the providers actually initialize. • `cmd/api/main.go`: set

viper.SetDefault("saml.forceAuthn", true)

so the YAML path matches the flag default when the key is omitted. • `pkg/config/types.go`: add the

SAML

and

OIDC

fields to

APIConfiguration

so the sections round-trip through

config-generate

. • `pkg/config/utils.go`: emit

SAML

,

OIDC

, and the previously-missing

Carver

block when generating an API config file. • `deploy/config/api.yml`: ship annotated

saml:

and

oidc:

sections as a ready-to-edit reference. • `docs/auth-providers.md`: document the two configuration modes (flags/env vs YAML) and how they map to the systemd deployment. • `cmd/api/config_test.go`: pin the wiring — YAML →

ServiceParams

must preserve both SSO sections,

Enabled

flags, key fields (EntityID, ACSURL, IssuerURL, ClientID, PKCE, scopes, required groups), and the

forceAuthn

default-true-when-omitted behavior. • `.gitignore`: ignore

.claude

and

.codex

agent metadata directories. Validation •

go test ./cmd/api ./pkg/config

— new config tests pass. • Manual:

osctrl-api config-generate

now emits

saml:

and

oidc:

blocks; starting the service with a YAML containing

oidc.enabled: true

registers the OIDC routes and

/auth/methods

advertises OIDC. Risk Notes This is an auth-wiring change. The fix is additive for the YAML path only — flag/env invocation is unchanged. Operators who were relying on the bug (YAML SSO silently disabled) will see SSO come online on next restart, which is the intended behavior but worth flagging in release notes. jmpsec/osctrl