[PR #2169] [MERGED] OpenID Connect SSO #5953

New Issue

OVERLORD · 2026-02-05T10:21:14+03:00

OVERLORD commented

2026-02-05 10:21:14 +03:00

📋 Pull Request Information

Original PR: https://github.com/BookStackApp/BookStack/pull/2169
Author: @jasperweyne
Created: 7/2/2020
Status: ✅ Merged
Merged: 10/16/2021
Merged by: @ssddanbrown

Base: master ← Head: openid

📝 Commits (10+)

07a6d76 First basic OpenID Connect implementation
25144a1 Deduplicated getOrRegisterUser method
10c8909 Token expiration and refreshing using the refresh_token flow
5df7db5 Ignore ID token expiry if unavailable
97cde9c Generalize refresh failure handling
13d0260 Configurable OpenID Connect services
75b4a05 Add OpenIdService to OpenIdSessionGuard constructor call
46388a5 AccessToken empty array parameter on null
6feaf25 Increase robustness of the refresh method
23402ae Initial unit tests for OpenID

📊 Changes

24 files changed (+888 additions, -40 deletions)

View changed files

📝 .env.example.complete (+8 -0)
📝 app/Auth/Access/ExternalAuthService.php (+37 -0)
➕ app/Auth/Access/Guards/OpenIdSessionGuard.php (+79 -0)
➕ app/Auth/Access/OpenIdService.php (+301 -0)
📝 app/Auth/Access/Saml2Service.php (+2 -30)
📝 app/Config/auth.php (+4 -0)
➕ app/Config/openid.php (+46 -0)
➕ app/Exceptions/OpenIdException.php (+6 -0)
📝 app/Http/Controllers/Auth/LoginController.php (+1 -2)
➕ app/Http/Controllers/Auth/OpenIdController.php (+70 -0)
📝 app/Http/Controllers/UserController.php (+2 -2)
📝 app/Http/Middleware/VerifyCsrfToken.php (+2 -1)
📝 app/Providers/AuthServiceProvider.php (+13 -0)
📝 composer.json (+2 -1)
📝 composer.lock (+176 -1)
📝 resources/lang/en/errors.php (+4 -0)
➕ resources/views/auth/forms/login/openid.blade.php (+11 -0)
📝 resources/views/common/header.blade.php (+2 -0)
📝 resources/views/settings/index.blade.php (+1 -1)
📝 resources/views/settings/roles/form.blade.php (+1 -1)

...and 4 more files

📄 Description

Current Status
A basic Authorization Code flow functions. Tokens are stored in the session and are refreshed upon expiration. Basic tests are implemented. Request for feedback on the CodeClimate issues.

Description
Currently, Bookstack support both LDAP and SAML 2.0 for SSO. This pull request intends to extend support to OpenID Connect providers as well. It's built on top of steverhoades' OpenID Connect provider. This pull request intends to supports only Authorization Code flow and the Refresh Token flow from OAuth2, given the nature of Bookstack. The additional code mimics the structure of the existing SAML implementation, to heighten code maintainability.

Benefits
Given that some systems solely support OpenID Connect, this would extend the support SSO solutions. Although this number is quite small at this point in time, the number is non-zero. Moreover, the reduced complexity compared to SAML suggests a possible shift in the future.

Risks
Although all extra code adds some technical debt by nature, the code is based on the already existing SAML integration. Therefore, the additional technical debt should be fairly limited. Moreover, additional dependencies are created. Currently, the code is built on top of steverhoades/oauth2-openid-connect-client. This seemed to be the most efficient approach. Alternatively, the code could potentially be migrated to be built on top of the jumbojett/OpenID-Connect-PHP library.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/BookStackApp/BookStack/pull/2169 **Author:** [@jasperweyne](https://github.com/jasperweyne) **Created:** 7/2/2020 **Status:** ✅ Merged **Merged:** 10/16/2021 **Merged by:** [@ssddanbrown](https://github.com/ssddanbrown) **Base:** `master` ← **Head:** `openid` --- ### 📝 Commits (10+) - [`07a6d76`](https://github.com/BookStackApp/BookStack/commit/07a6d7655fd77b9c33360b855a0c08d922b2f3ed) First basic OpenID Connect implementation - [`25144a1`](https://github.com/BookStackApp/BookStack/commit/25144a13c7150c75a023cb039972a3f784bee8cf) Deduplicated getOrRegisterUser method - [`10c8909`](https://github.com/BookStackApp/BookStack/commit/10c890947f9ea5661729f88e9e85464522498dd7) Token expiration and refreshing using the refresh_token flow - [`5df7db5`](https://github.com/BookStackApp/BookStack/commit/5df7db510524a156a0a1f0d659a06a02dd5d3644) Ignore ID token expiry if unavailable - [`97cde9c`](https://github.com/BookStackApp/BookStack/commit/97cde9c56a3268da179c2701d209a9a1224bac85) Generalize refresh failure handling - [`13d0260`](https://github.com/BookStackApp/BookStack/commit/13d0260cc97c5cce9399f44afa65b70857499da6) Configurable OpenID Connect services - [`75b4a05`](https://github.com/BookStackApp/BookStack/commit/75b4a05200ebf6b107b4448915f811f247bcba69) Add OpenIdService to OpenIdSessionGuard constructor call - [`46388a5`](https://github.com/BookStackApp/BookStack/commit/46388a591b7cff9364dff2502419ffdafab0137c) AccessToken empty array parameter on null - [`6feaf25`](https://github.com/BookStackApp/BookStack/commit/6feaf25c902d8cf1315ca0612e3f54387dbb55f4) Increase robustness of the refresh method - [`23402ae`](https://github.com/BookStackApp/BookStack/commit/23402ae81287bdfd0539d20a3a81c38d9efce1e5) Initial unit tests for OpenID ### 📊 Changes **24 files changed** (+888 additions, -40 deletions) <details> <summary>View changed files</summary> 📝 `.env.example.complete` (+8 -0) 📝 `app/Auth/Access/ExternalAuthService.php` (+37 -0) ➕ `app/Auth/Access/Guards/OpenIdSessionGuard.php` (+79 -0) ➕ `app/Auth/Access/OpenIdService.php` (+301 -0) 📝 `app/Auth/Access/Saml2Service.php` (+2 -30) 📝 `app/Config/auth.php` (+4 -0) ➕ `app/Config/openid.php` (+46 -0) ➕ `app/Exceptions/OpenIdException.php` (+6 -0) 📝 `app/Http/Controllers/Auth/LoginController.php` (+1 -2) ➕ `app/Http/Controllers/Auth/OpenIdController.php` (+70 -0) 📝 `app/Http/Controllers/UserController.php` (+2 -2) 📝 `app/Http/Middleware/VerifyCsrfToken.php` (+2 -1) 📝 `app/Providers/AuthServiceProvider.php` (+13 -0) 📝 `composer.json` (+2 -1) 📝 `composer.lock` (+176 -1) 📝 `resources/lang/en/errors.php` (+4 -0) ➕ `resources/views/auth/forms/login/openid.blade.php` (+11 -0) 📝 `resources/views/common/header.blade.php` (+2 -0) 📝 `resources/views/settings/index.blade.php` (+1 -1) 📝 `resources/views/settings/roles/form.blade.php` (+1 -1) _...and 4 more files_ </details> ### 📄 Description **Current Status** A basic Authorization Code flow functions. Tokens are stored in the session and are refreshed upon expiration. Basic tests are implemented. Request for feedback on the CodeClimate issues. **Description** Currently, Bookstack support both LDAP and SAML 2.0 for SSO. This pull request intends to extend support to OpenID Connect providers as well. It's built on top of steverhoades' OpenID Connect provider. This pull request intends to supports only Authorization Code flow and the Refresh Token flow from OAuth2, given the nature of Bookstack. The additional code mimics the structure of the existing SAML implementation, to heighten code maintainability. **Benefits** Given that some systems solely support OpenID Connect, this would extend the support SSO solutions. Although this number is quite small at this point in time, the number is non-zero. Moreover, the reduced complexity compared to SAML suggests a possible shift in the future. **Risks** Although all extra code adds some technical debt by nature, the code is based on the already existing SAML integration. Therefore, the additional technical debt should be fairly limited. Moreover, additional dependencies are created. Currently, the code is built on top of steverhoades/oauth2-openid-connect-client. This seemed to be the most efficient approach. Alternatively, the code could potentially be migrated to be built on top of the jumbojett/OpenID-Connect-PHP library. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

OVERLORD added the pull-request label 2026-02-05 10:21:14 +03:00

OVERLORD closed this issue

2026-02-05 10:21:18 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#5953