You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@devlake.apache.org by "MauricioApu (via GitHub)" <gi...@apache.org> on 2026/07/09 19:14:23 UTC
[PR] feat(auth): add OIDC allowlist restrictions [devlake]
MauricioApu opened a new pull request, #8984:
URL: https://github.com/apache/devlake/pull/8984
### ⚠️ Pre Checklist
- [x] I have read through the [Contributing Documentation](https://devlake.apache.org/community/).
- [x] I have added relevant tests.
- [x] I have added relevant documentation.
- [x] I will add labels to the PR, such as `pr-type/bug-fix`, `pr-type/feature-development`, etc.
### Summary
This PR introduces optional authorization filters to restrict OIDC logins by specific email addresses (`OIDC_ALLOW_EMAILS`) or domain suffixes (`OIDC_ALLOW_DOMAINS`).
* **Default Unrestricted Behavior:** If both configuration variables are empty or omitted, login access remains entirely unrestricted.
* **Case-Insensitive & Formatted Matching:** Email strings are properly trimmed of whitespace and converted to lower case to prevent user input discrepancies from blocking authentication.
* **Granular Control:** Administrators can now restrict access to specific developers or entire organizational domains seamlessly.
### Does this close any open issues?
None. This is a straightforward enhancement implemented directly to address an internal deployment requirement.
### Screenshots
<img width="979" height="95" alt="Screenshot 2026-07-09 at 4 06 51 PM" src="https://github.com/user-attachments/assets/fd17812d-014a-421c-8d0b-9bf6facd2200" />
### Other Information
* Tests were added under `backend/helpers/oidchelper/authorization_test.go` confirming case-insensitivity, malformed string protection, domain parsing, and default pass-through state behaviors.
* Updated `.env.example` to document the new optional configuration keys.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(auth): add OIDC allowlist restrictions [devlake]
Posted by "klesh (via GitHub)" <gi...@apache.org>.
klesh merged PR #8984:
URL: https://github.com/apache/devlake/pull/8984
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org