[MacNite]

Summary

Adds "Sign in with authentik" to the built-in dashboard (/dashboard). Any standards-compliant OpenID Connect provider works the same way.

• Backend flow: HiveHub is a confidential client running the Authorization Code flow with PKCE (server/oidc.py). It discovers the provider's endpoints and checks the ID token's signature against the provider's JWKS (RS/ES/PS, or HS with the client secret). It also checks issuer, audience, nonce and expiry, and refuses alg=none. It then issues the existing HttpOnly session cookie, so no provider token reaches the browser. There are no new dependencies (stdlib HTTP plus python-jose).
• User mapping by e-mail: the provider's address is matched case-insensitively to an existing dashboard_users.email. Unknown or ambiguous addresses are refused, and accounts are never auto-created. The role always comes from the local account.
• email_verified: required by default; OIDC_REQUIRE_EMAIL_VERIFIED=false relaxes it. If the ID token has no e-mail, the userinfo endpoint is used instead, and its sub must match the ID token's.
• Logout: signing out of an SSO session continues to the provider's end_session_endpoint (RP-initiated logout).
• Password login toggle: OIDC_DISABLE_PASSWORD_LOGIN=true makes the dashboard SSO-only. The password form and "Change password" are hidden, password logins are refused, and existing password sessions stop working. On a fresh install, the setup wizard creates a password-less admin and sends the browser through SSO. The setting only takes effect while SSO is fully configured, so it cannot lock everybody out.
• SSO-only accounts: while SSO is enabled, admins can create accounts with an empty password; these need an e-mail.
• Unique e-mails: a case-insensitive unique index on dashboard_users.email is created in init_db and by migration 032. If duplicates already exist, the migration aborts with the list of addresses. init_db instead logs them and skips the index, so measurement ingestion keeps running, and SSO refuses those addresses until they are fixed.
• UI: the login page shows the authentik button, SSO error messages via ?sso_error=, the SSO-only setup wizard, "SSO only" tags in the users list, and an account card that is aware of SSO.
• Config and docs: OIDC_* env vars in config.py, .env.example and docker-compose.yml. The new docs/sso-authentik.md covers authentik setup, the email_verified mapping and troubleshooting.

Tests

• New test-data/test_oidc_sso.py (23 tests, added to CI). It uses a fake provider and an RSA key generated during the test, and covers the happy path, PKCE/state/nonce, bad tokens (audience, issuer, expiry, signature, alg=none, HS256), email_verified and its override, the userinfo fallback, unknown and ambiguous users, the password toggle, logout redirect, and SSO-only accounts.
• The existing server test suite passes.
• Login, SSO-only and setup screens were checked in headless Chromium against a stubbed status endpoint.
• Not tested against a live authentik instance or PostgreSQL.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BBzs29kfDyFwPxXT6WfTJH

---

Generated by Claude Code