feat: auto-redirect to OIDC IdP on logout (#991)

Add GOTIFY_OIDC_AUTO_REDIRECT to skip the login page and redirect
straight to the configured OIDC provider. Only takes effect when
local auth is disabled, since local login would otherwise be
unreachable.

Add GOTIFY_OIDC_AUTO_REDIRECT_REQUIRE_REAUTH (default false) to send
prompt=login on that redirect, so logging out of Gotify doesn't
silently log the user back in via an existing IdP session. Does not
end that IdP session, so other apps using it are unaffected.

Wire both flags through gotifyinfo/injected UI config and the WebUI
login page, which now redirects instead of showing the OIDC button
when enabled.

Author: DerDummePunkt

api/oidc.go

@@ -66,6 +66,7 @@ func NewOIDC(conf *config.Configuration, db *database.GormDatabase, userChangeNo
 		SecureCookie:       conf.Server.SecureCookie,
 		AutoRegister:       conf.OIDC.AutoRegister,
 		LinkByUsername:     conf.OIDC.LinkByUsername,
+		PromptLogin:        conf.OIDC.RequireReauth,
 		pendingSessions:    decaymap.NewDecayMap[string, *pendingOIDCSession](time.Now(), pendingSessionMaxAge),
 	}
 }
@@ -94,6 +95,7 @@ type OIDCAPI struct {
 	SecureCookie       bool
 	AutoRegister       bool
 	LinkByUsername     bool
+	PromptLogin        bool
 	pendingSessions    *decaymap.DecayMap[string, *pendingOIDCSession]
 }
 
@@ -131,7 +133,11 @@ func (a *OIDCAPI) LoginHandler() gin.HandlerFunc {
 			return
 		}
 		a.pendingSessions.Set(time.Now(), state, &pendingOIDCSession{ClientName: clientName, CreatedAt: time.Now()})
-		rp.AuthURLHandler(func() string { return state }, a.Provider)(w, r)
+		var urlParams []rp.URLParamOpt
+		if a.PromptLogin {
+			urlParams = append(urlParams, rp.WithPromptURLParam("login"))
+		}
+		rp.AuthURLHandler(func() string { return state }, a.Provider, urlParams...)(w, r)
 	})
 }
 

api/oidc_test.go

@@ -1,7 +1,11 @@
 package api
 
 import (
+	"context"
+	"encoding/json"
+	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"strings"
 	"testing"
 	"time"
@@ -14,6 +18,7 @@ import (
 	"github.com/gotify/server/v2/test/testdb"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/suite"
+	"github.com/zitadel/oidc/v3/pkg/client/rp"
 	"github.com/zitadel/oidc/v3/pkg/oidc"
 )
 
@@ -62,6 +67,60 @@ func (s *OIDCSuite) Test_GenerateState_Unique() {
 	assert.NotEqual(s.T(), s1, s2)
 }
 
+// --- LoginHandler ---
+
+func newDiscoveryServer(t *testing.T) *httptest.Server {
+	t.Helper()
+	mux := http.NewServeMux()
+	server := httptest.NewServer(mux)
+	t.Cleanup(server.Close)
+	mux.HandleFunc("/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"issuer":                 server.URL,
+			"authorization_endpoint": server.URL + "/authorize",
+			"token_endpoint":         server.URL + "/token",
+			"userinfo_endpoint":      server.URL + "/userinfo",
+			"jwks_uri":               server.URL + "/keys",
+		})
+	})
+	return server
+}
+
+func (s *OIDCSuite) Test_LoginHandler_PromptLogin() {
+	issuer := newDiscoveryServer(s.T())
+
+	provider, err := rp.NewRelyingPartyOIDC(
+		context.Background(), issuer.URL, "client", "secret", "https://gotify.example/callback", []string{"openid"},
+	)
+	assert.NoError(s.T(), err)
+	s.a.Provider = provider
+
+	tests := []struct {
+		name        string
+		promptLogin bool
+		wantPrompt  string
+	}{
+		{name: "auto redirect enabled", promptLogin: true, wantPrompt: "login"},
+		{name: "auto redirect disabled", promptLogin: false, wantPrompt: ""},
+	}
+
+	for _, tc := range tests {
+		s.Run(tc.name, func() {
+			s.a.PromptLogin = tc.promptLogin
+			recorder := httptest.NewRecorder()
+			ctx, _ := gin.CreateTestContext(recorder)
+			ctx.Request = httptest.NewRequest("GET", "/auth/oidc/login?name=testclient", nil)
+
+			s.a.LoginHandler()(ctx)
+
+			location, err := url.Parse(recorder.Header().Get("Location"))
+			assert.NoError(s.T(), err)
+			assert.Equal(s.T(), tc.wantPrompt, location.Query().Get("prompt"))
+		})
+	}
+}
+
 func (s *OIDCSuite) Test_ResolveUser_ReturningUser_MatchedByOIDCID() {
 	oidcID := testIssuer + "#sub-1"
 	s.db.CreateUser(&model.User{ID: 1, Name: "alice", OIDCID: &oidcID})

config/config.go

@@ -69,6 +69,8 @@ type OIDC struct {
 	LinkByUsername bool
 	Scopes         []string
 	IDPName        string
+	AutoRedirect   bool
+	RequireReauth  bool
 }
 
 type Configuration struct {
@@ -183,6 +185,8 @@ func Get() (*Configuration, []FutureLog) {
 	add(parseBool(&c.OIDC.LinkByUsername, EnvOIDCLinkByUsername))
 	add(parseList(&c.OIDC.Scopes, EnvOIDCScopes))
 	add(parseString(&c.OIDC.IDPName, EnvOIDCIDPName))
+	add(parseBool(&c.OIDC.AutoRedirect, EnvOIDCAutoRedirect))
+	add(parseBool(&c.OIDC.RequireReauth, EnvOIDCAutoRedirectRequireReauth))
 
 	add(parseString(&c.NoColor, EnvNoColor))
 
@@ -194,6 +198,20 @@ func Get() (*Configuration, []FutureLog) {
 	if c.Registration && !c.LocalAuthEnabled {
 		logs = append(logs, futureFatal("registration requires local authentication to be enabled"))
 	}
+	if c.OIDC.AutoRedirect && c.LocalAuthEnabled {
+		logs = append(logs, futureWarn(
+			"GOTIFY_OIDC_AUTO_REDIRECT has no effect while local authentication is enabled",
+		))
+	}
+	c.OIDC.AutoRedirect = c.OIDC.AutoRedirect && !c.LocalAuthEnabled
+
+	if c.OIDC.RequireReauth && !c.OIDC.AutoRedirect {
+		logs = append(logs, futureWarn(
+			"GOTIFY_OIDC_AUTO_REDIRECT_REQUIRE_REAUTH has no effect unless GOTIFY_OIDC_AUTO_REDIRECT is also in effect",
+		))
+	}
+	c.OIDC.RequireReauth = c.OIDC.RequireReauth && c.OIDC.AutoRedirect
+
 	return c, logs
 }
 

config/config_test.go

@@ -84,6 +84,117 @@ func TestLocalAuthDisabled(t *testing.T) {
 	}
 }
 
+func TestOIDCAutoRedirect(t *testing.T) {
+	tests := []struct {
+		name             string
+		localAuthEnabled string
+		want             bool
+		warns            []FutureLog
+	}{
+		{
+			name:             "local auth disabled",
+			localAuthEnabled: "false",
+			want:             true,
+		},
+		{
+			name:             "local auth enabled",
+			localAuthEnabled: "true",
+			want:             false,
+			warns: []FutureLog{futureWarn(
+				"GOTIFY_OIDC_AUTO_REDIRECT has no effect while local authentication is enabled",
+			)},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			mode.Set(mode.TestDev)
+			t.Setenv(EnvOIDCAutoRedirect, "true")
+			t.Setenv(EnvLocalAuthEnabled, tc.localAuthEnabled)
+			t.Setenv(EnvOIDCEnabled, "true")
+
+			conf, logs := Get()
+			assert.Equal(t, tc.want, conf.OIDC.AutoRedirect)
+
+			var warns []FutureLog
+			for _, entry := range logs {
+				if entry.Level == zerolog.WarnLevel {
+					warns = append(warns, entry)
+				}
+			}
+			assert.Equal(t, tc.warns, warns)
+		})
+	}
+}
+
+func TestOIDCPromptLogin(t *testing.T) {
+	tests := []struct {
+		name             string
+		autoRedirect     string
+		localAuthEnabled string
+		requireReauth    string
+		want             bool
+		warns            []FutureLog
+	}{
+		{
+			name:             "auto redirect and require reauth enabled",
+			autoRedirect:     "true",
+			localAuthEnabled: "false",
+			requireReauth:    "true",
+			want:             true,
+		},
+		{
+			name:             "auto redirect enabled, require reauth left at default",
+			autoRedirect:     "true",
+			localAuthEnabled: "false",
+			requireReauth:    "false",
+			want:             false,
+		},
+		{
+			name:             "require reauth enabled but auto redirect disabled",
+			autoRedirect:     "false",
+			localAuthEnabled: "false",
+			requireReauth:    "true",
+			want:             false,
+			warns: []FutureLog{futureWarn(
+				"GOTIFY_OIDC_AUTO_REDIRECT_REQUIRE_REAUTH has no effect unless GOTIFY_OIDC_AUTO_REDIRECT is also in effect",
+			)},
+		},
+		{
+			name:             "require reauth enabled but local auth enabled",
+			autoRedirect:     "true",
+			localAuthEnabled: "true",
+			requireReauth:    "true",
+			want:             false,
+			warns: []FutureLog{
+				futureWarn("GOTIFY_OIDC_AUTO_REDIRECT has no effect while local authentication is enabled"),
+				futureWarn("GOTIFY_OIDC_AUTO_REDIRECT_REQUIRE_REAUTH has no effect unless GOTIFY_OIDC_AUTO_REDIRECT is also in effect"),
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			mode.Set(mode.TestDev)
+			t.Setenv(EnvOIDCEnabled, "true")
+			t.Setenv(EnvOIDCAutoRedirect, tc.autoRedirect)
+			t.Setenv(EnvLocalAuthEnabled, tc.localAuthEnabled)
+			t.Setenv(EnvOIDCAutoRedirectRequireReauth, tc.requireReauth)
+
+			conf, logs := Get()
+			assert.Equal(t, tc.want, conf.OIDC.RequireReauth)
+
+			var warns []FutureLog
+			for _, entry := range logs {
+				if entry.Level == zerolog.WarnLevel {
+					warns = append(warns, entry)
+				}
+			}
+			assert.Equal(t, tc.warns, warns)
+		})
+	}
+}
+
 func TestFile(t *testing.T) {
 	mode.Set(mode.TestDev)
 	dir := t.TempDir()

config/error.go

@@ -15,3 +15,10 @@ func futureFatal(msg string) FutureLog {
 		Msg:   msg,
 	}
 }
+
+func futureWarn(msg string) FutureLog {
+	return FutureLog{
+		Level: zerolog.WarnLevel,
+		Msg:   msg,
+	}
+}

config/keys.go

@@ -43,5 +43,7 @@ const (
 	EnvLocalAuthEnabled                 = "GOTIFY_LOCALAUTH_ENABLED"
 	EnvOIDCScopes                       = "GOTIFY_OIDC_SCOPES"
 	EnvOIDCIDPName                      = "GOTIFY_OIDC_IDP_NAME"
+	EnvOIDCAutoRedirect                 = "GOTIFY_OIDC_AUTO_REDIRECT"
+	EnvOIDCAutoRedirectRequireReauth    = "GOTIFY_OIDC_AUTO_REDIRECT_REQUIRE_REAUTH"
 	EnvNoColor                          = "NOCOLOR"
 )

docs/spec.json

@@ -2948,7 +2948,8 @@
         "register",
         "localAuth",
         "oidc",
-        "oidcIdpName"
+        "oidcIdpName",
+        "oidcAutoRedirect"
       ],
       "properties": {
         "localAuth": {
@@ -2963,6 +2964,12 @@
           "x-go-name": "Oidc",
           "example": true
         },
+        "oidcAutoRedirect": {
+          "description": "If the WebUI should automatically redirect to the OIDC identity\nprovider instead of showing the login page. Always false while local\nauthentication is enabled.",
+          "type": "boolean",
+          "x-go-name": "OIDCAutoRedirect",
+          "example": false
+        },
         "oidcIdpName": {
           "description": "Name of the OIDC identity provider.",
           "type": "string",

gotify-server.env.example

@@ -224,6 +224,23 @@
 # Type: text-list
 # GOTIFY_OIDC_SCOPES=openid,profile,email
 
+# Automatically redirect to the OIDC identity provider instead of showing the
+# login page. Only takes effect if GOTIFY_OIDC_ENABLED is true and
+# GOTIFY_LOCALAUTH_ENABLED is false, since local login would otherwise be
+# unreachable.
+#
+# Type: boolean
+# GOTIFY_OIDC_AUTO_REDIRECT=false
+
+# Send prompt=login to the OIDC provider on auto-redirect, so that logging
+# out of Gotify does not silently and invisibly log the user back in via an
+# existing IdP session. This does not end that IdP session, so other
+# applications using it are unaffected. Only takes effect if
+# GOTIFY_OIDC_AUTO_REDIRECT is also in effect.
+#
+# Type: boolean
+# GOTIFY_OIDC_AUTO_REDIRECT_REQUIRE_REAUTH=false
+
 # Enable authentication via username and password.
 # Type: boolean
 # GOTIFY_LOCALAUTH_ENABLED=true

model/gotifyinfo.go

@@ -29,4 +29,11 @@ type GotifyInfo struct {
 	// required: true
 	// example: OIDC
 	OIDCIDPName string `json:"oidcIdpName"`
+	// If the WebUI should automatically redirect to the OIDC identity
+	// provider instead of showing the login page. Always false while local
+	// authentication is enabled.
+	//
+	// required: true
+	// example: false
+	OIDCAutoRedirect bool `json:"oidcAutoRedirect"`
 }

router/router.go

@@ -120,7 +120,7 @@ func Create(db *database.GormDatabase, vInfo *model.VersionInfo, conf *config.Co
 	userChangeNotifier.OnUserDeleted(pluginManager.RemoveUser)
 	userChangeNotifier.OnUserAdded(pluginManager.InitializeForUserID)
 
-	ui.Register(g, *vInfo, conf.Registration, conf.LocalAuthEnabled, conf.OIDC.Enabled, conf.OIDC.IDPName)
+	ui.Register(g, *vInfo, conf.Registration, conf.LocalAuthEnabled, conf.OIDC.Enabled, conf.OIDC.IDPName, conf.OIDC.AutoRedirect)
 
 	if conf.OIDC.Enabled {
 		oidcHandler := api.NewOIDC(conf, db, userChangeNotifier)
@@ -192,11 +192,12 @@ func Create(db *database.GormDatabase, vInfo *model.VersionInfo, conf *config.Co
 	//         $ref: "#/definitions/GotifyInfo"
 	g.GET("gotifyinfo", func(ctx *gin.Context) {
 		ctx.JSON(200, &model.GotifyInfo{
-			Version:     vInfo.Version,
-			Oidc:        conf.OIDC.Enabled,
-			Register:    conf.Registration,
-			LocalAuth:   conf.LocalAuthEnabled,
-			OIDCIDPName: conf.OIDC.IDPName,
+			Version:          vInfo.Version,
+			Oidc:             conf.OIDC.Enabled,
+			Register:         conf.Registration,
+			LocalAuth:        conf.LocalAuthEnabled,
+			OIDCIDPName:      conf.OIDC.IDPName,
+			OIDCAutoRedirect: conf.OIDC.AutoRedirect,
 		})
 	})