[IanHollow]

Description

Allow administrators to set OIDC_TOKEN_ENDPOINT_AUTH_METHOD when an identity provider requires client_secret_basic or client_secret_post. Without this setting, the existing provider discovery behavior remains. An unsupported value fails when the authentication configuration loads.

The new setting is documented and passed to the frontend by both Compose variants and the Kubernetes manifest. Development Compose also passes its existing OIDC issuer and client settings to the frontend.

Related issue

No linked issue.

Type of change

• Bug fix
• Documentation update

Checklist

• I have read the CONTRIBUTING guide
• My code follows the project's coding style
• I have added tests that prove the fix works
• New and existing tests pass locally in full (seven focused tests and TypeScript passed locally; fork CI passed the full suites)
• I have updated documentation as needed
• My changes don't introduce new warnings or errors in the checks listed below

Testing

Test environment

• Local development
• Fork CI

Tests performed

• Seven focused OIDC tests and TypeScript passed locally. Tests cover the default, both explicit methods, invalid values, and the resulting token requests.
• The fork CI run for the updated head passed backend and frontend tests and lint, Docker builds, and Actionlint.

Screenshots

None. This changes authentication configuration.

Additional notes

A live identity provider login was unavailable for an end-to-end test. The request-level tests exercise Basic headers, Post form bodies, and the discovery-based fallback.

Summary by Sourcery

Allow administrators to configure the OIDC token endpoint authentication method across supported deployment configurations.

Bug Fixes:

• Support configurable OIDC token endpoint authentication for providers requiring either client_secret_basic or client_secret_post, while preserving discovery-based selection by default.
• Reject unsupported OIDC token endpoint authentication values during frontend authentication configuration.

Enhancements:

• Pass OIDC authentication settings through development and production Compose configurations and the Kubernetes frontend deployment.

Build:

• Add the openid-client dependency used by OIDC authentication tests.

Deployment:

• Expose the OIDC token endpoint authentication setting through the Kubernetes ConfigMap and frontend deployment.

Documentation:

• Document the OIDC_TOKEN_ENDPOINT_AUTH_METHOD setting and its supported values.

Tests:

• Add coverage for default discovery behavior, explicit authentication methods, invalid configuration, and resulting token request credential formats.

[sourcery-ai]

Reviewer's Guide

Introduces an optional, startup-validated OIDC token endpoint authentication override, retaining provider discovery when unset, and wires the setting through documentation, Docker Compose, and Kubernetes deployment manifests.

Sequence diagram for OIDC token endpoint authentication configuration

sequenceDiagram
    participant Env as Frontend environment
    participant Auth as frontend/lib/auth.ts
    participant NextAuth
    participant Provider as OIDC provider

    Env->>Auth: getTokenEndpointAuthMethod()
    alt OIDC_TOKEN_ENDPOINT_AUTH_METHOD unset
        Auth->>NextAuth: Configure OIDCProvider without client override
        NextAuth->>Provider: Discover token_endpoint_auth_methods_supported
        Provider-->>NextAuth: Provider-supported methods
    else client_secret_basic or client_secret_post
        Auth->>NextAuth: Configure client.token_endpoint_auth_method
        NextAuth->>Provider: Token request using configured method
    else unsupported value
        Auth-->>Env: Throw startup Error
    end

Loading

File-Level Changes

Change	Details	Files
Adds validated configuration for overriding the OIDC token endpoint client authentication method while preserving discovery-based behavior by default.	Reads and validates the optional environment variable at module initialization. Passes supported client_secret_basic or client_secret_post values to the NextAuth OIDC client configuration. Fails startup with a clear error for unsupported values. Covers unset, both supported overrides, and invalid configuration paths with tests.	frontend/lib/auth.ts frontend/tests/oidc-auth-config.test.ts
Propagates the new OIDC setting through deployment configuration and documents its use.	Documents the variable, accepted values, and discovery fallback. Adds the setting to production Compose and Kubernetes frontend configuration. Wires issuer, client credentials, end-session URL, and the new setting into the development Compose frontend service.	README.md docker-compose.prod.yml docker-compose.yml k8s/configmap.yaml k8s/frontend.yaml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Needs a human reviewer. An explicit setting changes how the OIDC client sends its client secret to the token endpoint; a wrong method can prevent users from logging in, or expose the secret through an incorrectly configured provider or transport. Reverting the code and configuration restores the previous behavior, and failed authentication attempts do not create persistent damage.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook