feat(auth): oidc-oauth2

[kimllee]

sample env file

FLATNOTES_USERNAME=youruser
FLATNOTES_PASSWORD=yourpassword
FLATNOTES_PATH=/data
FLATNOTES_SECRET_KEY=flatnotes
PYTHONPATH=server
OAUTH_CLIENT_ID=Ov23li0wyW1GzAGsMCV7
OAUTH_CLIENT_SECRET=<your_secret>
OIDC_CLIENT_ID=flatnotes
OIDC_CLIENT_SECRET=<your_secret>
OAUTH_REDIRECT_URI=http://localhost:9090/api/auth/oauth/callback
OIDC_REDIRECT_URI=http://localhost:9090/api/auth/oidc/callback
FLATNOTES_AUTH_TYPE=oidc
OIDC_DISCOVERY_URL=https://sub.domain.tld/realms/flatnotes/.well-known/openid-configuration
OIDC_AUTHORIZE_URL=https://sub.domain.tld/realms/flatnotes/protocol/openid-connect/auth
# Authentication oidc or github (oauth) defaults goes to GitHub
AUTH_PROVIDER=oidc

# ── Optionnelles (avec leurs valeurs par défaut) ──────────
OIDC_SCOPE=openid email profile
FLATNOTES_SESSION_EXPIRY_DAYS=30

# Optional: comma-separated GitHub usernames that are allowed in
#OAUTH_ALLOWED_USERS=alice,bob

[BobWs]

OIDC Testing with PocketID - Issues Encountered

I've been testing the OIDC implementation with PocketID as the provider, but I'm running into some issues. I need more time to debug.

Environment:

• PocketID v2.11.0
• Flatnotes-Enhanced running in Docker
• OIDC configuration with AUTH_PROVIDER=oidc

Errors Encountered:

1. "The requested OAuth 2.0 Client does not exist" - PocketID returns this error even though the client is properly registered. The logs show invalid_client during the authorize request.

2. State parameter issues - The OIDC provider rejects requests with either missing state or state that doesn't meet entropy requirements (needs at least 8 characters).

3. Missing code parameter in callback - After authentication, the callback endpoint receives an error instead of the expected authorization code.

PocketID Log Snippet:

ERR Failed to create authorize request error=invalid_client
path=/authorize query="state=12345678?client_id=...&redirect_uri=..."

Other OIDC clients work fine with PocketID, so the issue seems specific to this implementation.

If anyone can help test OIDC with PocketID (or other providers) and can share their working configuration, environment variables, and any code adjustments they made, that would be really helpful.

I'll continue investigating and update here if I find a solution.

[BobWs]

@kimllee – thank you for your contribution! I've noticed that the PR is based on the older pipenv system (Pipfile).
My fork has migrated to uv (see pyproject.toml and uv.lock).

Could you please update your PR to use the new uv system?

Thanks!

[kimllee]

Okay I will and i will also try with pocket-id but I won't be able to do it before 2 weeks from now.
Hope it is okay for you :)

[BobWs]

Okay I will and i will also try with pocket-id but I won't be able to do it before 2 weeks from now. Hope it is okay for you :)

No worries take your time!

[BobWs]

One last thing – I noticed that in the LogIn.vue file your PR still contains the Show QR code for authenticator setup button, which I removed in v1.12.1 for security reasons. Leaving it in would reintroduce the QR code on the login page for users who use TOTP instead of SSO, which would cause confusion and a potential security issue.

Could you please rebase your branch on the current main branch (which is at v1.13.1) and update your PR? This will ensure we don't reintroduce previous bugs and that your SSO implementation is built on the latest codebase.

Thanks for your understanding.

/Bob