Multiple login redirect urls

[eilmiv]

Summary of changes

• Allow multiple redirect URIs for login providers (oidc, oidc2, elixir_aai, orcid). A valid redirect URI for the current domain is selected automatically.
• Replace existing string prefix based check whether a redirect is valid for a given domain with the public_suffix gem to match actual cookie behaviour in browsers
• No longer show login providers on the login page that have no valid redirect URI (matching the behaviour of the login menu)

Motivation and context

• Closes [space] Login while registering returns to parent TeSS #1310
• Closes Support individualized redirect URIs for spaces with entirely different domain #1367
• There may be some relevancy for Un-"spaced" features #1209 as this allows to somewhat configure what login providers are shown in each space by setting the relevant redirect URIs (however spaces under one domain automatically share all login providers currently)

Screenshots

There are no UI changes other than only showing valid login providers (which is hard to show in a screenshot).

Checklist

• I have read and followed the CONTRIBUTING guide.
• I confirm that I have the authority necessary to make this contribution on behalf of its copyright owner and agree to license it to the TeSS codebase under the BSD license.

[Copilot]

Pull request overview

Adds domain-aware redirect URI selection for OIDC and ORCID authentication across TeSS spaces.

Changes:

• Supports multiple provider redirect URIs using public-suffix domain matching.
• Filters unsupported login providers by space.
• Updates authentication configuration and tests.

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
Gemfile	Adds public_suffix.
Gemfile.lock	Locks the dependency.
config/secrets.github.yml	Documents redirect URI lists.
config/secrets.example.yml	Documents redirect URI lists.
config/initializers/omniauth.rb	Implements domain-aware URI resolution.
config/initializers/omniauth/oidc.rb	Enables multiple OIDC redirects.
config/initializers/omniauth/oidc2.rb	Enables multiple secondary OIDC redirects.
config/initializers/omniauth/ls_login.rb	Enables multiple LS Login redirects.
app/models/space.rb	Replaces prefix-based domain validation.
app/helpers/spaces_helper.rb	Filters providers by space domain.
app/helpers/application_helper.rb	Generalizes provider login links.
app/controllers/orcid_controller.rb	Selects an ORCID redirect URI.
app/controllers/concerns/space_redirect.rb	Uses registrable-domain matching.
app/views/users/show.html.erb	Applies ORCID-specific availability checks.
app/views/layouts/_login_menu.html.erb	Shows only supported providers.
app/views/devise/sessions/new.html.erb	Hides unsupported provider options.
app/views/devise/sessions/_omniauth_options.html.erb	Uses filtered provider links.
test/models/space_test.rb	Tests registrable-domain matching.
test/integration/login_test.rb	Tests provider visibility by host.
test/controllers/static_controller_test.rb	Updates login-menu configuration tests.
test/controllers/orcid_controller_test.rb	Tests ORCID redirect selection.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 1 comment.

[eilmiv]

Of course, it is not so easy to test this login change because it depends on interaction with login providers. I can confirm that login worked in PaN-Training before the fixes that ware done as a result of review in this pull request.