From 25d63167c83fd5e8adef91b8f1b21a7e6763c011 Mon Sep 17 00:00:00 2001
From: Martin Voigt <m.voigt@hzdr.de>
Date: Thu, 6 Aug 2026 15:52:52 +0200
Subject: [PATCH 1/6] Support extra_redirect_uris to support login providers
 for spaces that are not a subdomain of the default space

---
 app/helpers/application_helper.rb             | 15 +++++-----
 app/helpers/spaces_helper.rb                  | 17 ++++++++++-
 .../sessions/_omniauth_options.html.erb       | 10 +++----
 app/views/devise/sessions/new.html.erb        |  2 +-
 app/views/layouts/_login_menu.html.erb        |  6 ++--
 config/initializers/omniauth.rb               |  2 ++
 config/initializers/omniauth/ls_login.rb      |  7 ++++-
 config/initializers/omniauth/oidc.rb          |  9 ++++--
 config/initializers/omniauth/oidc2.rb         |  9 ++++--
 config/secrets.example.yml                    |  6 ++++
 config/secrets.github.yml                     |  4 +++
 .../host_redirect_openid_connect.rb           | 26 +++++++++++++++++
 test/integration/login_test.rb                | 29 +++++++++++++++++++
 13 files changed, 117 insertions(+), 25 deletions(-)
 create mode 100644 lib/omniauth/strategies/host_redirect_openid_connect.rb

diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index e5f9ca7c1..f390e6f15 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -705,15 +705,14 @@ def theme_path
     "themes/#{params[:theme_preview] || current_space&.theme || TeSS::Config.site['default_theme'] || 'default'}"
   end
 
-  def omniauth_login_link(provider, config)
+  def omniauth_login_link(provider, config, html_options = {})
     params = Space.current_space&.default? ? {} : { space_id: Space.current_space.id }
-    link_to(
-      t('authentication.omniauth.log_in_with',
-        provider: config.options[:label] ||
-                  t("authentication.omniauth.providers.#{provider}", default: provider.to_s.titleize)),
-      omniauth_authorize_path('user', provider, **params),
-      method: :post
-    )
+    label = t('authentication.omniauth.log_in_with',
+              provider: config.options[:label] ||
+                        t("authentication.omniauth.providers.#{provider}", default: provider.to_s.titleize))
+
+    link_to(capture { block_given? ? yield : label }, omniauth_authorize_path('user', provider, **params),
+            { method: :post }.merge(html_options))
   end
 
   def per_page_options_for_select
diff --git a/app/helpers/spaces_helper.rb b/app/helpers/spaces_helper.rb
index 5bc7dd50c..b6827a2ba 100644
--- a/app/helpers/spaces_helper.rb
+++ b/app/helpers/spaces_helper.rb
@@ -20,7 +20,22 @@ def space_feature_options
     end
   end
 
+  def omniauth_providers_for_space(space = current_space)
+    host = space&.host || TeSS::Config.base_uri.host
+
+    Devise.omniauth_configs.select do |_provider, config|
+      default_redirect_uri = config.options.dig(:client_options, :redirect_uri)
+      extra_redirect_uris = Array(config.options[:extra_redirect_uris])
+
+      [default_redirect_uri, *extra_redirect_uris].compact_blank.any? do |uri|
+        URI.parse(uri).host == host
+      rescue URI::InvalidURIError
+        false
+      end
+    end
+  end
+
   def space_supports_omniauth?(space = current_space)
-    space.nil? || space.default? || space.is_subdomain?(TeSS::Config.base_uri.domain)
+    omniauth_providers_for_space(space).any?
   end
 end
diff --git a/app/views/devise/sessions/_omniauth_options.html.erb b/app/views/devise/sessions/_omniauth_options.html.erb
index 68745c4c7..b7d48974c 100644
--- a/app/views/devise/sessions/_omniauth_options.html.erb
+++ b/app/views/devise/sessions/_omniauth_options.html.erb
@@ -1,14 +1,14 @@
 <% if devise_mapping.omniauthable? -%>
-  <% Devise.omniauth_configs.each do |provider, config| -%>
-    <%= link_to(omniauth_authorize_path(resource_name, provider), method: :post,
-                class: config.options[:logo] ? '' :
-                    TeSS::Config.feature["login_through_oidc_only"] ? 'btn btn-default btn-lg btn-oidc-only' : 'btn btn-default') do %>
+  <% omniauth_providers_for_space.each do |provider, config| -%>
+    <%= omniauth_login_link(provider, config,
+                            class: config.options[:logo] ? '' :
+                              TeSS::Config.feature["login_through_oidc_only"] ? 'btn btn-default btn-lg btn-oidc-only' : 'btn btn-default') do %>
       <% if config.options[:logo].present? %>
         <%= image_tag(config.options[:logo], class: "omniauth-logo omniauth-#{provider}") -%>
       <% else %>
         <%= t('authentication.omniauth.log_in_with',
             provider: config.options[:label] || t("authentication.omniauth.providers.#{provider}", default: provider.to_s.titleize)) -%>
       <% end %>
-    <% end -%>
+    <% end %>
   <% end -%>
 <% end -%>
diff --git a/app/views/devise/sessions/new.html.erb b/app/views/devise/sessions/new.html.erb
index a8518c381..47a6a9aa0 100644
--- a/app/views/devise/sessions/new.html.erb
+++ b/app/views/devise/sessions/new.html.erb
@@ -5,7 +5,7 @@
     <% end %>
   </div>
   <div class="form-middle">
-    <% if resource_class.omniauth_providers.any? && devise_mapping.omniauthable? %>
+    <% if space_supports_omniauth? && devise_mapping.omniauthable? %>
       <div class="h4"><%= t('authentication.omniauth.title') %></div>
       <p><%= t('authentication.omniauth.description') %></p>
       <%= render partial: 'devise/sessions/omniauth_options' %>
diff --git a/app/views/layouts/_login_menu.html.erb b/app/views/layouts/_login_menu.html.erb
index f216f5b2e..a5ef4630e 100644
--- a/app/views/layouts/_login_menu.html.erb
+++ b/app/views/layouts/_login_menu.html.erb
@@ -1,6 +1,6 @@
-<% if TeSS::Config.feature["login_through_oidc_only"] && Devise.omniauth_configs.size == 1 %>
+<% if TeSS::Config.feature["login_through_oidc_only"] && omniauth_providers_for_space.size == 1 %>
 <li>
-  <% provider, config = Devise.omniauth_configs.first %>
+  <% provider, config = omniauth_providers_for_space.first %>
   <%= omniauth_login_link(provider, config) %>
 </li>
 <% else %>
@@ -10,7 +10,7 @@
   </a>
   <ul class="dropdown-menu dropdown-menu-right">
     <% if space_supports_omniauth? %>
-      <% Devise.omniauth_configs.each do |provider, config| -%>
+      <% omniauth_providers_for_space.each do |provider, config| -%>
         <li class="dropdown-item"><%= omniauth_login_link(provider, config) %></li>
       <% end %>
     <% end %>
diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb
index 3ddceac5c..7373b4167 100644
--- a/config/initializers/omniauth.rb
+++ b/config/initializers/omniauth.rb
@@ -1,3 +1,5 @@
+require 'omniauth/strategies/host_redirect_openid_connect'
+
 Rails.application.config.middleware.use OmniAuth::Builder do
   OmniAuth.config.allowed_request_methods = [:post]
 
diff --git a/config/initializers/omniauth/ls_login.rb b/config/initializers/omniauth/ls_login.rb
index d7cfc3b31..07dcfc306 100644
--- a/config/initializers/omniauth/ls_login.rb
+++ b/config/initializers/omniauth/ls_login.rb
@@ -1,5 +1,8 @@
 # OpenID Connect configuration for LS Login nee Elixir AAI
 unless Rails.application.config.secrets.dig(:elixir_aai, :client_id).blank?
+  redirect_uri = Rails.application.config.secrets.elixir_aai[:redirect_uri].presence ||
+    "#{TeSS::Config.base_url.chomp('/')}/users/auth/elixir_aai/callback"
+
   Devise.omniauth :openid_connect, {
     logo: 'ls-login.png',
     name: :elixir_aai,
@@ -7,11 +10,13 @@
     response_type: :code,
     issuer: 'https://login.aai.lifescience-ri.eu/oidc/',
     discovery: true,
+    strategy_class: OmniAuth::Strategies::HostRedirectOpenIDConnect,
+    extra_redirect_uris: Rails.application.config.secrets.elixir_aai[:extra_redirect_uris],
     client_options: {
       identifier: Rails.application.config.secrets.elixir_aai[:client_id],
       secret: Rails.application.config.secrets.elixir_aai[:secret],
       # Wish I could use the url helper for this! (user_elixir_aai_omniauth_callback_url)
-      redirect_uri: "#{TeSS::Config.base_url.chomp('/')}/users/auth/elixir_aai/callback",
+      redirect_uri: redirect_uri,
     }
   }
 end
\ No newline at end of file
diff --git a/config/initializers/omniauth/oidc.rb b/config/initializers/omniauth/oidc.rb
index 0e8d8a133..e2d5062f2 100644
--- a/config/initializers/omniauth/oidc.rb
+++ b/config/initializers/omniauth/oidc.rb
@@ -1,19 +1,22 @@
 # OpenID Connect configuration
 unless Rails.application.config.secrets.dig(:oidc, :client_id).blank?
+  redirect_uri = Rails.application.config.secrets.oidc[:redirect_uri].presence ||
+    "#{TeSS::Config.base_url.chomp('/')}/users/auth/oidc/callback"
+
   Devise.omniauth :openid_connect, {
     name: :oidc,
     label: Rails.application.config.secrets.oidc[:label],
     logo: Rails.application.config.secrets.oidc[:logo],
     issuer: Rails.application.config.secrets.oidc[:issuer],
-    strategy_class: OmniAuth::Strategies::OpenIDConnect,
+    strategy_class: OmniAuth::Strategies::HostRedirectOpenIDConnect,
     scope: [:openid, :email, :profile],
     response_type: :code,
     discovery: true,
+    extra_redirect_uris: Rails.application.config.secrets.oidc[:extra_redirect_uris],
     client_options: {
       identifier: Rails.application.config.secrets.oidc[:client_id],
       secret: Rails.application.config.secrets.oidc[:secret],
-      redirect_uri: Rails.application.config.secrets.oidc[:redirect_uri].presence ||
-        "#{TeSS::Config.base_url.chomp('/')}/users/auth/oidc/callback"
+      redirect_uri: redirect_uri
     }
   }
 end
diff --git a/config/initializers/omniauth/oidc2.rb b/config/initializers/omniauth/oidc2.rb
index e055987a2..8d0d4ab40 100644
--- a/config/initializers/omniauth/oidc2.rb
+++ b/config/initializers/omniauth/oidc2.rb
@@ -1,19 +1,22 @@
 # Secondary OpenID Connect configuration
 unless Rails.application.config.secrets.dig(:oidc2, :client_id).blank?
+  redirect_uri = Rails.application.config.secrets.oidc2[:redirect_uri].presence ||
+    "#{TeSS::Config.base_url.chomp('/')}/users/auth/oidc2/callback"
+
   Devise.omniauth :openid_connect, {
     name: :oidc2,
     label: Rails.application.config.secrets.oidc2[:label],
     logo: Rails.application.config.secrets.oidc2[:logo],
     issuer: Rails.application.config.secrets.oidc2[:issuer],
-    strategy_class: OmniAuth::Strategies::OpenIDConnect,
+    strategy_class: OmniAuth::Strategies::HostRedirectOpenIDConnect,
     scope: [:openid, :email, :profile],
     response_type: :code,
     discovery: true,
+    extra_redirect_uris: Rails.application.config.secrets.oidc2[:extra_redirect_uris],
     client_options: {
       identifier: Rails.application.config.secrets.oidc2[:client_id],
       secret: Rails.application.config.secrets.oidc2[:secret],
-      redirect_uri: Rails.application.config.secrets.oidc2[:redirect_uri].presence ||
-        "#{TeSS::Config.base_url.chomp('/')}/users/auth/oidc2/callback"
+      redirect_uri: redirect_uri
     }
   }
 end
diff --git a/config/secrets.example.yml b/config/secrets.example.yml
index d2161c560..9a00f08fc 100644
--- a/config/secrets.example.yml
+++ b/config/secrets.example.yml
@@ -20,17 +20,23 @@ external_api_keys: &external_api_keys
   elixir_aai: # LS-Login authentication config
     client_id: # client id
     secret: # secret
+    redirect_uri:      # redirect_uri e.g. https://<host address>/users/auth/elixir_aai/callback
+    extra_redirect_uris: # optional list of additional redirect URIs for other TeSS space domains
   oidc: # OpenID Connect authentication config
     label:             # name of auth provider to display to users e.g. AAF (Australia)
     logo:              # optional path to logo to display to users under app/assets/images e.g. dresa/aaf_service_223x54.png
     client_id:         # client id
     secret:            # secret
+    redirect_uri:      # redirect_uri e.g. https://<host address>/users/auth/oidc/callback
+    extra_redirect_uris: # optional list of additional redirect URIs for other TeSS space domains
     issuer:            # issuer uri e.g. https://central.test.aaf.edu.au
   oidc2: # Secondary OpenID Connect authentication config
     label:             # name of auth provider to display to users e.g. Tuakiri (NZ)
     logo:              # optional path to logo to display to users under app/assets/images
     client_id:         # client id
     secret:            # secret
+    redirect_uri:      # redirect_uri e.g. https://<host address>/users/auth/oidc2/callback
+    extra_redirect_uris: # optional list of additional redirect URIs for other TeSS space domains
     issuer:            # issuer uri e.g. https://openidconnect.test.tuakiri.ac.nz
   bioportal_api_key:
   fairsharing:
diff --git a/config/secrets.github.yml b/config/secrets.github.yml
index 57e833d75..b160d28e8 100644
--- a/config/secrets.github.yml
+++ b/config/secrets.github.yml
@@ -13,11 +13,14 @@ config: &config
   elixir_aai:
     client_id: # client id
     secret: # secret
+    redirect_uri: # redirect_uri e.g. https://<host address>/users/auth/elixir_aai/callback
+    extra_redirect_uris: # optional list of additional redirect URIs for other TeSS space domains
   oidc:
     label:             # service label
     client_id:         # client id
     secret:            # secret
     redirect_uri:      # redirect_uri e.g. https://<host address>/users/auth/oidc/callback
+    extra_redirect_uris: # optional list of additional redirect URIs for other TeSS space domains
     issuer:            # issuer uri e.g. https://central.test.aaf.edu.au
     host:              # host e.g. central.text.aaf.edu.au
   oidc2:
@@ -25,6 +28,7 @@ config: &config
     client_id:         # client id
     secret:            # secret
     redirect_uri:      # redirect_uri e.g. https://<host address>/users/auth/oidc/callback
+    extra_redirect_uris: # optional list of additional redirect URIs for other TeSS space domains
     issuer:            # issuer uri e.g. https://openidconnect.test.tuakiri.ac.nz
     host:              # host e.g. central.text.aaf.edu.au
   bioportal_api_key:
diff --git a/lib/omniauth/strategies/host_redirect_openid_connect.rb b/lib/omniauth/strategies/host_redirect_openid_connect.rb
new file mode 100644
index 000000000..6504a9d84
--- /dev/null
+++ b/lib/omniauth/strategies/host_redirect_openid_connect.rb
@@ -0,0 +1,26 @@
+module OmniAuth
+  module Strategies
+    class HostRedirectOpenIDConnect < OpenIDConnect
+      option :extra_redirect_uris, []
+
+      def redirect_uri
+        default_redirect_uri = options.dig(:client_options, :redirect_uri)
+        extra_redirect_uris = Array(options[:extra_redirect_uris])
+        redirect_uris = [default_redirect_uri, *extra_redirect_uris].compact_blank
+
+        resolved_uri = redirect_uris.find do |uri|
+          URI.parse(uri).host == request&.host
+        rescue URI::InvalidURIError
+          false
+        end || default_redirect_uri
+
+        return super unless resolved_uri.present?
+
+        # preserve params['redirect_uri'] behavior from OpenIDConnect strategy
+        return resolved_uri unless params['redirect_uri']
+
+        "#{resolved_uri}?redirect_uri=#{CGI.escape(params['redirect_uri'])}"
+      end
+    end
+  end
+end
\ No newline at end of file
diff --git a/test/integration/login_test.rb b/test/integration/login_test.rb
index ba7edd4ed..3b709549f 100644
--- a/test/integration/login_test.rb
+++ b/test/integration/login_test.rb
@@ -47,6 +47,35 @@ class LoginTest < ActionDispatch::IntegrationTest
     end
   end
 
+  test 'sign in page uses space-aware omniauth link on a supported alternate host' do
+    omniauth_configs = {
+      oidc: OpenStruct.new(options: {
+        client_options: { redirect_uri: 'https://training.gobrails.test/users/auth/oidc/callback' },
+        extra_redirect_uris: ['https://space.mytess.training/users/auth/oidc/callback']
+      })
+    }
+
+    Devise.stub(:omniauth_configs, omniauth_configs) do
+      with_host('space.mytess.training') do
+        get '/users/sign_in'
+
+        assert_response :success
+        assert_select "a[href='/users/auth/oidc?space_id=#{spaces(:astro).id}']"
+      end
+    end
+  end
+
+  test 'sign in page hides omniauth links on an unsupported host' do
+    with_host('space.mytess.training') do
+      get '/users/sign_in'
+
+      assert_response :success
+      assert_select "a[href^='/users/auth/oidc']", false
+      assert_select "a[href^='/users/auth/oidc2']", false
+      assert_select "a[href^='/users/auth/elixir_aai']", false
+    end
+  end
+
   test 'clears legacy cookie (without domain) on login' do
     user = users(:regular_user)
     post '/users/sign_in', params: { 'user[login]' => user.username, 'user[password]' => 'hello' }

From acd0f2d2b052f16dfc41961590b5ecb697213a3e Mon Sep 17 00:00:00 2001
From: Martin Voigt <m.voigt@hzdr.de>
Date: Thu, 6 Aug 2026 20:26:59 +0200
Subject: [PATCH 2/6] Support list as redirect_url for login providers

---
 Gemfile                                       |  1 +
 Gemfile.lock                                  |  1 +
 app/controllers/concerns/space_redirect.rb    |  2 +-
 app/controllers/orcid_controller.rb           |  7 ++-
 app/helpers/spaces_helper.rb                  | 26 +++++++---
 app/models/space.rb                           | 12 ++---
 app/views/users/show.html.erb                 |  2 +-
 config/initializers/omniauth.rb               | 43 ++++++++++++++-
 config/initializers/omniauth/ls_login.rb      |  8 +--
 config/initializers/omniauth/oidc.rb          |  8 +--
 config/initializers/omniauth/oidc2.rb         |  8 +--
 config/secrets.example.yml                    | 10 ++--
 config/secrets.github.yml                     | 14 ++---
 .../host_redirect_openid_connect.rb           | 26 ----------
 test/controllers/orcid_controller_test.rb     | 52 +++++++++++++++++--
 test/controllers/static_controller_test.rb    | 18 +++++--
 test/integration/login_test.rb                |  5 +-
 test/models/space_test.rb                     | 23 +++++---
 18 files changed, 184 insertions(+), 82 deletions(-)
 delete mode 100644 lib/omniauth/strategies/host_redirect_openid_connect.rb

diff --git a/Gemfile b/Gemfile
index 1bdeee2f3..07b487b1f 100644
--- a/Gemfile
+++ b/Gemfile
@@ -39,6 +39,7 @@ gem 'oai'
 gem 'omniauth_openid_connect'
 gem 'pg'
 gem 'private_address_check'
+gem 'public_suffix'
 gem 'public_activity'
 gem 'pundit'
 gem 'rack-cors', require: 'rack/cors'
diff --git a/Gemfile.lock b/Gemfile.lock
index 84e4be48b..f35abbf7e 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -904,6 +904,7 @@ DEPENDENCIES
   private_address_check
   pry-byebug
   public_activity
+  public_suffix
   puma
   pundit
   rack-cors
diff --git a/app/controllers/concerns/space_redirect.rb b/app/controllers/concerns/space_redirect.rb
index 24f6783e8..5dab181be 100644
--- a/app/controllers/concerns/space_redirect.rb
+++ b/app/controllers/concerns/space_redirect.rb
@@ -4,7 +4,7 @@ module SpaceRedirect
   private
 
   def redirect_to_space(path, space)
-    if space&.is_subdomain?
+    if space&.valid_login_domain?(request.host)
       port_part = ''
       port_part = ":#{request.port}" if (request.protocol == "http://" && request.port != 80) ||
         (request.protocol == "https://" && request.port != 443)
diff --git a/app/controllers/orcid_controller.rb b/app/controllers/orcid_controller.rb
index a0332dbce..902ada3d0 100644
--- a/app/controllers/orcid_controller.rb
+++ b/app/controllers/orcid_controller.rb
@@ -42,10 +42,15 @@ def callback
 
   def set_oauth_client
     config = Rails.application.config.secrets.orcid
+    redirect_uris = TessOmniauthRedirectUris.normalize(
+      config[:redirect_uri],
+      orcid_callback_url(host: TeSS::Config.base_uri.host)
+    )
+
     @oauth2_client ||= Rack::OAuth2::Client.new(
       identifier: config[:client_id],
       secret: config[:secret],
-      redirect_uri: config[:redirect_uri].presence || orcid_callback_url(host: TeSS::Config.base_uri.host),
+      redirect_uri: TessOmniauthRedirectUris.resolve_for_host(redirect_uris, request.host),
       authorization_endpoint: '/oauth/authorize',
       token_endpoint: '/oauth/token',
       host: config[:host].presence || (Rails.env.production? ? 'orcid.org' : 'sandbox.orcid.org')
diff --git a/app/helpers/spaces_helper.rb b/app/helpers/spaces_helper.rb
index b6827a2ba..310afcaeb 100644
--- a/app/helpers/spaces_helper.rb
+++ b/app/helpers/spaces_helper.rb
@@ -21,16 +21,11 @@ def space_feature_options
   end
 
   def omniauth_providers_for_space(space = current_space)
-    host = space&.host || TeSS::Config.base_uri.host
+    host = space.try(:host) || TeSS::Config.base_uri.host
 
     Devise.omniauth_configs.select do |_provider, config|
-      default_redirect_uri = config.options.dig(:client_options, :redirect_uri)
-      extra_redirect_uris = Array(config.options[:extra_redirect_uris])
-
-      [default_redirect_uri, *extra_redirect_uris].compact_blank.any? do |uri|
-        URI.parse(uri).host == host
-      rescue URI::InvalidURIError
-        false
+      Array(config.options[:redirect_uris]).any? do |uri|
+        TessOmniauthRedirectUris.valid_login_domain?(URI.parse(uri).host, host)
       end
     end
   end
@@ -38,4 +33,19 @@ def omniauth_providers_for_space(space = current_space)
   def space_supports_omniauth?(space = current_space)
     omniauth_providers_for_space(space).any?
   end
+
+  # ORCID auth requires same-site cookies, so only allow default space
+  # or spaces under the configured base domain.
+  def space_supports_orcid_auth?(space = current_space)
+    host = space.try(:host) || TeSS::Config.base_uri.host
+    config = Rails.application.config.secrets.orcid
+    redirect_uris = TessOmniauthRedirectUris.normalize(
+      config[:redirect_uri],
+      "#{TeSS::Config.base_url.chomp('/')}/orcid/callback"
+    )
+
+    redirect_uris.any? do |uri|
+      TessOmniauthRedirectUris.valid_login_domain?(URI.parse(uri).host, host)
+    end
+  end
 end
diff --git a/app/models/space.rb b/app/models/space.rb
index bdcb6088b..7929a6bd8 100644
--- a/app/models/space.rb
+++ b/app/models/space.rb
@@ -146,15 +146,15 @@ def enabled_features
     (FEATURES - disabled_features)
   end
 
-  # Checks whether this space's host is the given domain, or a subdomain of
-  # it.
+  # Checks whether a cookie set for the given domain can be read by this
+  # space's host.
   #
-  # domain:: the domain to compare against; defaults to
-  #          <tt>TeSS::Config.base_uri.domain</tt>.
+  # login_host:: the domain to compare against; defaults to
+  #          <tt>TeSS::Config.base_uri.host</tt>.
   #
   # Returns:: +true+ or +false+.
-  def is_subdomain?(domain = TeSS::Config.base_uri.domain)
-    (host == domain || host.ends_with?(".#{domain}"))
+  def valid_login_domain?(login_host = TeSS::Config.base_uri.host)
+    TessOmniauthRedirectUris.valid_login_domain?(host, login_host)
   end
 
   # Equality by id: two Space instances are equal if they are both Space
diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb
index 15f0d8a1b..db61e21f2 100644
--- a/app/views/users/show.html.erb
+++ b/app/views/users/show.html.erb
@@ -54,7 +54,7 @@
         <% if TeSS::Config.orcid_authentication_enabled? &&
             current_user == @user &&
             !@user.profile.orcid_authenticated? &&
-            space_supports_omniauth? %>
+            space_supports_orcid_auth? %>
           <%= button_to t(@user.profile.orcid.blank? ? 'orcid.link' : 'orcid.authenticate'), authenticate_orcid_path, class: 'btn btn-default' %>
         <% end %>
       </p>
diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb
index 7373b4167..6c5d60d05 100644
--- a/config/initializers/omniauth.rb
+++ b/config/initializers/omniauth.rb
@@ -1,4 +1,45 @@
-require 'omniauth/strategies/host_redirect_openid_connect'
+module TessOmniauthRedirectUris
+  module_function
+
+  def normalize(redirect_uri, fallback)
+    redirect_uri.blank? ? [fallback] : Array(redirect_uri)
+  end
+
+  def valid_login_domain?(space_host, login_host)
+    return false if space_host.blank? || login_host.blank?
+
+    own_domain = PublicSuffix.domain(space_host)
+    target_domain = PublicSuffix.domain(login_host)
+
+    return space_host == login_host if own_domain.nil? || target_domain.nil?
+
+    own_domain == target_domain
+  end
+
+  def resolve_for_host(redirect_uris, host)
+    uris = Array(redirect_uris)
+    uris.find { |uri| valid_login_domain?(URI.parse(uri).host, host) } || uris.first
+  end
+end
+
+module OmniAuth
+  module Strategies
+    class HostRedirectOpenIDConnect < OpenIDConnect
+      option :redirect_uris, []
+
+      def redirect_uri
+        resolved_uri = TessOmniauthRedirectUris.resolve_for_host(options[:redirect_uris], request&.host)
+
+        return super unless resolved_uri.present?
+
+        # preserve params['redirect_uri'] behavior from OpenIDConnect strategy
+        return resolved_uri unless params['redirect_uri']
+
+        "#{resolved_uri}?redirect_uri=#{CGI.escape(params['redirect_uri'])}"
+      end
+    end
+  end
+end
 
 Rails.application.config.middleware.use OmniAuth::Builder do
   OmniAuth.config.allowed_request_methods = [:post]
diff --git a/config/initializers/omniauth/ls_login.rb b/config/initializers/omniauth/ls_login.rb
index 07dcfc306..205b9dee3 100644
--- a/config/initializers/omniauth/ls_login.rb
+++ b/config/initializers/omniauth/ls_login.rb
@@ -1,7 +1,9 @@
 # OpenID Connect configuration for LS Login nee Elixir AAI
 unless Rails.application.config.secrets.dig(:elixir_aai, :client_id).blank?
-  redirect_uri = Rails.application.config.secrets.elixir_aai[:redirect_uri].presence ||
+  redirect_uris = TessOmniauthRedirectUris.normalize(
+    Rails.application.config.secrets.elixir_aai[:redirect_uri],
     "#{TeSS::Config.base_url.chomp('/')}/users/auth/elixir_aai/callback"
+  )
 
   Devise.omniauth :openid_connect, {
     logo: 'ls-login.png',
@@ -11,12 +13,12 @@
     issuer: 'https://login.aai.lifescience-ri.eu/oidc/',
     discovery: true,
     strategy_class: OmniAuth::Strategies::HostRedirectOpenIDConnect,
-    extra_redirect_uris: Rails.application.config.secrets.elixir_aai[:extra_redirect_uris],
+    redirect_uris: redirect_uris,
     client_options: {
       identifier: Rails.application.config.secrets.elixir_aai[:client_id],
       secret: Rails.application.config.secrets.elixir_aai[:secret],
       # Wish I could use the url helper for this! (user_elixir_aai_omniauth_callback_url)
-      redirect_uri: redirect_uri,
+      redirect_uri: redirect_uris.first,
     }
   }
 end
\ No newline at end of file
diff --git a/config/initializers/omniauth/oidc.rb b/config/initializers/omniauth/oidc.rb
index e2d5062f2..aeb82ff1d 100644
--- a/config/initializers/omniauth/oidc.rb
+++ b/config/initializers/omniauth/oidc.rb
@@ -1,7 +1,9 @@
 # OpenID Connect configuration
 unless Rails.application.config.secrets.dig(:oidc, :client_id).blank?
-  redirect_uri = Rails.application.config.secrets.oidc[:redirect_uri].presence ||
+  redirect_uris = TessOmniauthRedirectUris.normalize(
+    Rails.application.config.secrets.oidc[:redirect_uri],
     "#{TeSS::Config.base_url.chomp('/')}/users/auth/oidc/callback"
+  )
 
   Devise.omniauth :openid_connect, {
     name: :oidc,
@@ -12,11 +14,11 @@
     scope: [:openid, :email, :profile],
     response_type: :code,
     discovery: true,
-    extra_redirect_uris: Rails.application.config.secrets.oidc[:extra_redirect_uris],
+    redirect_uris: redirect_uris,
     client_options: {
       identifier: Rails.application.config.secrets.oidc[:client_id],
       secret: Rails.application.config.secrets.oidc[:secret],
-      redirect_uri: redirect_uri
+      redirect_uri: redirect_uris.first
     }
   }
 end
diff --git a/config/initializers/omniauth/oidc2.rb b/config/initializers/omniauth/oidc2.rb
index 8d0d4ab40..4ceb469f2 100644
--- a/config/initializers/omniauth/oidc2.rb
+++ b/config/initializers/omniauth/oidc2.rb
@@ -1,7 +1,9 @@
 # Secondary OpenID Connect configuration
 unless Rails.application.config.secrets.dig(:oidc2, :client_id).blank?
-  redirect_uri = Rails.application.config.secrets.oidc2[:redirect_uri].presence ||
+  redirect_uris = TessOmniauthRedirectUris.normalize(
+    Rails.application.config.secrets.oidc2[:redirect_uri],
     "#{TeSS::Config.base_url.chomp('/')}/users/auth/oidc2/callback"
+  )
 
   Devise.omniauth :openid_connect, {
     name: :oidc2,
@@ -12,11 +14,11 @@
     scope: [:openid, :email, :profile],
     response_type: :code,
     discovery: true,
-    extra_redirect_uris: Rails.application.config.secrets.oidc2[:extra_redirect_uris],
+    redirect_uris: redirect_uris,
     client_options: {
       identifier: Rails.application.config.secrets.oidc2[:client_id],
       secret: Rails.application.config.secrets.oidc2[:secret],
-      redirect_uri: redirect_uri
+      redirect_uri: redirect_uris.first
     }
   }
 end
diff --git a/config/secrets.example.yml b/config/secrets.example.yml
index 9a00f08fc..03d9a201b 100644
--- a/config/secrets.example.yml
+++ b/config/secrets.example.yml
@@ -20,23 +20,20 @@ external_api_keys: &external_api_keys
   elixir_aai: # LS-Login authentication config
     client_id: # client id
     secret: # secret
-    redirect_uri:      # redirect_uri e.g. https://<host address>/users/auth/elixir_aai/callback
-    extra_redirect_uris: # optional list of additional redirect URIs for other TeSS space domains
+    redirect_uri:      # either one URL or a YAML list of URLs, e.g. https://<host>/users/auth/elixir_aai/callback
   oidc: # OpenID Connect authentication config
     label:             # name of auth provider to display to users e.g. AAF (Australia)
     logo:              # optional path to logo to display to users under app/assets/images e.g. dresa/aaf_service_223x54.png
     client_id:         # client id
     secret:            # secret
-    redirect_uri:      # redirect_uri e.g. https://<host address>/users/auth/oidc/callback
-    extra_redirect_uris: # optional list of additional redirect URIs for other TeSS space domains
+    redirect_uri:      # either one URL or a YAML list of URLs, e.g. https://<host>/users/auth/oidc/callback
     issuer:            # issuer uri e.g. https://central.test.aaf.edu.au
   oidc2: # Secondary OpenID Connect authentication config
     label:             # name of auth provider to display to users e.g. Tuakiri (NZ)
     logo:              # optional path to logo to display to users under app/assets/images
     client_id:         # client id
     secret:            # secret
-    redirect_uri:      # redirect_uri e.g. https://<host address>/users/auth/oidc2/callback
-    extra_redirect_uris: # optional list of additional redirect URIs for other TeSS space domains
+    redirect_uri:      # either one URL or a YAML list of URLs, e.g. https://<host>/users/auth/oidc2/callback
     issuer:            # issuer uri e.g. https://openidconnect.test.tuakiri.ac.nz
   bioportal_api_key:
   fairsharing:
@@ -48,6 +45,7 @@ external_api_keys: &external_api_keys
   orcid:
     client_id:
     secret:
+    redirect_uri:      # either one URL or a YAML list of URLs, e.g. https://<host>/orcid/callback
     host:
 
 #Internal config
diff --git a/config/secrets.github.yml b/config/secrets.github.yml
index b160d28e8..707fc43a2 100644
--- a/config/secrets.github.yml
+++ b/config/secrets.github.yml
@@ -13,24 +13,26 @@ config: &config
   elixir_aai:
     client_id: # client id
     secret: # secret
-    redirect_uri: # redirect_uri e.g. https://<host address>/users/auth/elixir_aai/callback
-    extra_redirect_uris: # optional list of additional redirect URIs for other TeSS space domains
+    redirect_uri: # either one URL or a YAML list of URLs, e.g. https://<host>/users/auth/elixir_aai/callback
   oidc:
     label:             # service label
     client_id:         # client id
     secret:            # secret
-    redirect_uri:      # redirect_uri e.g. https://<host address>/users/auth/oidc/callback
-    extra_redirect_uris: # optional list of additional redirect URIs for other TeSS space domains
+    redirect_uri:      # either one URL or a YAML list of URLs, e.g. https://<host>/users/auth/oidc/callback
     issuer:            # issuer uri e.g. https://central.test.aaf.edu.au
     host:              # host e.g. central.text.aaf.edu.au
   oidc2:
     label:             # service label
     client_id:         # client id
     secret:            # secret
-    redirect_uri:      # redirect_uri e.g. https://<host address>/users/auth/oidc/callback
-    extra_redirect_uris: # optional list of additional redirect URIs for other TeSS space domains
+    redirect_uri:      # either one URL or a YAML list of URLs, e.g. https://<host>/users/auth/oidc2/callback
     issuer:            # issuer uri e.g. https://openidconnect.test.tuakiri.ac.nz
     host:              # host e.g. central.text.aaf.edu.au
+  orcid:
+    client_id:
+    secret:
+    redirect_uri:      # either one URL or a YAML list of URLs, e.g. https://<host>/orcid/callback
+    host:
   bioportal_api_key:
 
 production:
diff --git a/lib/omniauth/strategies/host_redirect_openid_connect.rb b/lib/omniauth/strategies/host_redirect_openid_connect.rb
deleted file mode 100644
index 6504a9d84..000000000
--- a/lib/omniauth/strategies/host_redirect_openid_connect.rb
+++ /dev/null
@@ -1,26 +0,0 @@
-module OmniAuth
-  module Strategies
-    class HostRedirectOpenIDConnect < OpenIDConnect
-      option :extra_redirect_uris, []
-
-      def redirect_uri
-        default_redirect_uri = options.dig(:client_options, :redirect_uri)
-        extra_redirect_uris = Array(options[:extra_redirect_uris])
-        redirect_uris = [default_redirect_uri, *extra_redirect_uris].compact_blank
-
-        resolved_uri = redirect_uris.find do |uri|
-          URI.parse(uri).host == request&.host
-        rescue URI::InvalidURIError
-          false
-        end || default_redirect_uri
-
-        return super unless resolved_uri.present?
-
-        # preserve params['redirect_uri'] behavior from OpenIDConnect strategy
-        return resolved_uri unless params['redirect_uri']
-
-        "#{resolved_uri}?redirect_uri=#{CGI.escape(params['redirect_uri'])}"
-      end
-    end
-  end
-end
\ No newline at end of file
diff --git a/test/controllers/orcid_controller_test.rb b/test/controllers/orcid_controller_test.rb
index f7b1d4795..362806ee5 100644
--- a/test/controllers/orcid_controller_test.rb
+++ b/test/controllers/orcid_controller_test.rb
@@ -28,6 +28,46 @@ class OrcidControllerTest < ActionController::TestCase
     end
   end
 
+  test 'authenticating orcid in space uses matching redirect URI from list' do
+    plant_space = spaces(:plants)
+    redirect_uris = [
+      "#{TeSS::Config.base_url}/orcid/callback",
+      "https://#{plant_space.host}/orcid/callback"
+    ]
+
+    Rails.application.config.secrets.stub(:orcid, Rails.application.config.secrets.orcid.merge(redirect_uri: redirect_uris)) do
+      with_host(plant_space.host) do
+        sign_in users(:regular_user)
+
+        post :authenticate
+
+        assert_redirected_to /https:\/\/sandbox\.orcid\.org\/oauth\/authorize\?.+/
+        params = Rack::Utils.parse_query(URI.parse(response.location).query)
+        assert_equal "https://#{plant_space.host}/orcid/callback", params['redirect_uri']
+        assert_equal "space_id:#{plant_space.id}", params['state']
+      end
+    end
+  end
+
+  test 'authenticating orcid falls back to first redirect URI when none match host domain' do
+    redirect_uris = [
+      "https://first.example.com/orcid/callback",
+      "https://second.example.com/orcid/callback"
+    ]
+
+    Rails.application.config.secrets.stub(:orcid, Rails.application.config.secrets.orcid.merge(redirect_uri: redirect_uris)) do
+      with_host('space.golf.com') do
+        sign_in users(:regular_user)
+
+        post :authenticate
+
+        assert_redirected_to /https:\/\/sandbox\.orcid\.org\/oauth\/authorize\?.+/
+        params = Rack::Utils.parse_query(URI.parse(response.location).query)
+        assert_equal 'https://first.example.com/orcid/callback', params['redirect_uri']
+      end
+    end
+  end
+
   test 'do not authenticate orcid if user not logged-in' do
     post :authenticate
 
@@ -174,8 +214,10 @@ class OrcidControllerTest < ActionController::TestCase
     assert user.profile.orcid.blank?
     sign_in user
 
-    VCR.use_cassette('orcid/get_token_free_orcid') do
-      get :callback, params: { code: '123xyz', state: "space_id:#{space.id}" }
+    with_host('www.example.com') do
+      VCR.use_cassette('orcid/get_token_free_orcid') do
+        get :callback, params: { code: '123xyz', state: "space_id:#{space.id}" }
+      end
     end
 
     profile = user.profile.reload
@@ -194,8 +236,10 @@ class OrcidControllerTest < ActionController::TestCase
     assert user.profile.orcid.blank?
     sign_in user
 
-    VCR.use_cassette('orcid/get_token_free_orcid') do
-      get :callback, params: { code: '123xyz', state: "space_id:#{space.id}" }
+    with_host('www.example.com') do
+      VCR.use_cassette('orcid/get_token_free_orcid') do
+        get :callback, params: { code: '123xyz', state: "space_id:#{space.id}" }
+      end
     end
 
     profile = user.profile.reload
diff --git a/test/controllers/static_controller_test.rb b/test/controllers/static_controller_test.rb
index 8cf57380d..2cfd61f91 100644
--- a/test/controllers/static_controller_test.rb
+++ b/test/controllers/static_controller_test.rb
@@ -577,11 +577,21 @@ class StaticControllerTest < ActionController::TestCase
   end
 
   test 'should find log in button when login_through_oidc_only is enabled' do
-    Devise.stub(:omniauth_configs, { oidc: OpenStruct.new(options: { label: 'OIDC' }) }) do
+    base_host = TeSS::Config.base_uri.host
+    omniauth_configs = {
+      oidc: OpenStruct.new(options: {
+        label: 'OIDC',
+        redirect_uris: ["https://#{base_host}/users/auth/oidc/callback"]
+      })
+    }
+
+    Devise.stub(:omniauth_configs, omniauth_configs) do
       with_settings({ feature: { login_through_oidc_only: true } }) do
-        get :home
-        assert_select 'ul.user-options.nav.navbar-nav.navbar-right' do
-          assert_select 'a[href="/users/auth/oidc"]', count: 1
+        with_host(base_host) do
+          get :home
+          assert_select 'ul.user-options.nav.navbar-nav.navbar-right' do
+            assert_select 'a[href="/users/auth/oidc"]', count: 1
+          end
         end
       end
     end
diff --git a/test/integration/login_test.rb b/test/integration/login_test.rb
index 3b709549f..9aa9e22e9 100644
--- a/test/integration/login_test.rb
+++ b/test/integration/login_test.rb
@@ -51,7 +51,10 @@ class LoginTest < ActionDispatch::IntegrationTest
     omniauth_configs = {
       oidc: OpenStruct.new(options: {
         client_options: { redirect_uri: 'https://training.gobrails.test/users/auth/oidc/callback' },
-        extra_redirect_uris: ['https://space.mytess.training/users/auth/oidc/callback']
+        redirect_uris: [
+          'https://training.gobrails.test/users/auth/oidc/callback',
+          'https://space.mytess.training/users/auth/oidc/callback'
+        ]
       })
     }
 
diff --git a/test/models/space_test.rb b/test/models/space_test.rb
index 1397dc9ff..28f47666f 100644
--- a/test/models/space_test.rb
+++ b/test/models/space_test.rb
@@ -169,14 +169,21 @@ class SpaceTest < ActiveSupport::TestCase
     assert_equal [], @space.disabled_features
   end
 
-  test 'is_subdomain?' do
-    assert @space.is_subdomain?('mytess.training')
-    refute @space.is_subdomain?('amytess.training')
-    refute @space.is_subdomain?('mytess.com')
-    refute @space.is_subdomain?('mytess.training.com')
-    refute @space.is_subdomain?('space.mytess.training')
-    refute @space.is_subdomain?
-    assert Space.new(host: 'test.example.com').is_subdomain?
+  test 'valid_login_domain?' do
+    assert @space.valid_login_domain?('mytess.training')
+    refute @space.valid_login_domain?('amytess.training')
+    refute @space.valid_login_domain?('mytess.com')
+    refute @space.valid_login_domain?('mytess.training.com')
+
+    # Any host under the same registerable domain is valid.
+    assert @space.valid_login_domain?('space.mytess.training')
+
+    # github.io is a public suffix, so each <user>.github.io is a separate registerable domain.
+    github_space = Space.new(host: 'foo.github.io')
+    assert github_space.valid_login_domain?('foo.github.io')
+    refute github_space.valid_login_domain?('bar.github.io')
+
+    refute Space.new(host: 'test.example.com').valid_login_domain?(nil)
   end
 
   test 'with_current_space' do

From 15f005420c9e257d4ba2765257af9d4aef50e60f Mon Sep 17 00:00:00 2001
From: Martin Voigt <m.voigt@hzdr.de>
Date: Tue, 18 Aug 2026 13:01:20 +0200
Subject: [PATCH 3/6] Cleanup login provider redirect uri implementation

---
 app/controllers/orcid_controller.rb      | 5 +----
 app/helpers/spaces_helper.rb             | 7 +------
 config/initializers/omniauth.rb          | 4 ----
 config/initializers/omniauth/ls_login.rb | 8 ++++----
 config/initializers/omniauth/oidc.rb     | 6 +++---
 config/initializers/omniauth/oidc2.rb    | 6 +++---
 6 files changed, 12 insertions(+), 24 deletions(-)

diff --git a/app/controllers/orcid_controller.rb b/app/controllers/orcid_controller.rb
index 902ada3d0..c8a40e514 100644
--- a/app/controllers/orcid_controller.rb
+++ b/app/controllers/orcid_controller.rb
@@ -42,10 +42,7 @@ def callback
 
   def set_oauth_client
     config = Rails.application.config.secrets.orcid
-    redirect_uris = TessOmniauthRedirectUris.normalize(
-      config[:redirect_uri],
-      orcid_callback_url(host: TeSS::Config.base_uri.host)
-    )
+    redirect_uris = Array(config[:redirect_uri].presence || orcid_callback_url(host: TeSS::Config.base_uri.host))
 
     @oauth2_client ||= Rack::OAuth2::Client.new(
       identifier: config[:client_id],
diff --git a/app/helpers/spaces_helper.rb b/app/helpers/spaces_helper.rb
index 310afcaeb..3cc7b0446 100644
--- a/app/helpers/spaces_helper.rb
+++ b/app/helpers/spaces_helper.rb
@@ -34,15 +34,10 @@ def space_supports_omniauth?(space = current_space)
     omniauth_providers_for_space(space).any?
   end
 
-  # ORCID auth requires same-site cookies, so only allow default space
-  # or spaces under the configured base domain.
   def space_supports_orcid_auth?(space = current_space)
     host = space.try(:host) || TeSS::Config.base_uri.host
     config = Rails.application.config.secrets.orcid
-    redirect_uris = TessOmniauthRedirectUris.normalize(
-      config[:redirect_uri],
-      "#{TeSS::Config.base_url.chomp('/')}/orcid/callback"
-    )
+    redirect_uris = Array(config[:redirect_uri].presence || "#{TeSS::Config.base_url.chomp('/')}/orcid/callback")
 
     redirect_uris.any? do |uri|
       TessOmniauthRedirectUris.valid_login_domain?(URI.parse(uri).host, host)
diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb
index 6c5d60d05..26f96579f 100644
--- a/config/initializers/omniauth.rb
+++ b/config/initializers/omniauth.rb
@@ -1,10 +1,6 @@
 module TessOmniauthRedirectUris
   module_function
 
-  def normalize(redirect_uri, fallback)
-    redirect_uri.blank? ? [fallback] : Array(redirect_uri)
-  end
-
   def valid_login_domain?(space_host, login_host)
     return false if space_host.blank? || login_host.blank?
 
diff --git a/config/initializers/omniauth/ls_login.rb b/config/initializers/omniauth/ls_login.rb
index 205b9dee3..2ee5732de 100644
--- a/config/initializers/omniauth/ls_login.rb
+++ b/config/initializers/omniauth/ls_login.rb
@@ -1,8 +1,9 @@
 # OpenID Connect configuration for LS Login nee Elixir AAI
 unless Rails.application.config.secrets.dig(:elixir_aai, :client_id).blank?
-  redirect_uris = TessOmniauthRedirectUris.normalize(
-    Rails.application.config.secrets.elixir_aai[:redirect_uri],
-    "#{TeSS::Config.base_url.chomp('/')}/users/auth/elixir_aai/callback"
+  redirect_uris = Array(
+    Rails.application.config.secrets.elixir_aai[:redirect_uri].presence ||
+      # Url helper user_elixir_aai_omniauth_callback_url can not be used here
+      "#{TeSS::Config.base_url.chomp('/')}/users/auth/elixir_aai/callback"
   )
 
   Devise.omniauth :openid_connect, {
@@ -17,7 +18,6 @@
     client_options: {
       identifier: Rails.application.config.secrets.elixir_aai[:client_id],
       secret: Rails.application.config.secrets.elixir_aai[:secret],
-      # Wish I could use the url helper for this! (user_elixir_aai_omniauth_callback_url)
       redirect_uri: redirect_uris.first,
     }
   }
diff --git a/config/initializers/omniauth/oidc.rb b/config/initializers/omniauth/oidc.rb
index aeb82ff1d..31234dc2c 100644
--- a/config/initializers/omniauth/oidc.rb
+++ b/config/initializers/omniauth/oidc.rb
@@ -1,8 +1,8 @@
 # OpenID Connect configuration
 unless Rails.application.config.secrets.dig(:oidc, :client_id).blank?
-  redirect_uris = TessOmniauthRedirectUris.normalize(
-    Rails.application.config.secrets.oidc[:redirect_uri],
-    "#{TeSS::Config.base_url.chomp('/')}/users/auth/oidc/callback"
+  redirect_uris = Array(
+    Rails.application.config.secrets.oidc[:redirect_uri].presence ||
+      "#{TeSS::Config.base_url.chomp('/')}/users/auth/oidc/callback"
   )
 
   Devise.omniauth :openid_connect, {
diff --git a/config/initializers/omniauth/oidc2.rb b/config/initializers/omniauth/oidc2.rb
index 4ceb469f2..a3f1015d2 100644
--- a/config/initializers/omniauth/oidc2.rb
+++ b/config/initializers/omniauth/oidc2.rb
@@ -1,8 +1,8 @@
 # Secondary OpenID Connect configuration
 unless Rails.application.config.secrets.dig(:oidc2, :client_id).blank?
-  redirect_uris = TessOmniauthRedirectUris.normalize(
-    Rails.application.config.secrets.oidc2[:redirect_uri],
-    "#{TeSS::Config.base_url.chomp('/')}/users/auth/oidc2/callback"
+  redirect_uris = Array(
+    Rails.application.config.secrets.oidc2[:redirect_uri].presence ||
+      "#{TeSS::Config.base_url.chomp('/')}/users/auth/oidc2/callback"
   )
 
   Devise.omniauth :openid_connect, {

From 739fdedfebdf45e76d114655865fede343fedc61 Mon Sep 17 00:00:00 2001
From: Martin Voigt <m.voigt@hzdr.de>
Date: Tue, 18 Aug 2026 14:39:23 +0200
Subject: [PATCH 4/6] Add login redirect uri integration test

---
 test/integration/omniauth_test.rb | 37 +++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/test/integration/omniauth_test.rb b/test/integration/omniauth_test.rb
index a3356987b..5a1e04c37 100644
--- a/test/integration/omniauth_test.rb
+++ b/test/integration/omniauth_test.rb
@@ -459,4 +459,41 @@ class OmniauthTest < ActionDispatch::IntegrationTest
     assert_equal "http://www.example.com/users/aaf_user/edit", response.headers['Location']
   end
 
+  test 'OIDC authorize request includes host-matched callback URI in authorize redirect' do
+    before_request_phase = lambda do |env|
+      strategy = env['omniauth.strategy']
+      next unless strategy&.name.to_s == 'oidc'
+
+      strategy.options[:issuer] = 'https://issuer.example.com'
+      strategy.options[:discovery] = false
+      strategy.options[:redirect_uris] = [
+        'https://www.example.com/users/auth/oidc/callback',
+        'https://space.mytess.training/users/auth/oidc/callback'
+      ]
+      strategy.options[:client_options][:scheme] = 'https'
+      strategy.options[:client_options][:host] = 'issuer.example.com'
+      strategy.options[:client_options][:port] = 443
+      strategy.options[:client_options][:authorization_endpoint] = '/authorize'
+      strategy.options[:client_options][:redirect_uri] = 'https://www.example.com/users/auth/oidc/callback'
+    end
+
+    original_before_request_phase = OmniAuth.config.before_request_phase
+    original_test_mode = OmniAuth.config.test_mode
+
+    OmniAuth.config.before_request_phase = before_request_phase
+    OmniAuth.config.test_mode = false
+
+    with_host('space2.mytess.training') do
+      post '/users/auth/oidc'
+
+      assert_response :redirect
+      location = CGI.unescape(response.headers['Location'])
+      assert_includes location, 'https://issuer.example.com/authorize'
+      assert_includes location, 'redirect_uri=https://space.mytess.training/users/auth/oidc/callback'
+    end
+  ensure
+    OmniAuth.config.before_request_phase = original_before_request_phase
+    OmniAuth.config.test_mode = original_test_mode
+  end
+
 end

From d4e4e5187059b4391635e81978ebc9529920989e Mon Sep 17 00:00:00 2001
From: Martin Voigt <m.voigt@hzdr.de>
Date: Tue, 18 Aug 2026 15:52:10 +0200
Subject: [PATCH 5/6] Use PublicSuffix instead of Rails default domain all
 option for session cookies

---
 config/initializers/session_store.rb | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/config/initializers/session_store.rb b/config/initializers/session_store.rb
index b3db12830..a003651ea 100644
--- a/config/initializers/session_store.rb
+++ b/config/initializers/session_store.rb
@@ -1,6 +1,26 @@
+require 'ipaddr'
+require 'public_suffix'
+
 # Be sure to restart your server when you modify this file.
 opts = {
-  domain: :all
+  domain: lambda do |request|
+    host = request&.host.to_s.strip.downcase
+
+    next nil if host.blank? || !host.include?('.')
+
+    begin
+      IPAddr.new(host)
+      next nil
+    rescue IPAddr::InvalidAddressError
+      nil
+    end
+
+    begin
+      PublicSuffix.domain(host)
+    rescue PublicSuffix::Error
+      nil
+    end
+  end
 }
 
 if Rails.env.production?

From 2c8b9d6a97e704b501f4d95366ed723db2264202 Mon Sep 17 00:00:00 2001
From: Martin Voigt <m.voigt@hzdr.de>
Date: Tue, 18 Aug 2026 16:02:22 +0200
Subject: [PATCH 6/6] Update mail gem

---
 Gemfile.lock | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index f35abbf7e..4cf2c6e7f 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -363,7 +363,8 @@ GEM
     loofah (2.25.2)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    mail (2.8.1)
+    mail (2.9.1)
+      logger
       mini_mime (>= 0.1.1)
       net-imap
       net-pop
@@ -402,7 +403,7 @@ GEM
       uri (>= 0.11.1)
     net-http-persistent (4.0.8)
       connection_pool (>= 2.2.4, < 4)
-    net-imap (0.6.4.1)
+    net-imap (0.6.6)
       date
       net-protocol
     net-pop (0.1.2)