Repository navigation
fix(sso): converge Etech provisioning on trusted UID and native accounts - #39
Merged
Merged
Conversation
seahub/oauth/views.py imports seahub.settings directly, so Django's override_settings never reached CF_DIRECTORY_URL in these callback tests. Patch views.settings like the existing Directory refresh test does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Etech 的管理员预建和首次登录此前使用不同命名规则，缺失 UID 的 OAuth 登录还可能回到 CE 兼容路径。此分支让两种创建入口按可信 Directory 的 UID 复用原生用户；新用户统一使用小写
account@auth.local，账号冲突拒绝，历史账号不重命名。/oidc/login/复用现有 OAuth 客户端及/oauth/callback/，验证 ID Token；首次建号要求签名声明和 UserInfo 的 userId 一致，再由 Directory 核对 UID/在职状态。验证：本轮 59 项 Hub 定向测试通过，覆盖登录先于同步、同步先于登录、多认证绑定、历史名称复用、非法新建、UID/账号冲突、停用、OAuth/OIDC 校验与管理解析。原生 SQL/RPC 边界使用隔离测试替身，未连接真实数据库；不代表 DEV 真实登录或文件读写验收。
上线顺序：先审核持久配置，再换镜像并核对源码回执的 Hub SHA。关闭退役的 CF_SSO_EAP_PROFILE_IDENTITY；配置正确 OAUTH_OIDC_ISSUER 和 OAUTH_OIDC_JWKS_URI；LOGIN_URL 包含 SITE_ROOT 前缀（当前 DEV 为 /seafile/oidc/login/）。保持 userId -> login_id、客户端和已有回调不变。HTTP DEV 核对 OAUTH_ENABLE_INSECURE_TRANSPORT=True，HTTPS 生产不因此开启该设置。
本 PR 不改 Authentik、不改数据库结构或历史数据、不部署。会话恢复、失败清理 Cookie、文件历史调用方式单独处理；历史账号迁移不进入正常登录流程。