OIDC settings page + setup wizard now configure the bootstrap admin
role instead of a hand-typed OIDC subject. The OIDC-only admin link is
handled automatically by the backend admin-role auto-connect on first
sign-in (explained inline in both the wizard and settings page).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Solves the OIDC-only bootstrap lockout (admin can't reach the in-app
OIDC settings page when password login is disabled and OIDC is unset).
- Frontend image entrypoint injects /runtime-config.js from the
deploy-time HARBORFORGE_OIDC_ONLY env so the SPA knows the mode
before the backend exists.
- Setup wizard gains an "OIDC" step (between Admin and Backend):
required when OIDC-only (incl. admin's OIDC subject so the bootstrap
admin can sign in), optional otherwise; written into harborforge.json.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Non-admins fall through to the catch-all redirect instead of seeing
the OIDC settings page shell. Sidebar link, in-page guard and the
admin-only backend API remain as defense in depth.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
New admin page /settings/oidc to configure the OIDC provider (issuer,
client id/secret, redirect/callback URL, scopes, post-login redirect).
Prominently shows the callback URL to register at the IdP, current
status/source, and the read-only deploy-level OIDC-only flag. Secret
is write-only (blank = keep). Sidebar entry for admins.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- useAuthConfig fetches public /auth/config; LoginPage hides the
password form when oidc_only and shows an SSO button when enabled.
- /oidc/callback route applies the returned JWT (sign-in) or shows the
link result; oidc_error surfaced on LoginPage.
- UsersPage: hides password fields in OIDC-only mode; admin OIDC
bind/unbind UI per user. Sidebar self-service "Link OIDC account"
(non-OIDC_ONLY).
- Dockerfile ARG/ENV HARBORFORGE_OIDC_ONLY.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
