Migrations/bookorbit
1
0
Fork 0
mirror of https://github.com/bookorbit/bookorbit.git synced 2026-11-03 00:11:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): explain untrusted OIDC certificate failures

Browse Source 
Classify private trust-chain failures with a stable error code and direct administrators to a mounted CA bundle without weakening TLS verification.

Fixes #1346
This commit is contained in:
neon
2026-09-10 11:47:56 +00:00
parent e514be151a
commit 33c7260f18
9 changed files with 118 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/.env.example
+3
View File
@@ -66,6 +66,9 @@ APP_DATA_PATH=../local/data
# Allow OIDC issuer/discovery URLs that resolve to private/local addresses in production.
# Default false. Keep false unless you intentionally trust your private network.
# OIDC_ALLOW_LOCAL_ISSUERS=false
# Trust additional PEM-encoded certificate authorities for outbound TLS, including OIDC.
# Mount the CA bundle read-only, set its in-container path here, and restart BookOrbit.
# NODE_EXTRA_CA_CERTS=/path/to/private-ca-bundle.pem
# Disable username/password sign-in after at least one active administrator has linked an enabled
# OIDC provider. Set false and restart to recover access if the identity provider is unavailable.