Migrations/neko
1
0
Fork 0
mirror of https://github.com/m1k1o/neko.git synced 2026-11-03 00:11:48 -06:00
Code Issues Packages Projects Releases Wiki Activity

feat: add email scope to OAuth configuration and update documentation

Browse Source
This commit is contained in:
Miroslav Šedivý
2026-09-24 00:13:28 +02:00
parent b5fa27324c
commit 1fec7b66d1
3 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
webpage/docs/configuration/authentication.md
+5 -1
View File
@@ -196,7 +196,7 @@ member:
client_id: "<client-id>"
client_secret: "<client-secret>"
issuer_url: "https://id.example.com"
scopes: ["openid", "profile"]
scopes: ["openid", "profile", "email"]
# Configure these to match the JSON returned by userinfo_url.
subject_field: "sub"
username_field: "name"
@@ -230,6 +230,10 @@ The sign-in endpoint is `GET /api/oauth/login`; the callback endpoint is `GET /a
`user_emails` restricts non-admin login to a list of allowed emails, matched the same way as `admin_emails`. If `user_emails` is empty (the default), any authenticated user is allowed to log in. Administrators (matched by `admin_emails` or `isAdmin: true`) can always log in regardless of `user_emails`. Users whose email is not allowed receive an HTTP 403 response and no session is created.
:::warning
`admin_emails` and `user_emails` are matched against the `email` claim. Most providers only include that claim if the `email` scope is requested, so `scopes` must include `"email"` (in addition to `"openid"`) or the claim will be empty and these lists will never match.
:::
For OAuth sessions, `GET /api/whoami` includes `extra_data`: the merged userinfo and ID-token claims, with userinfo values taking precedence. It is returned only to the authenticated session owner and is intended for profile-field troubleshooting. Do not place secrets in provider profile claims.
For non-OIDC providers, set `authorization_url`, `token_url`, `userinfo_url`, and optionally `redirect_url` directly. For GitHub, for example, use `read:user` as a scope and set `subject_field: id`, `username_field: login`, and `avatar_field: avatar_url`.