drwily/petal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auth: pass the OIDC issuer through untouched, trailing slash and all

Browse Source 
Deploying against the real Authentik turned this up immediately: its issuer
ends in a slash, OIDC requires the discovered issuer to match the configured
one byte-for-byte, and trimming it made discovery fail every time. The stub
in the tests happened to advertise a slashless issuer, so the whole suite
passed while the only provider Petal actually talks to could not be reached.
The stub now takes its issuer as a knob, and a regression test runs the flow
against one that ends in a slash.

Claude-Session: https://claude.ai/code/session_016y6gyuHkQXPiEuW8RGQyua
This commit is contained in:
prosolis
2026-07-27 07:27:54 -07:00
parent 1cf207d73f
commit 6d71276513
2 changed files with 46 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/auth/oidc.go
+5 -1
View File
@@ -91,7 +91,11 @@ func (o *OIDC) discover(ctx context.Context) error {
if o.provider != nil {
return nil
}
provider, err := oidc.NewProvider(ctx, strings.TrimSuffix(o.opts.IssuerURL, "/"))
// The issuer is passed through exactly as configured, trailing slash and
// all: OIDC requires the discovered issuer to match the requested one
// byte-for-byte, and Authentik's ends in a slash. (go-oidc trims it itself
// when building the .well-known URL, so a slash here costs nothing.)
provider, err := oidc.NewProvider(ctx, o.opts.IssuerURL)
if err != nil {
return err
}