From 1d3cc1c65e817716b0b8d3bd3252e5f5664e8bbe Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Mon, 23 Mar 2026 08:31:10 +0100 Subject: [PATCH] Use single OIDC session auth method instead of per-provider values The OIDC provider is already tracked in iam_oidc_states.provider, so there is no need for provider-specific session auth methods (GOOGLE, MICROSOFT). Replace them with a single OIDC auth method. Signed-off-by: Bryan Frimin --- pkg/coredata/migrations/20260319T150000Z.sql | 3 +-- pkg/coredata/session.go | 3 +-- pkg/server/api/connect/v1/oidc_handler.go | 12 ++---------- 3 files changed, 4 insertions(+), 14 deletions(-) diff --git a/pkg/coredata/migrations/20260319T150000Z.sql b/pkg/coredata/migrations/20260319T150000Z.sql index 259a73e53..e4fcc0600 100644 --- a/pkg/coredata/migrations/20260319T150000Z.sql +++ b/pkg/coredata/migrations/20260319T150000Z.sql @@ -1,5 +1,4 @@ -ALTER TYPE session_auth_method ADD VALUE 'GOOGLE'; -ALTER TYPE session_auth_method ADD VALUE 'MICROSOFT'; +ALTER TYPE session_auth_method ADD VALUE 'OIDC'; CREATE TYPE iam_oidc_provider AS ENUM ( 'GOOGLE', diff --git a/pkg/coredata/session.go b/pkg/coredata/session.go index f0c392f6c..9c499cb7c 100644 --- a/pkg/coredata/session.go +++ b/pkg/coredata/session.go @@ -57,8 +57,7 @@ const ( AuthMethodMagicLink AuthMethod = "MAGIC_LINK" AuthMethodPassword AuthMethod = "PASSWORD" AuthMethodSAML AuthMethod = "SAML" - AuthMethodGoogle AuthMethod = "GOOGLE" - AuthMethodMicrosoft AuthMethod = "MICROSOFT" + AuthMethodOIDC AuthMethod = "OIDC" ) func NewRootSession(identityID gid.GID, method AuthMethod, duration time.Duration) *Session { diff --git a/pkg/server/api/connect/v1/oidc_handler.go b/pkg/server/api/connect/v1/oidc_handler.go index cc9c0c98a..3c3d672c8 100644 --- a/pkg/server/api/connect/v1/oidc_handler.go +++ b/pkg/server/api/connect/v1/oidc_handler.go @@ -110,19 +110,11 @@ func (h *OIDCHandler) CallbackHandler(w http.ResponseWriter, r *http.Request) { return } - var authMethod coredata.AuthMethod - switch provider { - case coredata.OIDCProviderGoogle: - authMethod = coredata.AuthMethodGoogle - case coredata.OIDCProviderMicrosoft: - authMethod = coredata.AuthMethodMicrosoft - } - rootSession := authn.SessionFromContext(ctx) switch { case rootSession == nil: - rootSession, err = h.iam.AuthService.OpenSessionWithOIDC(ctx, identity.ID, authMethod) + rootSession, err = h.iam.AuthService.OpenSessionWithOIDC(ctx, identity.ID, coredata.AuthMethodOIDC) if err != nil { h.logger.ErrorCtx(ctx, "cannot open root session", log.Error(err)) httpserver.RenderError(w, http.StatusInternalServerError, errors.New("internal server error")) @@ -136,7 +128,7 @@ func (h *OIDCHandler) CallbackHandler(w http.ResponseWriter, r *http.Request) { return } - rootSession, err = h.iam.AuthService.OpenSessionWithOIDC(ctx, identity.ID, authMethod) + rootSession, err = h.iam.AuthService.OpenSessionWithOIDC(ctx, identity.ID, coredata.AuthMethodOIDC) if err != nil { h.logger.ErrorCtx(ctx, "cannot open root session", log.Error(err)) httpserver.RenderError(w, http.StatusInternalServerError, errors.New("internal server error"))