Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🔒feat: Enable OpenID Auto-Redirect #6066

Open
wants to merge 6 commits into
base: main
Choose a base branch
from

Conversation

leondape
Copy link
Contributor

@leondape leondape commented Feb 26, 2025

Summary

Closes: #5683
Docs: LibreChat-AI/librechat.ai#250

This pull request introduces several changes to support automatic redirection to an OpenID provider and improve the handling of user authentication. The most important changes include adding a new environment variable for OpenID auto-redirect, updating the login flow to handle this redirection, and enhancing the logout functionality to support custom redirects.

OpenID Auto-Redirect:

  • .env.example: Added OPENID_AUTO_REDIRECT environment variable to enable automatic redirection to the OpenID provider when a user visits the login page.
  • api/server/routes/config.js: Updated the configuration to include the openidAutoRedirect property.
  • client/src/components/Auth/Login.tsx: Implemented logic to handle auto-redirect to the OpenID provider based on the startup configuration and URL parameters.

Logout Functionality:

Error Handling and Localization:

These changes improve the user experience by streamlining the login process and providing more flexibility in handling authentication flows.

Change Type

Basically the Login page and config types were changed. Please review if any security questions have been touched. If think t should be fine.

  • New feature (non-breaking change which adds functionality)
  • This change requires a documentation update

Documented in: LibreChat-AI/librechat.ai#250

Checklist

  • My code adheres to this project's style guidelines
  • I have performed a self-review of my own code
  • I have commented in any complex areas of my code
  • I have made pertinent documentation changes
  • Local unit tests pass with my changes
  • Any changes dependent on mine have been merged and published in downstream modules.
  • A pull request for updating the documentation has been submitted. here

Copy link
Collaborator

@rubentalstra rubentalstra left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please have a look at my comment :)

@rubentalstra rubentalstra marked this pull request as draft February 27, 2025 09:06
@rubentalstra
Copy link
Collaborator

@leondape thank you for updating the code.

What do you think about instead of using the default url for redirecting have a parameter in the url to trigger this? So we don't need to make too many changes in the code?

This will also solve the infinite redirect loop?

@leondape
Copy link
Contributor Author

@rubentalstra could you elaborate your idea? I don’t quite get what you mean. :)

@rubentalstra
Copy link
Collaborator

@leondape instead of having a default direct to the OIDC? have the parameter so this? so when you use /login it will not auto direct only while doing /login?automatic-redirect=true or something. so you don't need to have a check for the infinite loop check and other things that makes it more complex?

@rubentalstra rubentalstra added this to the v0.7.8 milestone Mar 5, 2025
@leondape
Copy link
Contributor Author

leondape commented Mar 6, 2025

I understand.
I would propose it with a small change: if .env_redirect=true it should do so on /login.
If auth fails at the IDP it should navigate to /login?automatic-redirect=false to disable the infinite loop.
That way we can keep the default url. Otherwise I don't see how I can implement users browsing to /login?automatic-redirect=true.
What do you think?

@rubentalstra rubentalstra self-assigned this Mar 10, 2025
@leondape
Copy link
Contributor Author

@rubentalstra I just saw you merged into main?
I did not work on it at all. It probably has the whole "ugly" cookies solution in it. Was that a mistake?

@rubentalstra
Copy link
Collaborator

@leondape I did not merged it into main no worries. I'm working on your branch now. almost finished cleaning up some code here.

@leondape
Copy link
Contributor Author

aaaah I was just to stupid to read! Thank you. Looking forward to your solution.

@rubentalstra
Copy link
Collaborator

@leondape 17b0f35

please have a look and update your PR because I could not update it for some reason.

@rubentalstra
Copy link
Collaborator

@leondape
Copy link
Contributor Author

Vey cool, I see it works? :)
Any action required from my side? I suppose you can just merge from your branch?

Also.. different question: how can you setup the startup overlay message which can be seen in the video?

@rubentalstra
Copy link
Collaborator

@leondape if I merge from my branch then I need to close your PR. but I don;t want to take away your time and effort to start it :).

so to keep this PR it would be great if you could just update your branch with the changes from this branch:
https://github.com/danny-avila/LibreChat/compare/feat/oidc-auto-redirect

but if you don't mind then I will close this PR and create a new PR.

regarding the redirect message. this was just something I wanted to show the user with a little slower internet connection. will add a override text to it later as well was just an example.

@leondape
Copy link
Contributor Author

How forsightful, thank you!
Regarding the message. I meant the overlay stating something about admin dashboard or so?
I was looking for a way to display messages to users once they come to the platform for the first time and eventuelly when there are updates to report or so..

@rubentalstra
Copy link
Collaborator

@leondape have a look at this

config/update-banner.js

and

config/delete-banner.js

package.json

    "update-banner": "node config/update-banner.js",
    "delete-banner": "node config/delete-banner.js",

here you can set a banner. but I could not find it documented somewhere.

@leondape
Copy link
Contributor Author

interesting. Looking forward to the banner release!

@Odrec
Copy link

Odrec commented Mar 10, 2025

interesting. Looking forward to the banner release!

You can already use the banner as described here. I already used it and it works!

#3952

@leondape
Copy link
Contributor Author

Bildschirmfoto 2025-03-10 um 12 37 29
Amazing, but where does this overlay splash screen come from?

@rubentalstra
Copy link
Collaborator

@leondape I have updated it a little more: https://github.com/danny-avila/LibreChat/compare/feat/oidc-auto-redirect could you have a look please

@leondape
Copy link
Contributor Author

I updated it but must say for protocol that I did not have the time to review any of your changes.
But I like the approach much more than mine. If you continue to make changes, please feel free to close my PR and make your own. I don't mind not being credited on this one. But very noble of you acting that way! :)

@Odrec
Copy link

Odrec commented Mar 10, 2025

Bildschirmfoto 2025-03-10 um 12 37 29 Amazing, but where does this overlay splash screen come from?

From here. But it's only a Term and Conditions acceptance dialog, not for general info I guess.

@rubentalstra rubentalstra marked this pull request as ready for review March 10, 2025 13:14
@rubentalstra
Copy link
Collaborator

@danny-avila
✅ ready for review

@rubentalstra rubentalstra added the ✨ enhancement New feature or request label Mar 10, 2025
@rubentalstra rubentalstra changed the title added feature for oidc auto redirection 🔒feat: Enable OpenID Auto-Redirect Mar 10, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
✨ enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Enhancement: Automatic redirect to OIDC
3 participants