option to enforce oauth for some users

automatic style fixes and new workflows

fix user comparison and skip update on protected users

The farmer lets us know when a user is protected and can't be written,
so we can actually skip the update completely. fixes #132 for good

Only update local user cache when userdata has changed

There is no need to update the local user on every login when nothing
has changed.

This should fix most instances of #132 - if the oAuth provi

Only update local user cache when userdata has changed

There is no need to update the local user on every login when nothing
has changed.

This should fix most instances of #132 - if the oAuth provider data has
actually updated, the user would have to log into the farmer to update
the data though.

show more ...

Fix overwrite-groups config

This is a new implementation of the group handling introduced in #125

The previous implementation failed to preserve provider groups
properly. This also adds tests for t

Fix overwrite-groups config

This is a new implementation of the group handling introduced in #125

The previous implementation failed to preserve provider groups
properly. This also adds tests for the behaviour.

show more ...

Keep user groups set by different OAuth adapter plugins

Smarter merge of user groups

Update local user data with info from provider

Enable oauth service plugins to implement their own procedures on logout

Although some oauth services need their own procedures on logout
(e.g. Keycloak needs to access the logout endpoint), there i

Enable oauth service plugins to implement their own procedures on logout

Although some oauth services need their own procedures on logout
(e.g. Keycloak needs to access the logout endpoint), there is no way to
implement them. Fix it.

Signed-off-by: Naoto Kobayashi <naoto.kobayashi4c@gmail.com>

show more ...

better translation handling on exceptions

Fix check of valid email domains

improved user validation, added tests

lowercase mail

drop concept of GUID and introduce storageID

Previously we created a new GUID for any user trying to login via oauth.
That GUID was used to store the token states. This polluted the cache
area but e

drop concept of GUID and introduce storageID

Previously we created a new GUID for any user trying to login via oauth.
That GUID was used to store the token states. This polluted the cache
area but even worse, it made it impossible to stay logged in on multiple
devices when the IdP invalidated onld access tokens when issuing a new
one (like google does).

Now a session storage is used for the initial login. Permanent storage
is only initialized after a successful login (based on the user's email
address).

show more ...

moved token refresh to adapter class

This also takes care of saving the refresh token for when it's not
renewed on refresh (like Google doesn't).

use refresh token when AccessToken is about to expire

renamed our Service to Adapter to avoid confusion

Also added a mechanism to register Services from an adapter

restore proper ID context after login

removed lots of now unused code

make cookie login work, some more cleanup

another major refactoring

The new OAuthManager is now the main flow manager and should make it
easier to follow the flow. The Session class encapsulates all session
and cookie accesses. A new guid p

another major refactoring

The new OAuthManager is now the main flow manager and should make it
easier to follow the flow. The Session class encapsulates all session
and cookie accesses. A new guid paradigma should make invisible relogins
possible when the session expired. Needs all major cleanup but a first
login worked.

show more ...