feat: OIDC/OAuth2 authentication driver and SLO support - #160
Open
jcdelepine wants to merge 1 commit into
Open
jcdelepine wants to merge 1 commit into
jcdelepine wants to merge 1 commit into
Conversation
Adds OIDC/OAuth2 support to Horde Core, independent of the Horde auth
driver — any existing driver (LDAP, SQL, application...) authenticates
the user; OAuth/OIDC tokens are held and validated orthogonally:
- PreLogoutHandlerInterface: contract for pre-logout hooks called by
LoginService::performLogout() before clearAuth(). Handlers may revoke
tokens, trigger SLO, or return a post-logout redirect URL.
- OidcPreLogoutHandler: implementation supporting three logout strategies:
- local: remove tokens from local storage only
- slo: remove tokens + redirect to IdP end_session_endpoint
- revoke_and_slo: revoke tokens at provider + SLO redirect
- OidcBackchannelLogoutController: endpoint for RFC 9470 back-channel
logout. Validates signed logout_token JWTs (RS256/ES256 via JWKS),
enforces jti replay protection, and removes the affected user's tokens.
- OidcHookHelper: static helpers centralising token refresh logic for
IMAP/SMTP/Sieve XOAUTH2 hooks.
- OAuthTokenRepositoryFactory: SQL-backed token repository wired through
the DI container, configurable via the admin UI.
- Unit tests for OidcPreLogoutHandler and OidcHookHelper.
- OIDC.md: installation and configuration guide.
An earlier revision of this branch introduced a dedicated
Horde_Core_Auth_Oidc auth driver. That driver has been removed: any
existing driver now authenticates the user, and per-application
authValidate() capabilities (see horde/imp) check OAuth token presence
independently — see horde/base#70 for the underlying "two actor"
rationale.
Depends on:
- horde/Jwt: Jwk::toPublicKey() (merged)
- horde/Oauth: OAuth2Client::revokeToken() (merged)
jcdelepine
force-pushed
the
feat/OidcIntegration
branch
from
September 20, 2026 15:43
727db20 to
1251df9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a complete OIDC/OAuth2 authentication integration for Horde:
Horde_Core_Auth_Oidc: auth driver that validates sessions by checking that OAuth2 tokens are still present in the repository. Authentication itself is handled by OAuthAccountController via the /auth/oauth/login flow. User listing via LDAP.
PreLogoutHandlerInterface: contract for pre-logout hooks called by LoginService::performLogout() before clearAuth(). Handlers may revoke tokens, trigger SLO, or return a post-logout redirect URL.
OidcPreLogoutHandler: implementation supporting three logout strategies:
OidcBackchannelLogoutController: endpoint for RFC 9470 back-channel logout. Validates signed logout_token JWTs (RS256/ES256 via JWKS), enforces jti replay protection, and removes the affected user's tokens.
OidcHookHelper: static helpers centralising token refresh logic for IMAP/SMTP/Sieve XOAUTH2 hooks.
OAuthTokenRepositoryFactory: SQL-backed token repository wired through the DI container, configurable via the admin UI.
Unit tests for OidcPreLogoutHandler and OidcHookHelper.
OIDC.md: installation and configuration guide.
Depends on: