Repository navigation
Configure the RegApp sign-in from the environment - #2723
Merged
Merged
Conversation
The securitysettings template offers the NFDI RegApp AAI when OEP_REGAPP_CLIENT_ID, OEP_REGAPP_SECRET and OEP_REGAPP_SERVER_URL are set (oep.env on a Podman server) and no third-party sign-in otherwise, so a deployment needs no edited settings file. verified_email and email_authentication move into the app's settings, where allauth reads them. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
verified_email: True would trust every RegApp address, so a sign-in with an existing account's address logs into that account (and wipes its password when the address was never verified there). Until now the template's upper-case key was ignored, so dropping it keeps sign-in as it behaved. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A Podman deployment had no way to switch on the NFDI RegApp sign-in without editing
securitysettings.pyinside the image. The template now reads it from the environment:OEP_REGAPP_CLIENT_ID,OEP_REGAPP_SECRET,OEP_REGAPP_SERVER_URLset: the sign-in page offers "NFDI-RegApp AAI" (provider idRegApp, redirect URIhttps://<OEP_URL>/accounts/oidc/RegApp/login/callback/).OEP_REGAPP_CLIENT_IDunset or empty: no third-party sign-in, as today.The three keys are in
podman/quadlets/oep.env.example, so on a server they go into~/.config/oeplatform/oep.envnext to the other credentials.Sign-in behaves as before. The old template put
VERIFIED_EMAILandEMAIL_AUTHENTICATIONin upper case directly on the app. allauth (65.14.1) copies onlyname,provider_id,client_id,secret,keyandsettingsfrom an app entry, so both were ignored. They are dropped rather than moved intosettings. A workingverified_email: Truewould trust every RegApp address, and together withSOCIALACCOUNT_EMAIL_AUTHENTICATION(_AUTO_CONNECT)a RegApp sign-in with an existing account's address would log into that account and wipe its password if the address was never verified there. Whether to trust RegApp addresses is a separate decision. Until then an address counts as verified only when the provider'semail_verifiedclaim says so, exactly as today.Found on oep-dev: its image (built 2026-07-01) still carries the old template entry with an empty
provider_id, so/accounts/login/and/accounts/signup/answer 500 there. A new image with this template fixes that.Changes
oeplatform/securitysettings.py.default: env-drivenSOCIALACCOUNT_PROVIDERSpodman/quadlets/oep.env.example: three new optional keyslogin/tests/test_account_pages_render.py: the template is now loaded with and without the variables (runpyinstead ofast.literal_eval, which cannot reados.environ). Both pages render 200 in both cases, the RegApp login link appears when configured, and noverified_emailis set.Test
python manage.py test login.tests.test_account_pages_renderwith allauth 65.14.1: 2 tests OK.No migration. Deploy: fill the three keys in
oep.envand restartoep-oeplatform.🤖 Generated with Claude Code