Ability to provision OIDC w/o full redir-url verification

system/autosetup.go

@@ -105,7 +105,15 @@ func oidcAutoDiscovery(ctx context.Context, cmd *cobra.Command, c *cli.Config) (
 	for p := 0; p < plen; p = p + 2 {
 		name, purl = providers[p], providers[p+1]
 
-		eap, err = external.RegisterOidcProvider(ctx, name, purl, false, true, true)
+		// force:    false
+		// because we do not want to override the provider every time the system restarts
+		//
+		// validate: false
+		// because at the initial (empty db) start, we can not actually validate (server is not yet up)
+		//
+		// enable:   true
+		// we want provider & the entire external auth to be validated
+		eap, err = external.RegisterOidcProvider(ctx, name, purl, false, false, true)
 
 		if err != nil {
 			c.Log.Error(

system/commands/settings.go

@@ -197,9 +197,3 @@ func Settings(ctx context.Context, c *cli.Config) *cobra.Command {
 
 	return cmd
 }
-
-func SettingsAutoConfigure(cmd *cobra.Command) {
-	// @todo load
-	// autoDiscoverAuthSettings()
-	// @todo store
-}

system/internal/auth/external/register.go

@@ -69,6 +69,10 @@ func RegisterOidcProvider(ctx context.Context, name, providerUrl string, force,
 		}
 	}
 
+	if as.ExternalRedirectUrl == "" {
+		return nil, errors.New("refusing to register oidc privider withoit redirect url")
+	}
+
 	p, err := parseExternalProviderUrl(providerUrl)
 	if err != nil {
 		return

system/system.go

@@ -58,9 +58,6 @@ func Configure() *cli.Config {
 					cli.HandleError(discoverSettings(ctx, cmd, c))
 					cli.HandleError(oidcAutoDiscovery(ctx, cmd, c))
 
-					// Run auto configuration
-					commands.SettingsAutoConfigure(cmd)
-
 					// Reload auto-configured settings
 					service.DefaultAuthSettings, _ = service.DefaultSettings.LoadAuthSettings()
 				}