public/headscale
1
0 Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-11-04 12:39:25 +09:00
Code Issues Packages Projects Releases Wiki Activity

state, oidc: persist user changes and refresh nodes and clients

Browse Source 
Write cleared user columns, discard OIDC email the provider no longer
vouches for, refresh NodeStore users, and notify clients from the callback.

Fixes #3471
This commit is contained in:
Kristoffer Dalby committed 2026-11-02 17:46:54 +00:00
1 parent faa2b7c89d
commit cea0ef340d
8 files changed
+522 -16
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/ref/oidc.md
+5 -4
View File
@@ -127,12 +127,13 @@ are configured, a user needs to pass all of them.
### Control email verification
Headscale uses the `email` claim from the identity provider to synchronize the email address to its user profile. By
default, a user's email address is only synchronized when the identity provider reports the email address as verified
via the `email_verified: true` claim.
Headscale synchronizes the `email` claim from the identity provider to its user profile on each OIDC login. By default,
the profile uses the email only when the latest login reports `email_verified: true`. An absent, unverified, or
malformed email clears the previously stored address.
Unverified emails may be allowed in case an identity provider does not send the `email_verified` claim or email
verification is not required. In that case, a user's email address is always synchronized to the user profile.
verification is not required. With `email_verified_required: false`, the latest login's email is stored without
requiring verification. An absent or malformed email still clears the previously stored address.
```yaml hl_lines="5"
oidc: