4 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Fredrik Ekre	dc3c0bc587	cli: remove leftover trace log from #3324 that always renders a JSON marshaling error ... Noticed this while testing out #3394.	2026-07-28 12:27:10 +02:00
Fredrik EkreandCopilot	5aeeff98d0	oidc: fix NewProvider ignoring caller context timeout ... NewAuthProviderOIDC received a context with a 30-second timeout from its caller, but immediately discarded it by passing context.Background() to oidc.NewProvider. This caused both `headscale serve` and `headscale configtest` to hang indefinitely if the OIDC issuer was unreachable, rather than timing out and returning an error. Fix by passing the caller's ctx to oidc.NewProvider and remove the nolint:contextcheck annotation that was suppressing the linter warning about this bug. The annotation was introduced in ce580f82 as part of a bulk lint-suppression pass without addressing the underlying issue. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-24 19:03:00 +02:00
Fredrik Ekre	5d8a2c25ea	OIDC: Query userinfo endpoint before verifying user ... This patch includes some changes to the OIDC integration in particular: - Make sure that userinfo claims are queried *before* comparing the user with the configured allowed groups, email and email domain. - Update user with group claim from the userinfo endpoint which is required for allowed groups to work correctly. This is essentially a continuation of #2545. - Let userinfo claims take precedence over id token claims. With these changes I have verified that Headscale works as expected together with Authelia without the documented escape hatch [0], i.e. everything works even if the id token only contain the iss and sub claims. [0]: https://www.authelia.com/integration/openid-connect/headscale/#configuration-escape-hatch	2025-08-11 17:51:16 +02:00
Fredrik Ekre	3f72ee9de8	Clarify SIGHUP log message (#2661)	2025-07-04 09:30:51 +02:00