feat: auto-redirect to OIDC IdP (#991) - #1029

DerDummePunkt · 2026-08-15T10:11:55Z

This PR attempts to implement the missing part of #991

Add GOTIFY_OIDC_AUTO_REDIRECT (with default false) to skip the login page and redirect straight to the configured OIDC provider. Only takes effect when local auth is disabled, since local login would otherwise be unreachable.

Add GOTIFY_OIDC_AUTO_REDIRECT_REQUIRE_REAUTH (default false) to send prompt=login on that redirect, so logging out of Gotify doesn't silently log the user back in via an existing IdP session. Does not end that IdP session, so other apps using it are unaffected.

Wire both flags through gotifyinfo/injected UI config and the WebUI login page, which now redirects instead of showing the OIDC button when enabled.

Added helperfunction to emit warnigns via FutureLog in config builder/parser

codecov · 2026-08-15T10:20:46Z

Codecov Report

❌ Patch coverage is 96.55172% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 75.47%. Comparing base (8af44e0) to head (82856b6).

Files with missing lines	Patch %	Lines
api/oidc.go	88.88%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1029      +/-   ##
==========================================
+ Coverage   74.78%   75.47%   +0.69%     
==========================================
  Files          66       66              
  Lines        3541     3556      +15     
==========================================
+ Hits         2648     2684      +36     
+ Misses        688      662      -26     
- Partials      205      210       +5

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

jmattheis

Thanks for the contribution.

DerDummePunkt · 2026-08-15T15:38:23Z

Im pretty confident the prompt params are correct and to spec, but I'm having trouble testing value combinations, it seems I have discovered a bug in authelia 🤷‍♂️

I will test mutliple prompt values against one of my dev keycloak instances later, but configuring keycloak is always such a pain in the a**, I doint have time for that right now

jmattheis · 2026-08-19T19:08:23Z

I've made some changes, notably:

Made the prompt a text-list
Added the prompt parameter to the external auth flow
The login form is always shown (no login spinner), and no redirect is done when oidc is disabled or there is a connection error

I'll test this some more this week.

jmattheis · 2026-08-20T20:54:43Z

I've tested with dex, authelia, keycloak and authentik. Authentik didn't seem to use the prompt parameter, but didn't error when it was set. I tried using multiple prompt values like login consent, but this didn't seem to make any difference on the listed IdPs. authelia prompt for consent anyway when using prompt=login.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [gotify/server](https://github.com/gotify/server) | major | `2.9.1` → `3.1.1` | [Release notes](https://github.com/gotify/server/releases) --- ### Release Notes <details> <summary>gotify/server (gotify/server)</summary> ### [`v3.1.1`](https://github.com/gotify/server/releases/tag/v3.1.1) [Compare Source](gotify/server@v3.1.0...v3.1.1) - Require an elevated session for creating users (GHSA-phfm-q6fr-wv34 via [#1048](gotify/server#1048)) - Move theme selection and password change to separate settings page ([#1040](gotify/server#1040) via [#1041](gotify/server#1041) by [@justadityaraj](https://github.com/justadityaraj)) - Disable password change form when [`GOTIFY_LOCALAUTH_ENABLED`](https://gotify.net/docs/config#gotify-localauth-enabled) is disabled ([#1040](gotify/server#1040) via [#1041](gotify/server#1041) by [@justadityaraj](https://github.com/justadityaraj)) - Fix crash when a Let's Encrypt request fails ([#1046](gotify/server#1046) by [@NotAFlightRisk](https://github.com/NotAFlightRisk)) - Update dependencies ### [`v3.1.0`](https://github.com/gotify/server/releases/tag/v3.1.0) [Compare Source](gotify/server@v3.0.0...v3.1.0) Notable features: - Add setting [`GOTIFY_LOCALAUTH_ENABLED`](https://gotify.net/docs/config#gotify-localauth-enabled) for disabling local user authentication [Docs](https://gotify.net/docs/oidc#disabling-local-authentication) ([#1007](gotify/server#1007) via [#1020](gotify/server#1020) by [@DerDummePunkt](https://github.com/DerDummePunkt)) - Allow mapping user admin status from OIDC claims [OIDC Groups Docs](https://gotify.net/docs/oidc#groups) ([#957](gotify/server#957) via [#1033](gotify/server#1033) by [@UiP9AV6Y](https://github.com/UiP9AV6Y)) - Prompt for re-authentication when authenticating with OIDC by default, configurable via [`GOTIFY_OIDC_PROMPT`](https://gotify.net/docs/config#gotify-oidc-prompt) ([#1029](gotify/server#1029) by [@DerDummePunkt](https://github.com/DerDummePunkt)) - Add setting [`GOTIFY_OIDC_IDP_NAME`](https://gotify.net/docs/config#gotify-oidc-idp-name) to change the label of the "login with oidc" button ([#991](gotify/server#991) via [#1022](gotify/server#1022) by [@DerDummePunkt](https://github.com/DerDummePunkt)) - Add setting [`GOTIFY_OIDC_AUTO_REDIRECT`](https://gotify.net/docs/config#gotify-oidc-auto-redirect) to auto redirect to the IdP when opening the login page ([#991](gotify/server#991) via [#1029](gotify/server#1029) by [@DerDummePunkt](https://github.com/DerDummePunkt)) - Highlight the current session in the client page ([#677](gotify/server#677) via [#1025](gotify/server#1025) by [@SulimanAbdulrazzaq](https://github.com/SulimanAbdulrazzaq)) Miscellaneous changes: - Update go module path to github.com/gotify/server/v3 ([#1030](gotify/server#1030) by [@eternal-flame-AD](https://github.com/eternal-flame-AD)) - Fix potential crash when pushing messages while a client disconnects with plugins active ([GHSA-78w7-2h8c-8252](GHSA-78w7-2h8c-8252) via [#1035](gotify/server#1035)) - Fix potential crash when removing a user with plugins active ([#1005](gotify/server#1005) by [@Osamaali313](https://github.com/Osamaali313)) - Show password hashing errors in the UI instead of crashing ([#1013](gotify/server#1013) via [#1014](gotify/server#1014) by [@eternal-flame-AD](https://github.com/eternal-flame-AD)) - Fix OIDC ID being removed when updating a user ([#1009](gotify/server#1009) via [#1010](gotify/server#1010)) - Read the OIDC username claim from the ID token and only fall back to the userinfo endpoint when it's missing ([#1033](gotify/server#1033)) ### [`v3.0.0`](https://github.com/gotify/server/releases/tag/v3.0.0) [Compare Source](gotify/server@v2.9.1...v3.0.0) Notable features: - Add OIDC login support. See [OIDC Docs](https://gotify.net/docs/oidc) ([#433](gotify/server#433) via [#941](gotify/server#941), [#977](gotify/server#977), [#982](gotify/server#982), [#1003](gotify/server#1003)) - Thanks to [@KovachVL](https://github.com/KovachVL) and [@alanturing881](https://github.com/alanturing881) for reporting security issues for this feature. - Add session elevation for sensitive actions in the web UI. [Session Elevation Docs](https://gotify.net/docs/session-elevation) (GHSA-3hcj-9m7p-wwm9, [#944](gotify/server#944) via [#952](gotify/server#952), [#954](gotify/server#954)). - Automatically delete inactive clients/sessions ([#943](gotify/server#943) via [#959](gotify/server#959)) Breaking changes: - The `config.yml` file is no longer supported, convert it to the new env format with [`migrate-config`](https://gotify.net/docs/migrate-to-3#migrating-your-config). - If you set list or map environment variables, their syntax changed, see [List and map syntax](https://gotify.net/docs/migrate-to-3#environment-list-and-map-syntax). - API tokens are no longer returned in the GET endpoints and are only exposed on creation or rotation. See [Tokens are only shown once](https://gotify.net/docs/migrate-to-3#tokens-are-only-shown-once). - If you have scripts hitting client-token endpoints, they may now need [elevation](https://gotify.net/docs/migrate-to-3#step-up-authentication). - The paging.next URL in message list responses is now a relative path. See [Paging next URL is relative](https://gotify.net/docs/migrate-to-3#paging-next-url-is-relative). Miscellaneous changes: - Rework configuration ([#366](gotify/server#366), [#392](gotify/server#392) via [#967](gotify/server#967)) - Don't store tokens in plain text ([#325](gotify/server#325) via [#971](gotify/server#971) by [@eternal-flame-AD](https://github.com/eternal-flame-AD)) - Publish a `gotify/server:master` docker image for testing unreleased changes. [Docs: Testing master](https://gotify.net/docs/testing-master) ([#953](gotify/server#953), [#956](gotify/server#956)) - Allow sending messages with a client token ([#964](gotify/server#964)) - Allow refreshing application tokens ([#985](gotify/server#985) via [#986](gotify/server#986) by [@eternal-flame-AD](https://github.com/eternal-flame-AD)) - Increase token keyspace to >128 bits ([#936](gotify/server#936) via [#939](gotify/server#939) by [@eternal-flame-AD](https://github.com/eternal-flame-AD)) - Switch logging to zerolog ([#962](gotify/server#962)) - Add OCI labels to docker images ([#924](gotify/server#924) via [#927](gotify/server#927) by [@eternal-flame-AD](https://github.com/eternal-flame-AD)) - Use use HTTP-only session cookies instead of local storage for UI sessions ([#941](gotify/server#941)) - Add `createdAt` to users, clients, applications and plugins ([#959](gotify/server#959)) - Add a CLI with `gotify serve`, `gotify version` and `gotify migrate-config` commands ([#967](gotify/server#967)) - Fix Messenger plugins that are added after init ([#653](gotify/server#653) via [#998](gotify/server#998) by [@TowyTowy](https://github.com/TowyTowy)) - Update dependencies </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.vcasaserver.com/omar/swarm/pulls/705 Co-authored-by: Renovate Bot <renovate-bot@vcasaserver.com>

DerDummePunkt requested a review from a team as a code owner August 15, 2026 10:11

DerDummePunkt force-pushed the github_1007_option_to_redirect_to_idp_when_logged_out branch from 69d7eb8 to d764fd9 Compare August 15, 2026 12:35

jmattheis requested changes Aug 15, 2026

View reviewed changes

Comment thread gotify-server.env.example Outdated

Comment thread gotify-server.env.example Outdated

Comment thread ui/src/user/Login.tsx

Comment thread model/gotifyinfo.go

Comment thread config/config.go Outdated

jmattheis mentioned this pull request Aug 16, 2026

chore: update go module path to github.com/gotify/server/v3 #1030

Merged

DerDummePunkt and others added 3 commits August 19, 2026 21:04

feat: auto-redirect to OIDC IdP (gotify#991)

d8b34c0

feat: add GOTIFY_OIDC_PROMPT config

32d240b

fix: reorder local auth

82856b6

jmattheis force-pushed the github_1007_option_to_redirect_to_idp_when_logged_out branch from 5ae0c1e to 82856b6 Compare August 19, 2026 19:06

jmattheis approved these changes Aug 20, 2026

View reviewed changes

jmattheis added this pull request to the merge queue Aug 20, 2026

Merged via the queue into gotify:master with commit 6933034 Aug 20, 2026
3 checks passed

jmattheis mentioned this pull request Aug 26, 2026

fix: add new oidc settings gotify/website#105

Merged

Navigation Menu

Repository navigation

feat: auto-redirect to OIDC IdP (#991) - #1029

feat: auto-redirect to OIDC IdP (#991)#1029
jmattheis merged 3 commits into
gotify:masterfrom
DerDummePunkt:github_1007_option_to_redirect_to_idp_when_logged_out

DerDummePunkt commented Aug 15, 2026

Uh oh!

codecov Bot commented Aug 15, 2026 •

edited

Loading

Uh oh!

jmattheis left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

DerDummePunkt commented Aug 15, 2026 •

edited

Loading

Uh oh!

jmattheis commented Aug 19, 2026 •

edited

Loading

Uh oh!

jmattheis commented Aug 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Conversation

DerDummePunkt commented Aug 15, 2026

Uh oh!

codecov Bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jmattheis left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

DerDummePunkt commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jmattheis commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jmattheis commented Aug 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

codecov Bot commented Aug 15, 2026 •

edited

Loading

DerDummePunkt commented Aug 15, 2026 •

edited

Loading

jmattheis commented Aug 19, 2026 •

edited

Loading