Merge pull request 'Update Rust crate clap to 4.5.53' (#443 ) from renovate/clap-4.x into master

Update Rust crate clap to 4.5.53
Merge pull request 'Update Rust crate actix-web to 4.12.0' (#442 ) from renovate/actix-web-4.x into master
2025-11-21 00:06:51 +00:00 · 2025-11-20 00:06:35 +00:00 · 2025-11-18 00:07:30 +00:00 · 2025-11-17 00:07:08 +00:00 · 2025-11-03 22:23:32 +01:00 · 2025-11-02 00:06:57 +00:00
25 changed files with 332 additions and 71 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,3 @@
 /target
 .idea
-storage
+/storage
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -157,7 +157,7 @@ dependencies = [
 "futures-core",
 "futures-util",
 "mio",
- "socket2",
+ "socket2 0.5.8",
 "tokio",
 "tracing",
 ]
@@ -201,9 +201,9 @@ dependencies = [

 [[package]]
 name = "actix-web"
-version = "4.11.0"
+version = "4.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a597b77b5c6d6a1e1097fddde329a83665e25c5437c696a3a9a4aa514a614dea"
+checksum = "2233f53f6cb18ae038ce1f0713ca0c72ca0c4b71fe9aaeb59924ce2c89c6dd85"
 dependencies = [
 "actix-codec",
 "actix-http",
@@ -236,7 +236,7 @@ dependencies = [
 "serde_json",
 "serde_urlencoded",
 "smallvec",
- "socket2",
+ "socket2 0.6.1",
 "time",
 "tracing",
 "url",
@@ -400,9 +400,9 @@ dependencies = [

 [[package]]
 name = "anyhow"
-version = "1.0.97"
+version = "1.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcfed56ad506cb2c684a14971b8861fdc3baaaae314b9e5f9bb532cbe3ba7a4f"
+checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"

 [[package]]
 name = "arrayref"
@@ -660,9 +660,9 @@ dependencies = [

 [[package]]
 name = "binstring"
-version = "0.1.2"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed79c2a8151273c70956b5e3cdfdc1ff6c1a8b9779ba59c6807d281b32ee2f86"
+checksum = "0669d5a35b64fdb5ab7fb19cae13148b6b5cbdf4b8247faf54ece47f699c8cef"

 [[package]]
 name = "bitflags"
@@ -808,9 +808,9 @@ dependencies = [

 [[package]]
 name = "clap"
-version = "4.5.50"
+version = "4.5.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c2cfd7bf8a6017ddaa4e32ffe7403d547790db06bd171c1c53926faab501623"
+checksum = "c9e340e012a1bf4935f5282ed1436d1489548e8f72308207ea5df0e23d2d03f8"
 dependencies = [
 "clap_builder",
 "clap_derive",
@@ -818,9 +818,9 @@ dependencies = [

 [[package]]
 name = "clap_builder"
-version = "4.5.50"
+version = "4.5.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a4c05b9e80c5ccd3a7ef080ad7b6ba7d6fc00a985b8b157197075677c82c7a0"
+checksum = "d76b5d13eaa18c901fd2f7fca939fefe3a0727a953561fefdf3b2922b8569d00"
 dependencies = [
 "anstream",
 "anstyle",
@@ -973,9 +973,9 @@ dependencies = [

 [[package]]
 name = "ct-codecs"
-version = "1.1.3"
+version = "1.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b916ba8ce9e4182696896f015e8a5ae6081b305f74690baa8465e35f5a142ea4"
+checksum = "9b10589d1a5e400d61f9f38f12f884cfd080ff345de8f17efda36fe0e4a02aa8"

 [[package]]
 name = "ctr"
@@ -1450,18 +1450,18 @@ checksum = "18492c9f6f9a560e0d346369b665ad2bdbc89fa9bceca75796584e79042694c3"

 [[package]]
 name = "hmac-sha256"
-version = "1.1.8"
+version = "1.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a8575493d277c9092b988c780c94737fb9fd8651a1001e16bee3eccfc1baedb"
+checksum = "ad6880c8d4a9ebf39c6e8b77007ce223f646a4d21ce29d99f70cb16420545425"
 dependencies = [
 "digest",
 ]

 [[package]]
 name = "hmac-sha512"
-version = "1.1.6"
+version = "1.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0b3a0f572aa8389d325f5852b9e0a333a15b0f86ecccbb3fdb6e97cd86dc67c"
+checksum = "e89e8d20b3799fa526152a5301a771eaaad80857f83e01b23216ceaafb2d9280"
 dependencies = [
 "digest",
 ]
@@ -1598,7 +1598,7 @@ dependencies = [
 "http-body",
 "hyper",
 "pin-project-lite",
- "socket2",
+ "socket2 0.5.8",
 "tokio",
 "tower-service",
 "tracing",
@@ -1886,9 +1886,9 @@ dependencies = [

 [[package]]
 name = "jwt-simple"
-version = "0.12.12"
+version = "0.12.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "731011e9647a71ff4f8474176ff6ce6e0d2de87a0173f15613af3a84c3e3401a"
+checksum = "6ad8761f175784dfbb83709f322fc4daf6b27afd5bf375492f2876f9e925ef5a"
 dependencies = [
 "anyhow",
 "binstring",
@@ -1906,7 +1906,7 @@ dependencies = [
 "serde",
 "serde_json",
 "superboring",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
 "zeroize",
 ]

@@ -1932,9 +1932,9 @@ checksum = "d4345964bb142484797b161f473a503a434de77149dd8c7427788c6e13379388"

 [[package]]
 name = "lazy-regex"
-version = "3.4.1"
+version = "3.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60c7310b93682b36b98fa7ea4de998d3463ccbebd94d935d6b48ba5b6ffa7126"
+checksum = "191898e17ddee19e60bccb3945aa02339e81edd4a8c50e21fd4d48cdecda7b29"
 dependencies = [
 "lazy-regex-proc_macros",
 "once_cell",
@@ -1943,9 +1943,9 @@ dependencies = [

 [[package]]
 name = "lazy-regex-proc_macros"
-version = "3.4.1"
+version = "3.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ba01db5ef81e17eb10a5e0f2109d1b3a3e29bac3070fdbd7d156bf7dbd206a1"
+checksum = "c35dc8b0da83d1a9507e12122c80dea71a9c7c613014347392483a83ea593e04"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -1964,9 +1964,9 @@ dependencies = [

 [[package]]
 name = "libc"
-version = "0.2.171"
+version = "0.2.177"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c19937216e9d3aa9956d9bb8dfc0b0c8beb6058fc4f7a4dc4d850edf86a237d6"
+checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"

 [[package]]
 name = "libm"
@@ -2957,6 +2957,16 @@ dependencies = [
 "windows-sys 0.52.0",
 ]

+[[package]]
+name = "socket2"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17129e116933cf371d018bb80ae557e889637989d8638274fb25622827b03881"
+dependencies = [
+ "libc",
+ "windows-sys 0.60.2",
+]
+
 [[package]]
 name = "spin"
 version = "0.9.8"
@@ -3080,11 +3090,11 @@ dependencies = [

 [[package]]
 name = "thiserror"
-version = "2.0.12"
+version = "2.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
+checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8"
 dependencies = [
- "thiserror-impl 2.0.12",
+ "thiserror-impl 2.0.17",
 ]

 [[package]]
@@ -3100,9 +3110,9 @@ dependencies = [

 [[package]]
 name = "thiserror-impl"
-version = "2.0.12"
+version = "2.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
+checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -3163,7 +3173,7 @@ dependencies = [
 "parking_lot",
 "pin-project-lite",
 "signal-hook-registry",
- "socket2",
+ "socket2 0.5.8",
 "windows-sys 0.52.0",
 ]

@@ -3611,7 +3621,7 @@ checksum = "4286ad90ddb45071efd1a66dfa43eb02dd0dfbae1545ad6cc3c51cf34d7e8ba3"
 dependencies = [
 "windows-result",
 "windows-strings",
- "windows-targets 0.53.0",
+ "windows-targets 0.53.4",
 ]

 [[package]]
@@ -3650,6 +3660,15 @@ dependencies = [
 "windows-targets 0.52.6",
 ]

+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.4",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.52.6"
@@ -3668,10 +3687,11 @@ dependencies = [

 [[package]]
 name = "windows-targets"
-version = "0.53.0"
+version = "0.53.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1e4c7e8ceaaf9cb7d7507c974735728ab453b67ef8f18febdd7c11fe59dca8b"
+checksum = "2d42b7b7f66d2a06854650af09cfdf8713e427a439c97ad65a6375318033ac4b"
 dependencies = [
+ "windows-link 0.2.0",
 "windows_aarch64_gnullvm 0.53.0",
 "windows_aarch64_msvc 0.53.0",
 "windows_i686_gnu 0.53.0",
@@ -3892,9 +3912,9 @@ dependencies = [

 [[package]]
 name = "zeroize"
-version = "1.8.1"
+version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"

 [[package]]
 name = "zerovec"
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -8,10 +8,10 @@ edition = "2024"
 [dependencies]
 actix = "0.13.5"
 actix-identity = "0.9.0"
-actix-web = "4.11.0"
+actix-web = "4.12.0"
 actix-session = { version = "0.11.0", features = ["cookie-session"] }
 actix-remote-ip = "0.1.0"
-clap = { version = "4.5.50", features = ["derive", "env"] }
+clap = { version = "4.5.53", features = ["derive", "env"] }
 include_dir = "0.7.4"
 log = "0.4.28"
 serde_json = "1.0.145"
@@ -25,10 +25,10 @@ askama = "0.14.0"
 urlencoding = "2.1.3"
 rand = "0.9.2"
 base64 = "0.22.1"
-jwt-simple = { version = "0.12.12", default-features = false, features = ["pure-rust"] }
+jwt-simple = { version = "0.12.13", default-features = false, features = ["pure-rust"] }
 digest = "0.10.7"
 sha2 = "0.10.9"
-lazy-regex = "3.4.1"
+lazy-regex = "3.4.2"
 totp_rfc6238 = "0.6.1"
 base32 = "0.5.1"
 qrcode-generator = "5.0.0"
--- a/README.md
+++ b/README.md
@@ -67,10 +67,11 @@ You can add as much upstream provider as you want, using the following syntax in
 ```yaml
 - id: gitlab
  name: GitLab
-  logo: gitlab # Can be either gitea, gitlab, github, microsoft, google or a full URL
+  logo: gitlab # Can be either openid, gitea, gitlab, github, microsoft, google or a full URL
  client_id: CLIENT_ID_GIVEN_BY_PROVIDER
  client_secret: CLIENT_SECRET_GIVEN_BY_PROVIDER
  configuration_url: https://gitlab.com/.well-known/openid-configuration
+  allow_auto_account_creation: true

 ```

@@ -108,5 +109,20 @@ Corresponding client configuration:

 OAuth proxy can then be access on this URL: http://192.168.2.103:4180/

+## Testing with upstream identity provider
+The folder [sample_upstream_provider](sample_upstream_provider) contains a working scenario of authentication with an upstream provider.
+
+Run the following command to run the scenario:
+
+```bash
+cd sample_upstream_provider
+docker compose up
+```
+
+- Upstream provider (not to be directly used): http://localhost:9001
+- BasicOIDC: http://localhost:8000
+- Client 2: http://localhost:8012
+- Client 1: http://localhost:8011
+
 ## Contributing
 If you wish to contribute to this software, feel free to send an email to contact@communiquons.org to get an account on my system, managed by BasicOIDC :)
--- a/assets/css/base_settings_page.css
+++ b/assets/css/base_settings_page.css
@@ -20,4 +20,8 @@ body {

 .form-control::placeholder {
    color: #555;
+}
+
+.table-break-works td {
+    word-break: break-all;
 }
--- a/assets/img/brands/openid.svg
+++ b/assets/img/brands/openid.svg
@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>OpenID</title><path d="M14.54.889l-3.63 1.773v18.17c-4.15-.52-7.27-2.78-7.27-5.5 0-2.58 2.8-4.75 6.63-5.41v-2.31C4.42 8.322 0 11.502 0 15.332c0 3.96 4.74 7.24 10.91 7.78l3.63-1.71V.888m.64 6.724v2.31c1.43.25 2.71.7 3.76 1.31l-1.97 1.11 7.03 1.53-.5-5.21-1.87 1.06c-1.74-1.06-3.96-1.81-6.45-2.11z"/></svg>
--- a/sample_upstream_provider/dex-provider/dex.config.yaml
+++ b/sample_upstream_provider/dex-provider/dex.config.yaml
@@ -0,0 +1,26 @@
+issuer: http://127.0.0.1:9001/dex
+
+storage:
+  type: memory
+
+web:
+  http: 0.0.0.0:9001
+
+oauth2:
+  # Automate some clicking
+  # Note: this might actually make some tests pass that otherwise wouldn't.
+  skipApprovalScreen: false
+
+connectors:
+  # Note: this might actually make some tests pass that otherwise wouldn't.
+  - type: mockCallback
+    id: mock
+    name: Example
+
+# Basic OP test suite requires two clients.
+staticClients:
+  - id: foo
+    secret: bar
+    redirectURIs:
+      - http://localhost:8000/prov_cb
+    name: Auth
--- a/sample_upstream_provider/docker-compose.yaml
+++ b/sample_upstream_provider/docker-compose.yaml
@@ -0,0 +1,47 @@
+services:
+  upstream:
+    image: dexidp/dex
+    user: "1000"
+    network_mode: host
+    volumes:
+      - ./dex-provider:/conf:ro
+    command: [ "dex", "serve", "/conf/dex.config.yaml" ]
+
+  client1:
+    image: pierre42100/oidc_test_client
+    user: "1000"
+    network_mode: host
+    environment:
+      - LISTEN_ADDR=0.0.0.0:8011
+      - PUBLIC_URL=http://127.0.0.1:8011
+      - CONFIGURATION_URL=http://localhost:8000/.well-known/openid-configuration
+      - CLIENT_ID=testclient1
+      - CLIENT_SECRET=secretone
+
+  client2:
+    image: pierre42100/oidc_test_client
+    user: "1000"
+    network_mode: host
+    environment:
+      - LISTEN_ADDR=0.0.0.0:8012
+      - PUBLIC_URL=http://127.0.0.1:8012
+      - CONFIGURATION_URL=http://localhost:8000/.well-known/openid-configuration
+      - CLIENT_ID=testclient2
+      - CLIENT_SECRET=secrettwo
+
+  basicoidc:
+    image: rust
+    user: "1000"
+    network_mode: host
+    environment:
+      - STORAGE_PATH=/storage
+      - DISABLE_LOCAL_LOGIN=true
+      #- RUST_LOG=debug
+    volumes:
+      - ../:/app
+      - ./storage:/storage
+      - ~/.cargo/registry:/usr/local/cargo/registry
+    command:
+      - bash
+      - -c
+      - cd /app && cargo run
--- a/sample_upstream_provider/storage/.gitignore
+++ b/sample_upstream_provider/storage/.gitignore
@@ -0,0 +1 @@
+users.json
--- a/sample_upstream_provider/storage/clients.yaml
+++ b/sample_upstream_provider/storage/clients.yaml
@@ -0,0 +1,11 @@
+- id: testclient1
+  name: Client 1
+  description: client1
+  secret: secretone
+  redirect_uri: http://127.0.0.1:8011/
+  granted_to_all_users: true
+- id: testclient2
+  name: Client 2
+  description: client2
+  secret: secrettwo
+  redirect_uri: http://127.0.0.1:8012/
--- a/sample_upstream_provider/storage/providers.yaml
+++ b/sample_upstream_provider/storage/providers.yaml
@@ -0,0 +1,7 @@
+- id: upstream
+  name: Upstream
+  logo: openid
+  client_id: foo
+  client_secret: bar
+  configuration_url: http://127.0.0.1:9001/dex/.well-known/openid-configuration
+  allow_auto_account_creation: true
--- a/src/actors/users_actor.rs
+++ b/src/actors/users_actor.rs
@@ -1,10 +1,11 @@
 use std::net::IpAddr;

 use crate::data::provider::{Provider, ProviderID};
-use actix::{Actor, Context, Handler, Message, MessageResult};
-
 use crate::data::user::{FactorID, GeneralSettings, GrantedClients, TwoFactor, User, UserID};
 use crate::utils::err::Res;
+use crate::utils::string_utils::is_acceptable_login;
+use actix::{Actor, Context, Handler, Message, MessageResult};
+use light_openid::primitives::OpenIDUserInfo;

 /// User storage interface
 pub trait UsersSyncBackend {
@@ -38,6 +39,8 @@ pub enum LoginResult {
    LocalAuthForbidden,
    AuthFromProviderForbidden,
    Success(Box<User>),
+    AccountAutoCreated(Box<User>),
+    CannotAutoCreateAccount(String),
 }

 #[derive(Message)]
@@ -51,6 +54,7 @@ pub struct LocalLoginRequest {
 #[rtype(LoginResult)]
 pub struct ProviderLoginRequest {
    pub email: String,
+    pub user_info: OpenIDUserInfo,
    pub provider: Provider,
 }

@@ -187,7 +191,86 @@ impl Handler<ProviderLoginRequest> for UsersActor {
                log::error!("Failed to find user! {e}");
                MessageResult(LoginResult::Error)
            }
-            Ok(None) => MessageResult(LoginResult::AccountNotFound),
+            Ok(None) => {
+                // Check if automatic account creation is enabled for this provider
+                if !msg.provider.allow_auto_account_creation {
+                    return MessageResult(LoginResult::AccountNotFound);
+                }
+
+                // Extract username for account creation
+                let mut username = msg
+                    .user_info
+                    .preferred_username
+                    .unwrap_or(msg.email.to_string());
+
+                // Determine username from email, if necessary
+                if !is_acceptable_login(&username)
+                    || matches!(
+                        self.manager.find_by_username_or_email(&username),
+                        Ok(Some(_))
+                    )
+                {
+                    username = msg.email.clone();
+                }
+
+                // Check if username is already taken
+                if matches!(
+                    self.manager.find_by_username_or_email(&username),
+                    Ok(Some(_))
+                ) {
+                    return MessageResult(LoginResult::CannotAutoCreateAccount(format!(
+                        "username {username} is already taken!"
+                    )));
+                }
+
+                if !is_acceptable_login(&username) {
+                    return MessageResult(LoginResult::CannotAutoCreateAccount(
+                        "could not determine acceptable login for user!".to_string(),
+                    ));
+                }
+
+                // Automatic account creation
+                let user_id = match self.manager.create_user_account(GeneralSettings {
+                    uid: UserID::random(),
+                    username,
+                    first_name: msg.user_info.given_name.unwrap_or_default(),
+                    last_name: msg.user_info.family_name.unwrap_or_default(),
+                    email: msg.email.to_string(),
+                    enabled: true,
+                    two_factor_exemption_after_successful_login: false,
+                    is_admin: false,
+                }) {
+                    Ok(u) => u,
+                    Err(e) => {
+                        log::error!("Failed to create user account! {e}");
+                        return MessageResult(LoginResult::CannotAutoCreateAccount(
+                            "missing some user information".to_string(),
+                        ));
+                    }
+                };
+
+                // Mark the provider as the only authorized source
+                if let Err(e) = self.manager.set_authorized_authentication_sources(
+                    &user_id,
+                    AuthorizedAuthenticationSources {
+                        local: false,
+                        upstream: vec![msg.provider.id],
+                    },
+                ) {
+                    log::error!(
+                        "Failed to set authorized authentication sources for newly created account! {e}"
+                    );
+                }
+
+                // Extract user information to return them
+                let Ok(Some(user)) = self.manager.find_by_user_id(&user_id) else {
+                    return MessageResult(LoginResult::CannotAutoCreateAccount(
+                        "failed to get created user information".to_string(),
+                    ));
+                };
+
+                MessageResult(LoginResult::AccountAutoCreated(Box::new(user)))
+            }
            Ok(Some(user)) => {
                if !user.can_login_from_provider(&msg.provider) {
                    return MessageResult(LoginResult::AuthFromProviderForbidden);
--- a/src/controllers/login_controller.rs
+++ b/src/controllers/login_controller.rs
@@ -49,6 +49,7 @@ impl Default for BaseLoginPage {
 struct LoginTemplate {
    p: BaseLoginPage,
    login: String,
+    show_local_login: bool,
    providers: Vec<Provider>,
 }

@@ -156,8 +157,10 @@ pub async fn login_route(
            "Given login could not be processed, because it has an invalid format!".to_string(),
        );
    }
-    // Try to authenticate user
-    else if let Some(req) = &req {
+    // Try to authenticate user (local login)
+    else if let Some(req) = &req
+        && !AppConfig::get().disable_local_login
+    {
        login.clone_from(&req.login);
        let response: LoginResult = users
            .send(users_actor::LocalLoginRequest {
@@ -224,6 +227,10 @@ pub async fn login_route(
            }
        }
    }
+    // If there is only a single provider, trigger auto-login
+    else if AppConfig::get().disable_local_login && providers.len() == 1 {
+        return redirect_user(&providers.cloned()[0].login_url(&query.redirect));
+    }

    HttpResponse::Ok().content_type("text/html").body(
        LoginTemplate {
@@ -235,6 +242,7 @@ pub async fn login_route(
                ..Default::default()
            },
            login,
+            show_local_login: !AppConfig::get().disable_local_login,
            providers: providers.cloned(),
        }
        .render()
--- a/src/controllers/providers_controller.rs
+++ b/src/controllers/providers_controller.rs
@@ -1,11 +1,5 @@
 use std::sync::Arc;

-use actix::Addr;
-use actix_identity::Identity;
-use actix_remote_ip::RemoteIP;
-use actix_web::{HttpRequest, HttpResponse, Responder, web};
-use askama::Template;
-
 use crate::actors::bruteforce_actor::BruteForceActor;
 use crate::actors::providers_states_actor::{ProviderLoginState, ProvidersStatesActor};
 use crate::actors::users_actor::{LoginResult, UsersActor};
@@ -18,6 +12,11 @@ use crate::data::login_redirect::LoginRedirect;
 use crate::data::provider::{ProviderID, ProvidersManager};
 use crate::data::provider_configuration::ProviderConfigurationHelper;
 use crate::data::session_identity::{SessionIdentity, SessionStatus};
+use actix::Addr;
+use actix_identity::Identity;
+use actix_remote_ip::RemoteIP;
+use actix_web::{HttpRequest, HttpResponse, Responder, web};
+use askama::Template;

 #[derive(askama::Template)]
 #[template(path = "login/prov_login_error.html")]
@@ -273,7 +272,7 @@ pub async fn finish_login(
    }

    // Check if email was provided by the userinfo endpoint
-    let email = match user_info.email {
+    let email = match &user_info.email {
        Some(e) => e,
        None => {
            logger.log(Action::ProviderMissingEmailInResponse {
@@ -293,6 +292,7 @@ pub async fn finish_login(
    let result: LoginResult = users
        .send(users_actor::ProviderLoginRequest {
            email: email.clone(),
+            user_info: user_info.clone(),
            provider: provider.clone(),
        })
        .await
@@ -300,6 +300,13 @@ pub async fn finish_login(

    let user = match result {
        LoginResult::Success(u) => u,
+        LoginResult::AccountAutoCreated(u) => {
+            logger.log(Action::ProviderAccountAutoCreated {
+                provider: &provider,
+                user: u.loggable(),
+            });
+            u
+        }
        LoginResult::AccountNotFound => {
            logger.log(Action::ProviderAccountNotFound {
                provider: &provider,
--- a/src/controllers/settings_controller.rs
+++ b/src/controllers/settings_controller.rs
@@ -18,6 +18,7 @@ pub(crate) struct BaseSettingsPage<'a> {
    pub success_message: Option<String>,
    pub page_title: &'static str,
    pub app_name: &'static str,
+    pub local_login_enabled: bool,
    pub user: &'a User,
    pub version: &'static str,
    pub ip_location_api: Option<&'static str>,
@@ -37,6 +38,7 @@ impl<'a> BaseSettingsPage<'a> {
            app_name: APP_NAME,
            user,
            version: env!("CARGO_PKG_VERSION"),
+            local_login_enabled: !AppConfig::get().disable_local_login,
            ip_location_api: AppConfig::get().ip_location_service.as_deref(),
        }
    }
--- a/src/controllers/two_factor_api.rs
+++ b/src/controllers/two_factor_api.rs
@@ -1,6 +1,5 @@
 use actix::Addr;
 use actix_web::{HttpResponse, Responder, web};
-use uuid::Uuid;
 use webauthn_rs::prelude::RegisterPublicKeyCredential;

 use crate::actors::users_actor;
@@ -53,7 +52,7 @@ pub async fn save_totp_factor(
    }

    let factor = TwoFactor {
-        id: FactorID(Uuid::new_v4().to_string()),
+        id: FactorID::random(),
        name: factor_name,
        kind: TwoFactorType::TOTP(key),
    };
@@ -102,7 +101,7 @@ pub async fn save_webauthn_factor(
    };

    let factor = TwoFactor {
-        id: FactorID(Uuid::new_v4().to_string()),
+        id: FactorID::random(),
        name: factor_name,
        kind: TwoFactorType::WEBAUTHN(Box::new(key)),
    };
--- a/src/data/action_logger.rs
+++ b/src/data/action_logger.rs
@@ -150,6 +150,10 @@ pub enum Action<'a> {
        provider: &'a Provider,
        email: &'a str,
    },
+    ProviderAccountAutoCreated {
+        provider: &'a Provider,
+        user: LoggableUser,
+    },
    ProviderAccountDisabled {
        provider: &'a Provider,
        email: &'a str,
@@ -282,6 +286,11 @@ impl Action<'_> {
                "could not login using provider {} because the email {email} could not be associated to any account!",
                &provider.id.0
            ),
+            Action::ProviderAccountAutoCreated { provider, user } => format!(
+                "triggered automatic account creation for {} from provider {} because it was not found in local accounts list!",
+                user.quick_identity(),
+                &provider.id.0
+            ),
            Action::ProviderAccountDisabled { provider, email } => format!(
                "could not login using provider {} because the account associated to the email {email} is disabled!",
                &provider.id.0
--- a/src/data/app_config.rs
+++ b/src/data/app_config.rs
@@ -62,6 +62,11 @@ pub struct AppConfig {
    /// Login background image
    #[arg(long, env, default_value = "/assets/img/forest.jpg")]
    pub login_background_image: String,
+
+    /// Disable local login. If this option is set without any upstream providers set, it will be impossible
+    /// to authenticate
+    #[arg(long, env)]
+    pub disable_local_login: bool,
 }

 lazy_static::lazy_static! {
--- a/src/data/provider.rs
+++ b/src/data/provider.rs
@@ -26,6 +26,10 @@ pub struct Provider {
    ///
    /// (.well-known/openid-configuration endpoint)
    pub configuration_url: String,
+
+    /// Set to true if accounts on BasicOIDC should be automatically created from this provider
+    #[serde(default)]
+    pub allow_auto_account_creation: bool,
 }

 impl Provider {
@@ -42,6 +46,7 @@ impl Provider {
            "github" => "/assets/img/brands/github.svg",
            "microsoft" => "/assets/img/brands/microsoft.svg",
            "google" => "/assets/img/brands/google.svg",
+            "openid" => "/assets/img/brands/openid.svg",
            s => s,
        }
    }
--- a/src/data/session_identity.rs
+++ b/src/data/session_identity.rs
@@ -5,20 +5,15 @@ use serde::{Deserialize, Serialize};
 use crate::data::user::{User, UserID};
 use crate::utils::time::time;

-#[derive(Debug, Serialize, Deserialize, Eq, PartialEq)]
+#[derive(Debug, Serialize, Deserialize, Eq, PartialEq, Default)]
 pub enum SessionStatus {
+    #[default]
    Invalid,
    SignedIn,
    NeedNewPassword,
    Need2FA,
 }

-impl Default for SessionStatus {
-    fn default() -> Self {
-        Self::Invalid
-    }
-}
-
 #[derive(Debug, Serialize, Deserialize, Default)]
 pub struct SessionIdentityData {
    pub id: Option<UserID>,
--- a/src/data/user.rs
+++ b/src/data/user.rs
@@ -14,6 +14,12 @@ use crate::utils::time::{fmt_time, time};
 #[derive(Clone, Debug, Eq, PartialEq, serde::Serialize, serde::Deserialize, Encode, Decode)]
 pub struct UserID(pub String);

+impl UserID {
+    pub fn random() -> Self {
+        Self(uuid::Uuid::new_v4().to_string())
+    }
+}
+
 #[derive(Debug, Clone)]
 pub struct GeneralSettings {
    pub uid: UserID,
@@ -46,6 +52,12 @@ impl GrantedClients {
 #[derive(Clone, Debug, Eq, PartialEq, serde::Serialize, serde::Deserialize)]
 pub struct FactorID(pub String);

+impl FactorID {
+    pub fn random() -> Self {
+        Self(uuid::Uuid::new_v4().to_string())
+    }
+}
+
 #[derive(Clone, Debug, serde::Serialize, serde::Deserialize)]
 pub enum TwoFactorType {
    TOTP(TotpKey),
@@ -295,7 +307,7 @@ impl Eq for User {}
 impl Default for User {
    fn default() -> Self {
        Self {
-            uid: UserID(uuid::Uuid::new_v4().to_string()),
+            uid: UserID::random(),
            first_name: "".to_string(),
            last_name: "".to_string(),
            username: "".to_string(),
--- a/src/data/users_file_entity.rs
+++ b/src/data/users_file_entity.rs
@@ -71,7 +71,7 @@ impl UsersSyncBackend for EntityManager<User> {

    fn create_user_account(&mut self, settings: GeneralSettings) -> Res<UserID> {
        let mut user = User {
-            uid: UserID(uuid::Uuid::new_v4().to_string()),
+            uid: UserID::random(),
            ..Default::default()
        };
        user.update_general_settings(settings);
--- a/templates/login/login.html
+++ b/templates/login/login.html
@@ -18,6 +18,8 @@

 </style>

+<!-- Local login -->
+{% if show_local_login %}
 <form action="/login?redirect={{ p.redirect_uri.get_encoded() }}" method="post">
    <div>
        <div class="form-floating">
@@ -36,6 +38,7 @@
    <button class="w-100 btn btn-lg btn-primary" type="submit">Sign in</button>

 </form>
+{% endif %}

 <!-- Upstream providers -->
 {% if !providers.is_empty() %}
--- a/templates/settings/base_settings_page.html
+++ b/templates/settings/base_settings_page.html
@@ -24,7 +24,7 @@
                Account details
            </a>
        </li>
-        {% if p.user.allow_local_login %}
+        {% if p.user.allow_local_login && p.local_login_enabled %}
        <li>
            <a href="/settings/change_password" class="nav-link link-dark">
                Change password
--- a/templates/settings/clients_list.html
+++ b/templates/settings/clients_list.html
@@ -1,7 +1,7 @@
 {% extends "base_settings_page.html" %}
 {% block content %}

-<table class="table table-hover" style="max-width: 800px;" aria-describedby="Clients list">
+<table class="table table-hover table-break-works" style="max-width: 800px;" aria-describedby="Clients list">
    <thead>
    <tr>
        <th scope="col">ID</th>
Author	SHA1	Message	Date
Renovate Bot	1901238f87	Merge pull request 'Update Rust crate clap to 4.5.53' (#443 ) from renovate/clap-4.x into master Some checks failed continuous-integration/drone/push Build is failing Details	2025-11-21 00:06:51 +00:00
Renovate Bot	088d682b31	Update Rust crate clap to 4.5.53 Some checks failed continuous-integration/drone/push Build is failing Details continuous-integration/drone/pr Build is failing Details	2025-11-20 00:06:35 +00:00
Renovate Bot	02c7f764f5	Merge pull request 'Update Rust crate actix-web to 4.12.0' (#442 ) from renovate/actix-web-4.x into master Some checks failed continuous-integration/drone/push Build is failing Details	2025-11-18 00:07:30 +00:00
Renovate Bot	7b8412682d	Update Rust crate actix-web to 4.12.0 Some checks failed continuous-integration/drone/push Build is failing Details continuous-integration/drone/pr Build is failing Details	2025-11-17 00:07:08 +00:00
Pierre HUBERT	5a05b547a8	Fix cargo clippy issue All checks were successful continuous-integration/drone/push Build is passing Details	2025-11-03 22:23:32 +01:00
Renovate Bot	da2aa8aac2	Merge pull request 'Update Rust crate lazy-regex to 3.4.2' (#441 ) from renovate/lazy-regex-3.x into master Some checks failed continuous-integration/drone/push Build is failing Details	2025-11-02 00:06:57 +00:00
Renovate Bot	bc453cfd26	Update Rust crate lazy-regex to 3.4.2 Some checks failed continuous-integration/drone/push Build is failing Details continuous-integration/drone/pr Build is failing Details	2025-11-01 00:07:09 +00:00
Renovate Bot	4b26a0ea12	Merge pull request 'Update Rust crate jwt-simple to 0.12.13' (#440 ) from renovate/jwt-simple-0.x into master Some checks failed continuous-integration/drone/push Build is failing Details	2025-11-01 00:06:34 +00:00
Renovate Bot	242d725ad0	Update Rust crate jwt-simple to 0.12.13 Some checks failed continuous-integration/drone/push Build is passing Details continuous-integration/drone/pr Build is failing Details	2025-10-31 00:33:01 +00:00
Renovate Bot	ce4317299e	Merge pull request 'Update Rust crate clap to 4.5.51' (#439 ) from renovate/clap-4.x into master All checks were successful continuous-integration/drone/push Build is passing Details	2025-10-31 00:31:57 +00:00
Renovate Bot	14ede196c4	Update Rust crate clap to 4.5.51 All checks were successful continuous-integration/drone/push Build is passing Details continuous-integration/drone/pr Build is passing Details	2025-10-30 00:35:05 +00:00
Pierre HUBERT	6d341069a0	Fix appearance issue in clients list screen with long client ids All checks were successful continuous-integration/drone/push Build is passing Details	2025-10-29 12:34:47 +01:00
Pierre HUBERT	d4de81f1fb	Can disable local login All checks were successful continuous-integration/drone/push Build is passing Details	2025-10-29 12:20:05 +01:00
Pierre HUBERT	9a599fdde2	Can create accounts automatically for a given upstream provider All checks were successful continuous-integration/drone/push Build is passing Details	2025-10-29 11:30:45 +01:00
Pierre HUBERT	764ad3d5a1	Add sample upstream provider	2025-10-29 09:34:10 +01:00
				`@@ -0,0 +1 @@`
				`<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>OpenID</title><path d="M14.54.889l-3.63 1.773v18.17c-4.15-.52-7.27-2.78-7.27-5.5 0-2.58 2.8-4.75 6.63-5.41v-2.31C4.42 8.322 0 11.502 0 15.332c0 3.96 4.74 7.24 10.91 7.78l3.63-1.71V.888m.64 6.724v2.31c1.43.25 2.71.7 3.76 1.31l-1.97 1.11 7.03 1.53-.5-5.21-1.87 1.06c-1.74-1.06-3.96-1.81-6.45-2.11z"/></svg>`