Debian 3a707e2e3f feat(auth): OIDC/Keycloak SSO-Login (additiv) — v1.2.91 ...

SSO per OpenID Connect (Authorization Code + PKCE) zusätzlich zum lokalen Login.
- Regeln: kein Auto-Provisioning (E-Mail muss als User existieren), Rolle aus DB (nie aus Token), lokaler Login+TOTP unangetastet.
- Migration 0040: oidc_settings (Singleton, client_secret_enc via secrets.Box) + users.oidc_subject.
- internal/services/oidc: Settings-Repo (write-only Secret) + lazy go-oidc Client (testbarer Authenticator-Seam).
- internal/handlers/oidc.go: GET/PUT /oidc/settings (admin), GET /auth/oidc/{settings,login,callback}. Flow-State (state/PKCE/nonce) stateless im 5-min signierten HttpOnly-Cookie (SameSite=Lax). email_verified erzwungen, opportunistisches sub-Linking, Session via setSessionCookie+Signer.
- session.SignBlob/VerifyBlob; users.Get/SetOIDCSubject; main.go-Wiring.
- Frontend: App.tsx /auth/me-Bootstrap (für Cookie-Session nach Callback), Login-SSO-Button + sso_error, Settings OIDC-Card, i18n de/en.
- Tests (guarded EG_FWTEST_DSN): Secret-Roundtrip + Callback (Rolle-aus-DB, no_account, disabled, unverified, nonce, state).
Deps: go-oidc/v3, x/oauth2. Scope v1: nur Login (kein SLO/Refresh).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-05 16:04:13 +02:00

..

response

fix(backends): Backend-Löschen verweigern wenn Routing-Regeln darauf zeigen (v1.1.142)

2026-05-29 07:15:16 +02:00

.gitkeep

chore: initial skeleton

2026-05-08 18:45:41 +02:00

acme_test.go

feat(acme): (b) HTTP-01 Webroot-Handler in der API

2026-05-09 11:24:42 +02:00

acme.go

feat(acme): (b) HTTP-01 Webroot-Handler in der API

2026-05-09 11:24:42 +02:00

alerts.go

feat(alerts): Health-Alarme via Webhook + Email-SMTP

2026-05-13 15:57:05 +02:00

audit.go

feat: umfangreiches UI+API-Polish (v1.1.36–1.1.42)

2026-05-19 16:18:41 +02:00

auth.go

feat: HA-Cluster v1.2.x — Split-Brain, TOTP, Enterprise-FW, Drift-Fix, VIP-Recovery

2026-05-31 18:18:31 +02:00

backend_servers.go

feat(backends): Pool-Modell — Backend = Pool, N Server pro Backend

2026-05-11 20:55:47 +02:00

backends.go

fix(backends): Backend-Löschen verweigern wenn Routing-Regeln darauf zeigen (v1.1.142)

2026-05-29 07:15:16 +02:00

backup_remotes.go

feat(backup): Off-Site-Upload nach S3 + SFTP

2026-05-13 18:49:02 +02:00

backup.go

feat(backup): Restore-Pfad — POST /backups/:id/restore + UI

2026-05-12 23:22:55 +02:00

cluster_certsync.go

feat: HA-Cluster v1.2.x — Split-Brain, TOTP, Enterprise-FW, Drift-Fix, VIP-Recovery

2026-05-31 18:18:31 +02:00

cluster_repair.go

fix(cluster): Repair-Rollenerkennung über pg_publication statt ha_nodes.role — v1.2.88

2026-06-04 13:18:54 +02:00

cluster_rollingupdate.go

fix(rolling-update): stable done-detection, mobile banner layout, stale-state protection

2026-05-30 12:56:20 +02:00

cluster_viptest.go

feat: HA-Cluster v1.2.x — Split-Brain, TOTP, Enterprise-FW, Drift-Fix, VIP-Recovery

2026-05-31 18:18:31 +02:00

cluster.go

feat(cluster): GUI-Repair-Button für Config-Drift + Stale-Chunk-Auto-Reload — v1.2.86

2026-06-04 12:10:41 +02:00

crowdsec.go

feat(crowdsec): CrowdSec IDS/IPS Management — v1.2.61

2026-06-01 20:25:48 +02:00

diagnostics.go

feat(diagnostics): UI-Tools — ping/traceroute/dig/curl/tcp

2026-05-13 15:30:07 +02:00

dns.go

feat: HA-Cluster v1.2.x — Split-Brain, TOTP, Enterprise-FW, Drift-Fix, VIP-Recovery

2026-05-31 18:18:31 +02:00

domains.go

fix(api): WireGuard Private-Key-Verlust bei Peer-Update + Domain-Header-Ownership

2026-05-24 12:59:13 +02:00

firewall_counters_test.go

feat(firewall): nftables hit-counter pro Regel + Live-Hits-Spalte in der UI

2026-05-21 08:42:31 +02:00

firewall_counters.go

feat(firewall): nftables hit-counter pro Regel + Live-Hits-Spalte in der UI

2026-05-21 08:42:31 +02:00

firewall_log.go

feat(firewall-log): Phase 2 — HTTP-Tail + WebSocket-Live-Stream

2026-05-12 21:05:39 +02:00

firewall.go

feat(firewall): Inline-Note + Labels direkt in der Tabelle

2026-05-31 18:46:54 +02:00

forwardproxy.go

feat: HA-Cluster v1.2.x — Split-Brain, TOTP, Enterprise-FW, Drift-Fix, VIP-Recovery

2026-05-31 18:18:31 +02:00

haproxy_stats.go

fix(haproxy-stats): filter internal backends from stats response

2026-05-27 18:48:04 +02:00

ipaddresses.go

fix(network): context.Background() für applyAsync + StartLimitIntervalSec=0

2026-05-30 13:41:29 +02:00

license.go

feat(license): Lizenz-System mit Ed25519-Verify gegen license.netcell-it.com

2026-05-11 13:41:16 +02:00

logs.go

feat(logs): Phase 4 — zentrales Logsystem /api/v1/logs + /system/logs

2026-05-12 21:29:38 +02:00

middleware.go

feat(rbac): Viewer-Rolle durchsetzen — alle Mutations nur für Admins

2026-05-23 16:57:17 +02:00

networks.go

fix(network): context.Background() für applyAsync + StartLimitIntervalSec=0

2026-05-30 13:41:29 +02:00

ntp.go

fix(audit): fehlende Audit-Logs für DNS-Zone/Record-Delete + NTP-Pool-Delete

2026-05-28 14:57:35 +02:00

oidc_test.go

feat(auth): OIDC/Keycloak SSO-Login (additiv) — v1.2.91

2026-06-05 16:04:13 +02:00

oidc.go

feat(auth): OIDC/Keycloak SSO-Login (additiv) — v1.2.91

2026-06-05 16:04:13 +02:00

routes.go

feat(routes): Static-Routes-Management + Live-View (Networks-Tab)

2026-05-12 23:50:26 +02:00

routingrules.go

feat(api): Auto-Reload HAProxy bei Domain/Backend/Routing-Mutation

2026-05-10 18:23:18 +02:00

setup.go

feat(cluster): startup peer-sync + stable primary-ID in ha_nodes

2026-05-29 17:45:26 +02:00

system.go

feat(waf): Phase 4 — Packaging, CRS, systemd, sudoers — v1.2.69

2026-06-02 16:03:37 +02:00

tlscerts.go

feat(ssl): TLS-Cert-Verwaltung in der GUI — Let's Encrypt + eigenes PEM

2026-05-09 21:49:14 +02:00

users.go

feat: HA-Cluster v1.2.x — Split-Brain, TOTP, Enterprise-FW, Drift-Fix, VIP-Recovery

2026-05-31 18:18:31 +02:00

waf.go

feat(waf): Ausnahmen mit Notiz + Ausnahmen-Liste im Drawer — v1.2.79

2026-06-03 11:31:49 +02:00

wireguard.go

feat(wireguard): selektiver .conf-Import — Auswahl einzelner Interfaces per Modal

2026-05-24 22:09:37 +02:00