9d2e6f30a7
OIDC provider settings (issuer, client ID/secret, roles claim) are now stored in ClickHouse and managed via admin REST API at /api/v1/admin/oidc. This allows runtime configuration from the UI without server restarts. - New oidc_config table (ReplacingMergeTree, singleton row) - OidcConfig record + OidcConfigRepository interface in core - ClickHouseOidcConfigRepository implementation - OidcConfigAdminController: GET/PUT/DELETE config, POST test connectivity, client_secret masked in responses - OidcTokenExchanger: reads config from DB, invalidateCache() on config change - OidcAuthController: always registered (no @ConditionalOnProperty), returns 404 when OIDC not configured - Startup seeder: env vars seed DB on first boot only, then admin API takes over - HOWTO.md updated with admin OIDC config API examples Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
12 lines
473 B
SQL
12 lines
473 B
SQL
CREATE TABLE IF NOT EXISTS oidc_config (
|
|
config_id String DEFAULT 'default',
|
|
enabled Bool DEFAULT false,
|
|
issuer_uri String DEFAULT '',
|
|
client_id String DEFAULT '',
|
|
client_secret String DEFAULT '',
|
|
roles_claim String DEFAULT 'realm_access.roles',
|
|
default_roles Array(LowCardinality(String)),
|
|
updated_at DateTime64(3, 'UTC') DEFAULT now64(3, 'UTC')
|
|
) ENGINE = ReplacingMergeTree(updated_at)
|
|
ORDER BY (config_id);
|