strapi-plugin-oidc 1.9.3 → 1.9.4

package/README.md

@@ -32,7 +32,7 @@ module.exports = ({ env }) => ({
     enabled: true,
     config: {
       // Required
-      OIDC_DISCOVERY_URL: env('OIDC_DISCOVERY_URL'), // https://your-provider/.well-known/openid-configuration
+      OIDC_ISSUER: env('OIDC_ISSUER'), // https://your-provider or https://your-provider/realms/your-realm
       OIDC_CLIENT_ID: env('OIDC_CLIENT_ID'),
       OIDC_CLIENT_SECRET: env('OIDC_CLIENT_SECRET'),
       OIDC_REDIRECT_URI: env('OIDC_REDIRECT_URI'), // https://your-strapi.com/strapi-plugin-oidc/oidc/callback
@@ -55,7 +55,7 @@ module.exports = ({ env }) => ({
 });
 ```
 
-`OIDC_DISCOVERY_URL` is the URL of your provider's OpenID Connect discovery document (`/.well-known/openid-configuration`). The plugin fetches it at startup and automatically configures all endpoints, JWKS URI, and issuer.
+`OIDC_ISSUER` is your provider's issuer URL (e.g. `https://auth.example.com` or `https://auth.example.com/realms/myrealm`). The plugin appends `/.well-known/openid-configuration` automatically if not present, and fetches the discovery document at startup to configure all endpoints, JWKS URI, and canonical issuer.
 
 ### Security features
 

package/dist/server/index.js

@@ -102,7 +102,6 @@ const coerceBoolNullable = zod.z.preprocess(
 );
 const pluginConfigSchema = zod.z.object({
   REMEMBER_ME: coerceBool(false),
-  OIDC_DISCOVERY_URL: zod.z.string().default(""),
   OIDC_REDIRECT_URI: zod.z.string().default(""),
   OIDC_CLIENT_ID: zod.z.string().default(""),
   OIDC_CLIENT_SECRET: zod.z.string().default(""),
@@ -172,6 +171,7 @@ const CACHE_TTL = {
 const DEFAULT_RETENTION_DAYS = 90;
 const DAY_MS = 864e5;
 const DISCOVERY_TIMEOUT_MS = 5e3;
+const OIDC_DISCOVERY_PATH = "/.well-known/openid-configuration";
 const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function getPluginConfig() {
   return pluginConfigSchema.parse(strapi.config.get("plugin::strapi-plugin-oidc") ?? {});
@@ -198,7 +198,6 @@ const discoveryDocumentSchema = zod.z.object({
   jwks_uri: zod.z.string().optional()
 }).passthrough();
 const FIELD_MAP = [
-  ["issuer", "OIDC_ISSUER"],
   ["authorization_endpoint", "OIDC_AUTHORIZATION_ENDPOINT"],
   ["token_endpoint", "OIDC_TOKEN_ENDPOINT"],
   ["userinfo_endpoint", "OIDC_USERINFO_ENDPOINT"],
@@ -207,8 +206,17 @@ const FIELD_MAP = [
 ];
 async function applyDiscovery(strapi2) {
   const config2 = strapi2.config.get("plugin::strapi-plugin-oidc");
-  const discoveryUrl = config2.OIDC_DISCOVERY_URL;
-  if (!discoveryUrl) return;
+  const issuer = config2.OIDC_ISSUER;
+  if (!issuer) return;
+  let discoveryUrl;
+  let canonicalIssuer;
+  if (issuer.includes(OIDC_DISCOVERY_PATH)) {
+    discoveryUrl = issuer;
+    canonicalIssuer = issuer.replace(OIDC_DISCOVERY_PATH, "");
+  } else {
+    discoveryUrl = issuer.replace(/\/$/, "") + OIDC_DISCOVERY_PATH;
+    canonicalIssuer = issuer.replace(/\/$/, "");
+  }
   let doc;
   try {
     const res = await fetch(discoveryUrl, { signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS) });
@@ -222,13 +230,13 @@ async function applyDiscovery(strapi2) {
     );
     return;
   }
-  const updates = {};
+  const updates = { OIDC_ISSUER: canonicalIssuer };
   for (const [docField, configKey] of FIELD_MAP) {
     if (doc[docField]) {
       updates[configKey] = doc[docField];
     }
   }
-  if (Object.keys(updates).length > 0) {
+  if (Object.keys(updates).length > 1) {
     strapi2.config.set("plugin::strapi-plugin-oidc", { ...config2, ...updates });
     strapi2.log.info(`[strapi-plugin-oidc] Discovery applied: ${Object.keys(updates).join(", ")}`);
   }
@@ -385,7 +393,6 @@ function destroy() {
 const config = {
   default: {
     REMEMBER_ME: false,
-    OIDC_DISCOVERY_URL: "",
     OIDC_REDIRECT_URI: "http://localhost:1337/strapi-plugin-oidc/oidc/callback",
     OIDC_CLIENT_ID: "",
     OIDC_CLIENT_SECRET: "",
@@ -401,7 +408,7 @@ const config = {
     OIDC_REQUIRE_EMAIL_VERIFIED: true,
     OIDC_TRUSTED_IP_HEADER: "",
     OIDC_FORCE_SECURE_COOKIES: false,
-    // Populated at bootstrap from OIDC_DISCOVERY_URL — not user-configurable directly
+    // Populated at bootstrap from OIDC_ISSUER — not user-configurable directly
     OIDC_AUTHORIZATION_ENDPOINT: "",
     OIDC_TOKEN_ENDPOINT: "",
     OIDC_USERINFO_ENDPOINT: "",
@@ -522,14 +529,14 @@ function toMessage(e) {
   return e instanceof Error ? e.message : String(e);
 }
 const REQUIRED_CONFIG_KEYS = [
-  "OIDC_DISCOVERY_URL",
+  "OIDC_ISSUER",
   "OIDC_CLIENT_ID",
   "OIDC_CLIENT_SECRET",
   "OIDC_REDIRECT_URI",
   "OIDC_SCOPE",
   "OIDC_FAMILY_NAME_FIELD",
   "OIDC_GIVEN_NAME_FIELD",
-  // Populated at bootstrap from OIDC_DISCOVERY_URL — checked here as a runtime safety net
+  // Populated at bootstrap from OIDC_ISSUER — checked here as a runtime safety net
   "OIDC_TOKEN_ENDPOINT",
   "OIDC_USERINFO_ENDPOINT",
   "OIDC_AUTHORIZATION_ENDPOINT"

package/dist/server/index.mjs

@@ -96,7 +96,6 @@ const coerceBoolNullable = z.preprocess(
 );
 const pluginConfigSchema = z.object({
   REMEMBER_ME: coerceBool(false),
-  OIDC_DISCOVERY_URL: z.string().default(""),
   OIDC_REDIRECT_URI: z.string().default(""),
   OIDC_CLIENT_ID: z.string().default(""),
   OIDC_CLIENT_SECRET: z.string().default(""),
@@ -166,6 +165,7 @@ const CACHE_TTL = {
 const DEFAULT_RETENTION_DAYS = 90;
 const DAY_MS = 864e5;
 const DISCOVERY_TIMEOUT_MS = 5e3;
+const OIDC_DISCOVERY_PATH = "/.well-known/openid-configuration";
 const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function getPluginConfig() {
   return pluginConfigSchema.parse(strapi.config.get("plugin::strapi-plugin-oidc") ?? {});
@@ -192,7 +192,6 @@ const discoveryDocumentSchema = z.object({
   jwks_uri: z.string().optional()
 }).passthrough();
 const FIELD_MAP = [
-  ["issuer", "OIDC_ISSUER"],
   ["authorization_endpoint", "OIDC_AUTHORIZATION_ENDPOINT"],
   ["token_endpoint", "OIDC_TOKEN_ENDPOINT"],
   ["userinfo_endpoint", "OIDC_USERINFO_ENDPOINT"],
@@ -201,8 +200,17 @@ const FIELD_MAP = [
 ];
 async function applyDiscovery(strapi2) {
   const config2 = strapi2.config.get("plugin::strapi-plugin-oidc");
-  const discoveryUrl = config2.OIDC_DISCOVERY_URL;
-  if (!discoveryUrl) return;
+  const issuer = config2.OIDC_ISSUER;
+  if (!issuer) return;
+  let discoveryUrl;
+  let canonicalIssuer;
+  if (issuer.includes(OIDC_DISCOVERY_PATH)) {
+    discoveryUrl = issuer;
+    canonicalIssuer = issuer.replace(OIDC_DISCOVERY_PATH, "");
+  } else {
+    discoveryUrl = issuer.replace(/\/$/, "") + OIDC_DISCOVERY_PATH;
+    canonicalIssuer = issuer.replace(/\/$/, "");
+  }
   let doc;
   try {
     const res = await fetch(discoveryUrl, { signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS) });
@@ -216,13 +224,13 @@ async function applyDiscovery(strapi2) {
     );
     return;
   }
-  const updates = {};
+  const updates = { OIDC_ISSUER: canonicalIssuer };
   for (const [docField, configKey] of FIELD_MAP) {
     if (doc[docField]) {
       updates[configKey] = doc[docField];
     }
   }
-  if (Object.keys(updates).length > 0) {
+  if (Object.keys(updates).length > 1) {
     strapi2.config.set("plugin::strapi-plugin-oidc", { ...config2, ...updates });
     strapi2.log.info(`[strapi-plugin-oidc] Discovery applied: ${Object.keys(updates).join(", ")}`);
   }
@@ -379,7 +387,6 @@ function destroy() {
 const config = {
   default: {
     REMEMBER_ME: false,
-    OIDC_DISCOVERY_URL: "",
     OIDC_REDIRECT_URI: "http://localhost:1337/strapi-plugin-oidc/oidc/callback",
     OIDC_CLIENT_ID: "",
     OIDC_CLIENT_SECRET: "",
@@ -395,7 +402,7 @@ const config = {
     OIDC_REQUIRE_EMAIL_VERIFIED: true,
     OIDC_TRUSTED_IP_HEADER: "",
     OIDC_FORCE_SECURE_COOKIES: false,
-    // Populated at bootstrap from OIDC_DISCOVERY_URL — not user-configurable directly
+    // Populated at bootstrap from OIDC_ISSUER — not user-configurable directly
     OIDC_AUTHORIZATION_ENDPOINT: "",
     OIDC_TOKEN_ENDPOINT: "",
     OIDC_USERINFO_ENDPOINT: "",
@@ -516,14 +523,14 @@ function toMessage(e) {
   return e instanceof Error ? e.message : String(e);
 }
 const REQUIRED_CONFIG_KEYS = [
-  "OIDC_DISCOVERY_URL",
+  "OIDC_ISSUER",
   "OIDC_CLIENT_ID",
   "OIDC_CLIENT_SECRET",
   "OIDC_REDIRECT_URI",
   "OIDC_SCOPE",
   "OIDC_FAMILY_NAME_FIELD",
   "OIDC_GIVEN_NAME_FIELD",
-  // Populated at bootstrap from OIDC_DISCOVERY_URL — checked here as a runtime safety net
+  // Populated at bootstrap from OIDC_ISSUER — checked here as a runtime safety net
   "OIDC_TOKEN_ENDPOINT",
   "OIDC_USERINFO_ENDPOINT",
   "OIDC_AUTHORIZATION_ENDPOINT"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "strapi-plugin-oidc",
-  "version": "1.9.3",
+  "version": "1.9.4",
   "description": "A Strapi plugin that provides OpenID Connect (OIDC) authentication functionality for the Strapi Admin Panel.",
   "strapi": {
     "displayName": "OIDC Plugin",