simple-module-oidc 0.0.43__py3-none-any.whl

oidc/__init__.py

@@ -0,0 +1 @@
+"""Generic OIDC authentication provider for simple_module (Entra, Auth0, Okta, ...)."""

oidc/client.py

@@ -0,0 +1,138 @@
+"""OIDC client -- authorization URL, code exchange, and logout.
+
+Endpoint-driven: the authorize/token/end-session URLs come from the discovery
+document, so this client is provider-agnostic.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import secrets
+from typing import Any
+from urllib.parse import quote_plus, urlencode
+
+import httpx
+from auth.oidc_common.session import pkce_challenge
+
+# Revocation runs inside the logout request: a hung IdP must not hold it long.
+_REVOKE_TIMEOUT_SECONDS = 3
+
+
+class OIDCClient:
+    """Thin wrapper around a provider's discovered OIDC endpoints."""
+
+    def __init__(
+        self,
+        *,
+        authorization_endpoint: str,
+        token_endpoint: str,
+        end_session_endpoint: str,
+        client_id: str,
+        client_secret: str,
+        revocation_endpoint: str = "",
+        token_endpoint_auth_methods_supported: list[str] | None = None,
+        revocation_endpoint_auth_methods_supported: list[str] | None = None,
+    ) -> None:
+        self._authorization_endpoint = authorization_endpoint
+        self._token_endpoint = token_endpoint
+        self._end_session_endpoint = end_session_endpoint
+        self._client_id = client_id
+        self._client_secret = client_secret
+        self._revocation_endpoint = revocation_endpoint
+        self._token_endpoint_auth_methods_supported = token_endpoint_auth_methods_supported
+        # The revocation endpoint advertises its own methods; fall back to the token endpoint's.
+        self._revocation_endpoint_auth_methods_supported = (
+            revocation_endpoint_auth_methods_supported
+            if revocation_endpoint_auth_methods_supported is not None
+            else token_endpoint_auth_methods_supported
+        )
+
+    def build_authorization_url(
+        self,
+        redirect_uri: str,
+        nonce: str,
+        scope: str = "openid email profile",
+        *,
+        code_verifier: str,
+    ) -> tuple[str, str]:
+        state = secrets.token_urlsafe(32)
+        params = {
+            "client_id": self._client_id,
+            "redirect_uri": redirect_uri,
+            "response_type": "code",
+            "scope": scope,
+            "state": state,
+            "nonce": nonce,
+            "code_challenge_method": "S256",
+            "code_challenge": pkce_challenge(code_verifier),
+        }
+        separator = "&" if "?" in self._authorization_endpoint else "?"
+        url = f"{self._authorization_endpoint}{separator}{urlencode(params)}"
+        return url, state
+
+    async def exchange_code(
+        self, code: str, redirect_uri: str, *, code_verifier: str
+    ) -> dict[str, Any]:
+        return await self._token_request(
+            grant_type="authorization_code",
+            code=code,
+            code_verifier=code_verifier,
+            redirect_uri=redirect_uri,
+        )
+
+    def build_logout_url(
+        self,
+        post_logout_redirect_uri: str,
+    ) -> str:
+        """End-session URL. Falls back to the local redirect if the provider
+        does not advertise an ``end_session_endpoint``."""
+        if not self._end_session_endpoint:
+            return post_logout_redirect_uri
+        params = {
+            "post_logout_redirect_uri": post_logout_redirect_uri,
+            "client_id": self._client_id,
+        }
+        separator = "&" if "?" in self._end_session_endpoint else "?"
+        return f"{self._end_session_endpoint}{separator}{urlencode(params)}"
+
+    async def refresh_tokens(self, refresh_token: str) -> dict[str, Any]:
+        return await self._token_request(grant_type="refresh_token", refresh_token=refresh_token)
+
+    async def revoke_refresh_token(self, refresh_token: str) -> None:
+        if self._revocation_endpoint:
+            # httpx timeouts are per phase; bound the whole exchange too.
+            async with asyncio.timeout(_REVOKE_TIMEOUT_SECONDS):
+                await self._post(
+                    self._revocation_endpoint,
+                    self._revocation_endpoint_auth_methods_supported,
+                    {"token": refresh_token, "token_type_hint": "refresh_token"},
+                    timeout=_REVOKE_TIMEOUT_SECONDS,
+                )
+
+    async def _token_request(self, **grant: str) -> dict[str, Any]:
+        resp = await self._post(
+            self._token_endpoint, self._token_endpoint_auth_methods_supported, dict(grant)
+        )
+        return resp.json()
+
+    async def _post(
+        self,
+        endpoint: str,
+        methods: list[str] | None,
+        fields: dict[str, str],
+        *,
+        timeout: float = 10,
+    ) -> httpx.Response:
+        data = dict(fields)
+        extra: dict[str, Any] = {}
+        if methods is None or "client_secret_post" in methods:
+            data.update(client_id=self._client_id, client_secret=self._client_secret)
+        else:
+            # RFC 6749 requires form-encoding each credential before HTTP Basic encoding.
+            extra["auth"] = httpx.BasicAuth(
+                quote_plus(self._client_id), quote_plus(self._client_secret)
+            )
+        async with httpx.AsyncClient() as client:
+            resp = await client.post(endpoint, data=data, timeout=timeout, **extra)
+            resp.raise_for_status()
+            return resp

oidc/constants.py

@@ -0,0 +1,19 @@
+"""OIDC routes, page names and session keys."""
+
+_MODULE_AUTH = "Auth"
+_MODULE_SETTINGS = "Settings"
+_PAGE_LOGIN = "Oidc/Login"
+_PAGE_LOGGED_OUT = "Oidc/LoggedOut"
+LOGIN_PATH = "/oidc/login"
+LOGOUT_PATH = "/oidc/logout"
+LOGGED_OUT_PATH = "/oidc/logged-out"
+AUTH_LOGIN_PATH = "/api/oidc/auth/login"
+AUTH_CALLBACK_PATH = "/api/oidc/auth/callback"
+SESSION_STATE_KEY = "oidc_state"
+SESSION_NONCE_KEY = "oidc_nonce"
+SESSION_VERIFIER_KEY = "oidc_pkce_verifier"
+SESSION_USER_KEY = "user_ctx"
+SESSION_IDENTITY_KEY = "oidc_identity"
+SESSION_REFRESH_TOKEN_KEY = "oidc_refresh_token"
+SESSION_REFRESH_RETRY_AT_KEY = "oidc_refresh_retry_at"
+DEFAULT_LOGIN_REDIRECT_URL = "/dashboard/"

oidc/contracts/__init__.py

@@ -0,0 +1 @@
+"""OIDC module contracts."""

oidc/directory.py

@@ -0,0 +1,10 @@
+"""User directory over the provider's unchanged cache table."""
+
+from auth.oidc_common.directory import CacheDirectory
+
+from oidc.models import OidcUserCache
+
+
+class OidcDirectory(CacheDirectory):
+    def __init__(self) -> None:
+        super().__init__(OidcUserCache)

oidc/discovery.py

@@ -0,0 +1,103 @@
+"""Validated OIDC discovery metadata; endpoint hosts may legitimately differ."""
+
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass
+from typing import Any
+from urllib.parse import urlsplit
+
+import httpx
+
+logger = logging.getLogger(__name__)
+
+
+def _validate_url(value: object, *, development: bool) -> str:
+    if not isinstance(value, str) or not value or any(c.isspace() for c in value):
+        raise ValueError("OIDC metadata URL must be a non-empty URL")
+    parsed = urlsplit(value)
+    if (
+        parsed.scheme not in ({"https", "http"} if development else {"https"})
+        or not parsed.hostname
+        or parsed.username is not None
+        or parsed.password is not None
+        or parsed.fragment
+    ):
+        raise ValueError("OIDC metadata requires HTTPS URLs without credentials or fragments")
+    return value
+
+
+@dataclass(frozen=True)
+class OidcMetadata:
+    issuer: str
+    authorization_endpoint: str
+    token_endpoint: str
+    jwks_uri: str
+    end_session_endpoint: str = ""
+    revocation_endpoint: str = ""
+    token_endpoint_auth_methods_supported: list[str] | None = None
+    revocation_endpoint_auth_methods_supported: list[str] | None = None
+
+    @classmethod
+    def from_document(
+        cls, doc: dict, *, expected_issuer: str | None = None, development: bool = False
+    ) -> OidcMetadata:
+        if not isinstance(doc, dict):
+            raise ValueError("OIDC discovery document must be an object")
+        required = ("issuer", "authorization_endpoint", "token_endpoint", "jwks_uri")
+        missing = [key for key in required if not doc.get(key)]
+        if missing:
+            raise ValueError(
+                f"OIDC discovery document missing required fields: {', '.join(missing)}"
+            )
+        values: dict[str, Any] = {
+            key: _validate_url(doc[key], development=development) for key in required
+        }
+        issuer = urlsplit(values["issuer"])
+        if issuer.query or "{" in values["issuer"] or "}" in values["issuer"]:
+            raise ValueError("OIDC issuer must be concrete and have no query")
+        # Compared without one trailing slash: issuers such as Auth0's end in
+        # "/" while the discovery URL is built without it. Tokens are still
+        # validated against the issuer exactly as the document states it.
+        if expected_issuer is not None and values["issuer"].rstrip("/") != expected_issuer.rstrip(
+            "/"
+        ):
+            raise ValueError("OIDC discovery issuer does not match configured issuer")
+        logout = doc.get("end_session_endpoint", "")
+        values["end_session_endpoint"] = (
+            _validate_url(logout, development=development) if logout != "" else ""
+        )
+        # Optional extras must not take sign-in down: a malformed one is ignored
+        # (no revocation; the default client authentication) with a warning.
+        values["revocation_endpoint"] = ""
+        if doc.get("revocation_endpoint", "") != "":
+            try:
+                values["revocation_endpoint"] = _validate_url(
+                    doc["revocation_endpoint"], development=development
+                )
+            except ValueError:
+                logger.warning("Ignoring unusable OIDC revocation_endpoint in discovery")
+        for key in (
+            "token_endpoint_auth_methods_supported",
+            "revocation_endpoint_auth_methods_supported",
+        ):
+            methods = doc.get(key)
+            if methods is not None and (
+                not isinstance(methods, list) or not all(isinstance(m, str) for m in methods)
+            ):
+                logger.warning("Ignoring malformed OIDC %s in discovery", key)
+                methods = None
+            values[key] = methods
+        return cls(**values)
+
+
+async def fetch_metadata(
+    discovery_url: str, *, expected_issuer: str | None = None, development: bool = False
+) -> OidcMetadata:
+    _validate_url(discovery_url, development=development)
+    async with httpx.AsyncClient() as client:
+        resp = await client.get(discovery_url, timeout=10)
+        resp.raise_for_status()
+        return OidcMetadata.from_document(
+            resp.json(), expected_issuer=expected_issuer, development=development
+        )

oidc/endpoints/__init__.py

@@ -0,0 +1 @@
+"""OIDC endpoint routers."""

oidc/endpoints/api.py

@@ -0,0 +1,119 @@
+"""OIDC login transaction: PKCE, nonce, session rotation and bounded authority."""
+
+from __future__ import annotations
+
+import logging
+import secrets
+import time
+
+from auth.oidc_common.session import sign_in, stale_callback
+from fastapi import APIRouter, HTTPException, Request
+from starlette.responses import RedirectResponse
+
+from oidc.constants import (
+    SESSION_IDENTITY_KEY,
+    SESSION_NONCE_KEY,
+    SESSION_STATE_KEY,
+    SESSION_USER_KEY,
+    SESSION_VERIFIER_KEY,
+)
+from oidc.runtime import require_client
+from oidc.tokens import store_refresh_token
+
+logger = logging.getLogger(__name__)
+router = APIRouter(prefix="/auth", tags=["oidc-auth"])
+
+
+@router.get("/login", name="oidc_auth_login")
+async def oidc_login(request: Request):
+    client = await require_client(request)
+    nonce = secrets.token_urlsafe(32)
+    verifier = secrets.token_urlsafe(64)
+    url, state = client.build_authorization_url(
+        redirect_uri=str(request.url_for("oidc_auth_callback")),
+        nonce=nonce,
+        scope=request.app.state.oidc.settings.scope,
+        code_verifier=verifier,
+    )
+    request.session[SESSION_STATE_KEY] = state
+    request.session[SESSION_NONCE_KEY] = nonce
+    request.session[SESSION_VERIFIER_KEY] = verifier
+    return RedirectResponse(url, status_code=302)
+
+
+@router.get("/callback", name="oidc_auth_callback")
+async def oidc_callback(request: Request):
+    code = request.query_params.get("code")
+    # The state is compared before the login transaction is consumed: a reply
+    # that does not carry it (a forged link) leaves the pending sign-in alone.
+    stale = stale_callback(
+        request,
+        SESSION_STATE_KEY,
+        SESSION_USER_KEY,
+        request.app.state.oidc.settings.login_redirect_url,
+    )
+    if stale is not None:
+        return stale
+    request.session.pop(SESSION_STATE_KEY, None)
+    expected_nonce = request.session.pop(SESSION_NONCE_KEY, None)
+    verifier = request.session.pop(SESSION_VERIFIER_KEY, None)
+    # Past this point the reply belongs to this login, and every outcome,
+    # including an ``error`` reply (access_denied, login_required, ...), spends it.
+    if request.query_params.get("error"):
+        raise HTTPException(status_code=401, detail="Sign-in was refused by the identity provider")
+    if not code:
+        raise HTTPException(status_code=400, detail="Invalid OIDC state")
+    if not isinstance(expected_nonce, str) or not expected_nonce:
+        raise HTTPException(status_code=400, detail="Missing OIDC nonce")
+    if not isinstance(verifier, str) or not verifier:
+        raise HTTPException(status_code=400, detail="Missing PKCE verifier")
+    client = await require_client(request)
+    try:
+        tokens = await client.exchange_code(
+            code=code,
+            redirect_uri=str(request.url_for("oidc_auth_callback")),
+            code_verifier=verifier,
+        )
+    except Exception:
+        logger.warning("OIDC token exchange failed")
+        raise HTTPException(status_code=502, detail="Token exchange failed") from None
+    if not isinstance(tokens, dict):
+        logger.warning("OIDC token endpoint returned a non-object response")
+        raise HTTPException(status_code=502, detail="Token exchange failed")
+    s = request.app.state.oidc.settings
+    cache = request.app.state.oidc.jwks_cache
+    claims = (
+        await cache.validate_jwt(tokens.get("id_token", ""), audience=s.client_id)
+        if cache
+        else None
+    )
+    nonce = claims.get("nonce") if claims else None
+    if not isinstance(nonce, str) or not secrets.compare_digest(
+        nonce.encode(), expected_nonce.encode()
+    ):
+        raise HTTPException(status_code=401, detail="ID token validation failed")
+    expires_at = claims.get("exp")
+    if type(expires_at) is not int or expires_at <= time.time():
+        raise HTTPException(status_code=401, detail="Invalid ID token expiry")
+    provider = request.app.state.auth.auth_provider
+    try:
+        identity = provider._identity(claims)
+    except ValueError:
+        raise HTTPException(status_code=401, detail="Missing OIDC identity") from None
+    cache_id = await provider._upsert_user_cache(request, claims)
+    if cache_id is None:
+        raise HTTPException(status_code=503, detail="OIDC identity unavailable")
+    user_ctx = provider._claims_to_user_context(claims, cache_id=cache_id)
+    next_url = sign_in(
+        request,
+        user=user_ctx,
+        expires_at=expires_at,
+        authority=provider._session_authority,
+        redirect=s.login_redirect_url,
+        user_key=SESSION_USER_KEY,
+        identity_key=SESSION_IDENTITY_KEY,
+        identity=identity,
+    )
+    if tokens.get("refresh_token"):
+        store_refresh_token(request.app, request.session, tokens["refresh_token"])
+    return RedirectResponse(next_url, status_code=303)

oidc/endpoints/views.py

@@ -0,0 +1,59 @@
+"""OIDC interstitials and RP-initiated logout."""
+
+import logging
+
+from auth.oidc_common.renewal_outcomes import forget_outcomes
+from fastapi import APIRouter, Request
+from simple_module_hosting.inertia_deps import InertiaDep, is_inertia_request
+from simple_module_inertia.response import location
+from starlette.responses import RedirectResponse
+
+from oidc.constants import _PAGE_LOGGED_OUT, _PAGE_LOGIN, LOGGED_OUT_PATH, SESSION_REFRESH_TOKEN_KEY
+from oidc.renewal import _KEYS
+from oidc.runtime import is_signed_in
+from oidc.tokens import open_refresh_token
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["oidc-views"])
+
+
+@router.get("/login")
+async def login_page(inertia: InertiaDep):
+    return await inertia.render(_PAGE_LOGIN)
+
+
+@router.get("/logged-out")
+async def logged_out_page(request: Request, inertia: InertiaDep):
+    # Only meaningful once the session is gone; a signed-in visitor is not
+    # told they were signed out.
+    if is_signed_in(request.session):
+        return RedirectResponse(request.app.state.oidc.settings.login_redirect_url, 303)
+    return await inertia.render(_PAGE_LOGGED_OUT)
+
+
+@router.post("/logout")
+async def logout(request: Request):
+    client = request.app.state.oidc.client
+    if client is not None:
+        try:
+            refresh_token = open_refresh_token(
+                request.app, request.session.get(SESSION_REFRESH_TOKEN_KEY)
+            )
+            if refresh_token:
+                await client.revoke_refresh_token(refresh_token)
+        except Exception as exc:
+            # The class (timeout, HTTP status error, ...), never the token or body.
+            logger.warning(
+                "OIDC refresh token revocation failed (%s); continuing logout", type(exc).__name__
+            )
+    await forget_outcomes(request.app, _KEYS, request.session)
+    request.session.clear()
+    destination = f"{str(request.base_url).rstrip('/')}{LOGGED_OUT_PATH}"
+    if client is not None:
+        try:
+            destination = client.build_logout_url(post_logout_redirect_uri=destination)
+        except Exception:
+            logger.warning("OIDC logout unavailable; local session cleared")
+    if is_inertia_request(request.scope):
+        return location(destination)
+    return RedirectResponse(destination, status_code=303)

oidc/jwks.py

@@ -0,0 +1,5 @@
+"""Provider entry point for the shared JWKS validator."""
+
+from auth.oidc_common.jwks import JWKSCache
+
+__all__ = ["JWKSCache"]

oidc/locales/de.json

@@ -0,0 +1,14 @@
+{
+  "login": {
+    "redirecting": "Weiterleitung zum Identitätsanbieter…",
+    "manual": "Keine Weiterleitung? Manuell fortfahren"
+  },
+  "logout": {
+    "title": "Abgemeldet",
+    "message": "Sie wurden erfolgreich von dieser App abgemeldet.",
+    "sign_in_again": "Erneut anmelden"
+  },
+  "nav": {
+    "logout": "Abmelden"
+  }
+}

oidc/locales/en.json

@@ -0,0 +1,14 @@
+{
+  "login": {
+    "redirecting": "Redirecting to identity provider\u2026",
+    "manual": "Not redirected? Continue manually"
+  },
+  "logout": {
+    "title": "Signed Out",
+    "message": "You have been signed out successfully.",
+    "sign_in_again": "Sign in again"
+  },
+  "nav": {
+    "logout": "Logout"
+  }
+}

oidc/models.py

@@ -0,0 +1,28 @@
+"""OIDC user cache -- maps a provider subject to a stable framework UUID."""
+
+from __future__ import annotations
+
+import uuid as uuid_mod
+from datetime import datetime
+
+from simple_module_db.base import create_module_base
+from simple_module_db.types import AwareDateTime
+from sqlalchemy import UniqueConstraint
+from sqlmodel import Field
+
+Base = create_module_base("oidc")
+
+
+class OidcUserCache(Base, table=True):  # ty: ignore[unsupported-base]
+    __tablename__ = "oidc_user_cache"
+
+    id: uuid_mod.UUID = Field(default_factory=uuid_mod.uuid4, primary_key=True)
+    __table_args__ = (
+        UniqueConstraint("issuer", "subject", name="uq_oidc_user_cache_issuer_subject"),
+    )
+
+    issuer: str
+    subject: str
+    email: str = ""
+    full_name: str | None = None
+    last_login_at: datetime | None = Field(default=None, sa_type=AwareDateTime())

oidc/module.py

@@ -0,0 +1,87 @@
+"""Generic OIDC authentication module (Entra, Auth0, Okta, ...)."""
+
+from __future__ import annotations
+
+import importlib.resources
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from simple_module_core.menu import MenuItem, MenuRegistry, MenuSection
+from simple_module_core.module import ModuleBase, ModuleMeta
+from simple_module_core.module_settings import register_module_settings
+from simple_module_core.user_directory import set_user_directory
+
+from oidc.constants import (
+    _MODULE_AUTH,
+    _MODULE_SETTINGS,
+    AUTH_CALLBACK_PATH,
+    AUTH_LOGIN_PATH,
+    LOGGED_OUT_PATH,
+    LOGIN_PATH,
+    LOGOUT_PATH,
+)
+
+if TYPE_CHECKING:
+    from fastapi import APIRouter, FastAPI
+
+
+class OidcModule(ModuleBase):
+    meta = ModuleMeta(
+        name="Oidc",
+        route_prefix="/api/oidc",
+        view_prefix="/oidc",
+        depends_on=[_MODULE_AUTH],
+        optional_depends_on=[_MODULE_SETTINGS],
+    )
+    _is_auth_provider = True
+
+    def register_settings(self, app: FastAPI) -> None:
+        from oidc.directory import OidcDirectory
+        from oidc.provider import OidcAuthProvider
+        from oidc.settings import OidcSettings
+        from oidc.state import OidcState
+
+        register_module_settings(
+            app,
+            "oidc",
+            OidcSettings,
+            lambda s: OidcState(settings=s),
+        )
+
+        set_user_directory(app, OidcDirectory())
+        app.state.auth.auth_provider = OidcAuthProvider(
+            app.state.oidc.settings, state=app.state.oidc
+        )
+
+    def register_menu_items(self, registry: MenuRegistry) -> None:
+        registry.add(
+            MenuItem(
+                label="Logout",
+                label_key="oidc.nav.logout",
+                url=LOGOUT_PATH,
+                icon="log-out",
+                order=999,
+                section=MenuSection.USER_DROPDOWN,
+                method="post",
+            )
+        )
+
+    def register_routes(self, api_router: APIRouter, view_router: APIRouter) -> None:
+        from oidc.endpoints.api import router as api
+        from oidc.endpoints.views import router as views
+
+        api_router.include_router(api)
+        view_router.include_router(views)
+
+    def register_public_routes(self, registry) -> None:
+        for path in (LOGIN_PATH, LOGGED_OUT_PATH, AUTH_LOGIN_PATH, AUTH_CALLBACK_PATH):
+            registry.add_exact(path, methods={"GET"})
+        registry.add_exact(LOGOUT_PATH, methods={"POST"})
+
+    async def on_startup(self, app: FastAPI) -> None:
+        from oidc.runtime import initialize
+
+        await initialize(app)
+
+    def locale_dirs(self) -> dict[str, Path]:
+        return {"oidc": Path(str(importlib.resources.files(__package__) / "locales"))}

oidc/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "@simple-module/oidc",
+  "private": true,
+  "version": "0.0.43",
+  "type": "module",
+  "dependencies": {}
+}

oidc/pages/LoggedOut.tsx

@@ -0,0 +1,15 @@
+import { Link } from '@inertiajs/react';
+import { keys, useT } from '@simple-module-py/i18n';
+
+export default function LoggedOut() {
+  const { t } = useT();
+  return (
+    <div className="flex min-h-screen flex-col items-center justify-center gap-4">
+      <h1 className="text-2xl font-bold">{t(keys.oidc.logout.title)}</h1>
+      <p className="text-muted-foreground">{t(keys.oidc.logout.message)}</p>
+      <Link href="/oidc/login" className="text-primary underline">
+        {t(keys.oidc.logout.sign_in_again)}
+      </Link>
+    </div>
+  );
+}

oidc/pages/Login.tsx

@@ -0,0 +1,20 @@
+import { keys, useT } from '@simple-module-py/i18n';
+import { useEffect } from 'react';
+
+const START_LOGIN_URL = '/api/oidc/auth/login';
+
+export default function Login() {
+  const { t } = useT();
+  useEffect(() => {
+    window.location.assign(START_LOGIN_URL);
+  }, []);
+
+  return (
+    <div className="flex min-h-screen flex-col items-center justify-center gap-4">
+      <p className="text-muted-foreground">{t(keys.oidc.login.redirecting)}</p>
+      <a href={START_LOGIN_URL} className="text-primary underline">
+        {t(keys.oidc.login.manual)}
+      </a>
+    </div>
+  );
+}