webgate 2.5.0__tar.gz → 2.7.0__tar.gz

{webgate-2.5.0 → webgate-2.7.0}/.github/workflows/demo.yml

@@ -4,8 +4,10 @@ name: Deploy demo
 # it spent months serving a version several releases behind the repository.
 
 on:
-  release:
-    types: [published]
+  # Called by release.yml rather than triggered by the release it creates: GitHub
+  # does not start workflows from events raised with GITHUB_TOKEN, so a
+  # `release: published` trigger here never fires and the demo silently stays behind.
+  workflow_call:
   workflow_dispatch:
 
 permissions:

{webgate-2.5.0 → webgate-2.7.0}/.github/workflows/release.yml

@@ -121,3 +121,8 @@ jobs:
           tag_name: ${{ inputs.tag || github.ref_name }}
           name: v${{ needs.verify.outputs.version }}
           body_path: notes.md
+
+  demo:
+    needs: github_release
+    uses: ./.github/workflows/demo.yml
+    secrets: inherit

{webgate-2.5.0 → webgate-2.7.0}/CHANGELOG.md

@@ -1,5 +1,93 @@
 # Changelog
 
+## v2.7.0 (2026-09-17) — single sign-on
+
+LDAP already existed, but no company running Entra ID, Okta or Google Workspace is
+going to keep a second directory for one tool. It was the first thing anyone asked
+about, and the thing most likely to decide whether webgate gets deployed at all.
+
+### Single sign-on (OpenID Connect)
+
+**Admin → Settings → Single sign-on**, alongside local accounts and LDAP rather than
+instead of them. Register one redirect URI with your provider, fill in the issuer,
+client ID, secret and scopes, and everything else — the endpoints, the signing keys —
+comes from the provider's discovery document.
+
+- **The ID token is actually verified**: signature against the provider's published
+  keys, plus issuer, audience, expiry, and a nonce tied to that one sign-in, so a token
+  captured from another flow cannot be replayed into this one. A token that merely
+  decodes proves nothing.
+- **Authorization code with PKCE**, so it is safe with or without a client secret.
+- **The in-progress sign-in lives in the database**, not in worker memory. The browser
+  can come back to a different worker than the one it left, which is the whole point of
+  the stateless design.
+- **The session token never travels in a URL.** The callback hands the page a one-time
+  code, good for about a minute, which it trades for a session — so nothing sensitive
+  reaches browser history or a proxy log.
+- **A provider group grants nothing until an admin maps it**, exactly as LDAP works. A
+  directory group created next month cannot quietly open a webgate group that happens
+  to share its name. A separate admin-groups list grants admin.
+- Sign-ins are audited as `sso_login`, with the groups granted.
+- Accounts created this way have **no local password** — nothing to reset, nothing to
+  leak.
+
+Twenty-one tests, run against a real identity provider started for the test: it
+publishes a discovery document and a JWKS and signs its own tokens, so the
+verification is exercised rather than mocked away. A token signed with the wrong key,
+issued for another audience, expired, or carrying another sign-in's nonce is refused,
+and each of those is a test.
+
+[Setup, and what to do when nobody gets any groups](https://kalexnolasco.github.io/webgate/guide/sso/).
+
+354 tests: 345 unit, 9 browser.
+
+---
+
+## v2.6.0 (2026-09-16) — rotating the secret key no longer breaks everything
+
+### Fixed
+
+- **A changed `WEBGATE_SECRET_KEY` made webgate fall over instead of explaining
+  itself.** v2.2.0 refuses the shipped default, which asks every existing install to
+  set a real one; doing that leaves rows encrypted under the old key. `decrypt_value`
+  raised a bare Fernet error from twelve call sites and none of them caught it. The
+  status monitor died on its first sweep and froze every server's dot; opening a
+  terminal failed the WebSocket **upgrade**, so the browser got a 500 with nothing in
+  it. Found on the public demo, by walking into it.
+
+  An unreadable credential is now its own error, naming the server, why it happened
+  and what to do. The monitor marks that one server offline and carries on, the
+  terminal answers with an error frame, SFTP returns 502, and a connection test
+  reports it.
+
+- **The demo banner covered the top of the interface.** It was `position: fixed` with
+  nothing making room for it, so the app bar sat underneath. It is in flow now, which
+  also holds when it wraps to two lines on a narrow screen. Only visible with
+  `WEBGATE_DEMO_MODE=true`, which is why no test caught it.
+
+- **Diagrams that did not show.** Nine style directives set a pale fill and left the
+  label to the theme, so on GitHub's dark background they were light text on a light
+  box. All 21 diagrams in the repository now render, and every label is readable on
+  both grounds — checked with the Mermaid version GitHub actually uses, in a browser,
+  one diagram per page.
+
+### Added
+
+- **The pinned host key is visible.** The fingerprint has been in the API since
+  v2.0.0 and nothing showed it. Servers carry a shield when a key is pinned, the edit
+  form shows the fingerprint, and an admin can clear it there — with the consequence
+  spelled out, since accepting a new key is the one moment the protection is stood
+  down.
+- **A cap on concurrent SSH sessions per account** (**Admin → Settings → Security**,
+  0 for none). There was nothing stopping a looping tab from opening sessions until
+  the worker ran out. Checked before the SSH connection is made, and counted per
+  worker — which the setting says, because a gateway behind a load balancer allows
+  that many on each.
+
+333 tests.
+
+---
+
 ## v2.5.0 (2026-09-16) — browser tests
 
 The audit gap in v2.4.0 was reported by a person using the interface, and no test in

{webgate-2.5.0 → webgate-2.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: webgate
-Version: 2.5.0
+Version: 2.7.0
 Summary: Self-hosted web application for remote server management via SSH terminal and SFTP file browser
 Project-URL: Homepage, https://github.com/kalexnolasco/webgate
 Project-URL: Documentation, https://kalexnolasco.github.io/webgate/
@@ -126,9 +126,9 @@ flowchart TB
     GW -. "SSH :22" .-> APP2
     GW -. "SSH :22" .-> WORKER
     GW -. "SSH :22" .-> REDIS
-    style internet fill:#e8f0fe,stroke:#4a90d9
-    style firewall fill:#fff3e0,stroke:#ff9800
-    style internal fill:#f0f9e8,stroke:#5cb85c
+    style internet fill:none,stroke:#4a90d9,stroke-width:2px
+    style firewall fill:none,stroke:#ff9800,stroke-width:2px
+    style internal fill:none,stroke:#5cb85c,stroke-width:2px
     style GW fill:#ffcc02,stroke:#e6a800,color:#333
     style YOU fill:#4a90d9,stroke:#2a6cb5,color:#fff
 ```
@@ -160,9 +160,9 @@ flowchart TB
     WG -- "SSH/SFTP" --> APP1
     WG -- "SSH/SFTP" --> WORKER
     WG -- "SSH/SFTP" --> REDIS
-    style internet fill:#e8f0fe,stroke:#4a90d9
-    style firewall fill:#fff3e0,stroke:#ff9800
-    style internal fill:#f0f9e8,stroke:#5cb85c
+    style internet fill:none,stroke:#4a90d9,stroke-width:2px
+    style firewall fill:none,stroke:#ff9800,stroke-width:2px
+    style internal fill:none,stroke:#5cb85c,stroke-width:2px
     style WG fill:#5cb85c,stroke:#449d44,color:#fff
     style ENG1 fill:#4a90d9,stroke:#2a6cb5,color:#fff
     style ENG2 fill:#4a90d9,stroke:#2a6cb5,color:#fff
@@ -189,7 +189,7 @@ flowchart TB
 | **SFTP** | Full file ops + drag & drop upload, **sortable columns**, **multi-select** with batch ZIP download and delete, hidden-file toggle, in-browser editor (CodeMirror 6), PDF/image preview |
 | **Server Registry** | Groups, tags, password/key auth, encrypted at rest (Fernet), **verified host keys** (TOFU), **favourites and recents**, import/export JSON, **jump host / bastion** chaining |
 | **Access Control** | Admin/user roles, per-server SSH/SFTP toggles, SFTP path restrictions, read-only SFTP mode, group-based visibility |
-| **Auth** | JWT + bcrypt locally, **2FA TOTP**, **API keys** for automation, **LDAP / Active Directory** with group→role mapping |
+| **Auth** | **Single sign-on (OpenID Connect)** — Entra ID, Okta, Google Workspace, Keycloak — with group→role mapping, plus JWT + bcrypt locally, **2FA TOTP**, **API keys** for automation, **LDAP / Active Directory** |
 | **Compliance** | **Session recording** to asciinema cast files with browser replay, off by default and opted into per server, **audit log** covering every SFTP operation, registry and account change, searchable by filename, **webhooks** (HMAC-signed) on key events |
 | **Migration** | **Full-state backup and restore** — servers with credentials, users, groups, webhooks and API keys in one passphrase-encrypted file, portable between instances |
 | **AI agent** | Per-server iterative chat over **Ollama** or **OpenRouter**, read-only inspection tools, **works on SFTP-only hosts**, cached results and searchable findings — configured in the admin panel, off until then |
@@ -355,7 +355,7 @@ flowchart LR
     style B fill:#4a90d9,stroke:#2a6cb5,color:#fff
     style WG fill:#5cb85c,stroke:#449d44,color:#fff
     style BAST fill:#ffcc02,stroke:#e6a800,color:#333
-    style INT fill:#fff3e0,stroke:#ff9800
+    style INT fill:#b25e00,stroke:#ff9800,color:#fff
 ```
 
 ### Shared terminal session
@@ -407,7 +407,7 @@ flowchart LR
         L1["alice ∈ cn=devs"]
         L2["alice ∈ cn=admins"]
     end
-    subgraph "Group mapping<br/>(Admin → Settings → LDAP)"
+    subgraph MAP["Group mapping<br/>Admin &rarr; Settings &rarr; LDAP"]
         M["{<br/>  &quot;devs&quot;: &quot;production&quot;,<br/>  &quot;sre&quot;: &quot;all&quot;<br/>}"]
     end
     subgraph User
@@ -650,9 +650,9 @@ flowchart LR
     W3 -. watches .-> LEASE
     style LB fill:#ffcc02,stroke:#e6a800,color:#333
     style W1 fill:#5cb85c,stroke:#449d44,color:#fff
-    style W2 fill:#e8f0fe,stroke:#4a90d9
-    style W3 fill:#e8f0fe,stroke:#4a90d9
-    style PG fill:#fff3e0,stroke:#ff9800
+    style W2 fill:#2a6cb5,stroke:#4a90d9,color:#fff
+    style W3 fill:#2a6cb5,stroke:#4a90d9,color:#fff
+    style PG fill:#b25e00,stroke:#ff9800,color:#fff
 ```
 
 Reference stack:
@@ -727,6 +727,7 @@ The demo middleware blocks all writes on `/api/*` (login, terminal share and tot
 | **Servers** | `GET/POST/PUT/DELETE /api/servers`, `POST /api/servers/{id}/test`, `GET /api/servers/groups`, `POST /api/servers/import`, `GET /api/servers/export`, `GET /api/servers/status` |
 | **Terminal** | `WS /api/ws/terminal/{server_id}` (owner), `WS /api/ws/terminal/quick` (one-off), `WS /api/ws/terminal/join/{token}?mode=rw\|ro` (joiner), `POST/DELETE /api/terminal/share/{session_id}` |
 | **Files (SFTP)** | `GET /ls`, `GET /read`, `GET /download`, `GET /download-zip` (one directory), `POST /download-zip` (a chosen selection), `POST /upload`, `PUT /write`, `POST /mkdir`, `POST /rename`, `DELETE /delete`, `POST /chmod`, `GET /stat` (all under `/api/files/{server_id}/`) |
+| **Single sign-on** | `GET /api/auth/sso/start`, `GET /api/auth/sso/callback`, `POST /api/auth/sso/exchange` |
 | **Settings** | `GET /api/settings`, `PUT /api/settings`, `POST /api/settings/reset` (admin only) |
 | **Agent** | `GET/PUT /api/agent/settings`, `POST /api/agent/models`, `POST /api/agent/chat/{server_id}`, `GET/DELETE /api/agent/conversations/{server_id}`, `GET /api/agent/findings` |
 | **Branding** | `GET /api/branding` (public), `PUT/DELETE /api/branding` (admin only) |
@@ -790,6 +791,7 @@ docker compose -f compose.dev.yml up --build
 
 ## Security
 
+- **Single sign-on** verifies the ID token properly: signature against the provider's published keys, plus issuer, audience, expiry and a per-sign-in nonce. The flow uses PKCE, its state lives in the database so it works across workers, and the session token is handed over as a one-time code rather than in a URL
 - **Host keys are verified** — trust on first use. The first connection to a server records the key it presents; every connection after that is checked against it *before authentication runs*, so a mismatch sends nothing. Accepting a changed key is a deliberate, audited admin action. This covers the terminal, SFTP, the connection pool, the status monitor, the agent and jump hosts
 - All SSH passwords and private keys are encrypted at rest with **Fernet** (key derived from `WEBGATE_SECRET_KEY`)
 - **The default secret key is refused.** That key signs every session token and derives the credential encryption key, and its default is published in this repository — a deployment that never changed it will hand a valid admin token to anyone who asks. webgate now stops at startup rather than serving under it, unless it is bound to loopback only

{webgate-2.5.0 → webgate-2.7.0}/README.md

@@ -77,9 +77,9 @@ flowchart TB
     GW -. "SSH :22" .-> APP2
     GW -. "SSH :22" .-> WORKER
     GW -. "SSH :22" .-> REDIS
-    style internet fill:#e8f0fe,stroke:#4a90d9
-    style firewall fill:#fff3e0,stroke:#ff9800
-    style internal fill:#f0f9e8,stroke:#5cb85c
+    style internet fill:none,stroke:#4a90d9,stroke-width:2px
+    style firewall fill:none,stroke:#ff9800,stroke-width:2px
+    style internal fill:none,stroke:#5cb85c,stroke-width:2px
     style GW fill:#ffcc02,stroke:#e6a800,color:#333
     style YOU fill:#4a90d9,stroke:#2a6cb5,color:#fff
 ```
@@ -111,9 +111,9 @@ flowchart TB
     WG -- "SSH/SFTP" --> APP1
     WG -- "SSH/SFTP" --> WORKER
     WG -- "SSH/SFTP" --> REDIS
-    style internet fill:#e8f0fe,stroke:#4a90d9
-    style firewall fill:#fff3e0,stroke:#ff9800
-    style internal fill:#f0f9e8,stroke:#5cb85c
+    style internet fill:none,stroke:#4a90d9,stroke-width:2px
+    style firewall fill:none,stroke:#ff9800,stroke-width:2px
+    style internal fill:none,stroke:#5cb85c,stroke-width:2px
     style WG fill:#5cb85c,stroke:#449d44,color:#fff
     style ENG1 fill:#4a90d9,stroke:#2a6cb5,color:#fff
     style ENG2 fill:#4a90d9,stroke:#2a6cb5,color:#fff
@@ -140,7 +140,7 @@ flowchart TB
 | **SFTP** | Full file ops + drag & drop upload, **sortable columns**, **multi-select** with batch ZIP download and delete, hidden-file toggle, in-browser editor (CodeMirror 6), PDF/image preview |
 | **Server Registry** | Groups, tags, password/key auth, encrypted at rest (Fernet), **verified host keys** (TOFU), **favourites and recents**, import/export JSON, **jump host / bastion** chaining |
 | **Access Control** | Admin/user roles, per-server SSH/SFTP toggles, SFTP path restrictions, read-only SFTP mode, group-based visibility |
-| **Auth** | JWT + bcrypt locally, **2FA TOTP**, **API keys** for automation, **LDAP / Active Directory** with group→role mapping |
+| **Auth** | **Single sign-on (OpenID Connect)** — Entra ID, Okta, Google Workspace, Keycloak — with group→role mapping, plus JWT + bcrypt locally, **2FA TOTP**, **API keys** for automation, **LDAP / Active Directory** |
 | **Compliance** | **Session recording** to asciinema cast files with browser replay, off by default and opted into per server, **audit log** covering every SFTP operation, registry and account change, searchable by filename, **webhooks** (HMAC-signed) on key events |
 | **Migration** | **Full-state backup and restore** — servers with credentials, users, groups, webhooks and API keys in one passphrase-encrypted file, portable between instances |
 | **AI agent** | Per-server iterative chat over **Ollama** or **OpenRouter**, read-only inspection tools, **works on SFTP-only hosts**, cached results and searchable findings — configured in the admin panel, off until then |
@@ -306,7 +306,7 @@ flowchart LR
     style B fill:#4a90d9,stroke:#2a6cb5,color:#fff
     style WG fill:#5cb85c,stroke:#449d44,color:#fff
     style BAST fill:#ffcc02,stroke:#e6a800,color:#333
-    style INT fill:#fff3e0,stroke:#ff9800
+    style INT fill:#b25e00,stroke:#ff9800,color:#fff
 ```
 
 ### Shared terminal session
@@ -358,7 +358,7 @@ flowchart LR
         L1["alice ∈ cn=devs"]
         L2["alice ∈ cn=admins"]
     end
-    subgraph "Group mapping<br/>(Admin → Settings → LDAP)"
+    subgraph MAP["Group mapping<br/>Admin &rarr; Settings &rarr; LDAP"]
         M["{<br/>  &quot;devs&quot;: &quot;production&quot;,<br/>  &quot;sre&quot;: &quot;all&quot;<br/>}"]
     end
     subgraph User
@@ -601,9 +601,9 @@ flowchart LR
     W3 -. watches .-> LEASE
     style LB fill:#ffcc02,stroke:#e6a800,color:#333
     style W1 fill:#5cb85c,stroke:#449d44,color:#fff
-    style W2 fill:#e8f0fe,stroke:#4a90d9
-    style W3 fill:#e8f0fe,stroke:#4a90d9
-    style PG fill:#fff3e0,stroke:#ff9800
+    style W2 fill:#2a6cb5,stroke:#4a90d9,color:#fff
+    style W3 fill:#2a6cb5,stroke:#4a90d9,color:#fff
+    style PG fill:#b25e00,stroke:#ff9800,color:#fff
 ```
 
 Reference stack:
@@ -678,6 +678,7 @@ The demo middleware blocks all writes on `/api/*` (login, terminal share and tot
 | **Servers** | `GET/POST/PUT/DELETE /api/servers`, `POST /api/servers/{id}/test`, `GET /api/servers/groups`, `POST /api/servers/import`, `GET /api/servers/export`, `GET /api/servers/status` |
 | **Terminal** | `WS /api/ws/terminal/{server_id}` (owner), `WS /api/ws/terminal/quick` (one-off), `WS /api/ws/terminal/join/{token}?mode=rw\|ro` (joiner), `POST/DELETE /api/terminal/share/{session_id}` |
 | **Files (SFTP)** | `GET /ls`, `GET /read`, `GET /download`, `GET /download-zip` (one directory), `POST /download-zip` (a chosen selection), `POST /upload`, `PUT /write`, `POST /mkdir`, `POST /rename`, `DELETE /delete`, `POST /chmod`, `GET /stat` (all under `/api/files/{server_id}/`) |
+| **Single sign-on** | `GET /api/auth/sso/start`, `GET /api/auth/sso/callback`, `POST /api/auth/sso/exchange` |
 | **Settings** | `GET /api/settings`, `PUT /api/settings`, `POST /api/settings/reset` (admin only) |
 | **Agent** | `GET/PUT /api/agent/settings`, `POST /api/agent/models`, `POST /api/agent/chat/{server_id}`, `GET/DELETE /api/agent/conversations/{server_id}`, `GET /api/agent/findings` |
 | **Branding** | `GET /api/branding` (public), `PUT/DELETE /api/branding` (admin only) |
@@ -741,6 +742,7 @@ docker compose -f compose.dev.yml up --build
 
 ## Security
 
+- **Single sign-on** verifies the ID token properly: signature against the provider's published keys, plus issuer, audience, expiry and a per-sign-in nonce. The flow uses PKCE, its state lives in the database so it works across workers, and the session token is handed over as a one-time code rather than in a URL
 - **Host keys are verified** — trust on first use. The first connection to a server records the key it presents; every connection after that is checked against it *before authentication runs*, so a mismatch sends nothing. Accepting a changed key is a deliberate, audited admin action. This covers the terminal, SFTP, the connection pool, the status monitor, the agent and jump hosts
 - All SSH passwords and private keys are encrypted at rest with **Fernet** (key derived from `WEBGATE_SECRET_KEY`)
 - **The default secret key is refused.** That key signs every session token and derives the credential encryption key, and its default is published in this repository — a deployment that never changed it will hand a valid admin token to anyone who asks. webgate now stops at startup rather than serving under it, unless it is bound to loopback only

{webgate-2.5.0 → webgate-2.7.0}/ROADMAP.md

@@ -90,6 +90,17 @@ Tracks the development plan for **webgate**. Items are organized by release.
 - [x] **The documentation screenshots are taken by those tests**, so they cannot drift from the shipped interface
 - [x] **CI runs them on every push**, and uploads what they captured
 
+### v2.6.0 — Key rotation, host key UI, session cap (2026-09-16)
+- [x] **A changed secret key is handled** — it used to kill the monitor and fail the terminal's WebSocket upgrade with a bare 500
+- [x] **The pinned host key fingerprint is visible and clearable** from the Site Manager
+- [x] **A per-account cap on concurrent SSH sessions**
+- [x] **The demo banner no longer covers the interface**, and every diagram in the repository renders legibly on both GitHub grounds
+
+### v2.7.0 — Single sign-on (2026-09-17)
+- [x] **OpenID Connect sign-on** for Entra ID, Okta, Google Workspace, Keycloak and Authentik, with the ID token verified against the provider's keys and a per-sign-in nonce
+- [x] **Provider groups map to webgate groups**, and an unmapped group grants nothing
+- [x] **The session token is handed over as a one-time code**, never in a URL
+
 ---
 
 ## Planned
@@ -97,8 +108,6 @@ Tracks the development plan for **webgate**. Items are organized by release.
 ### v2.1.x — Next
 | Feature | Priority | Description |
 |---------|----------|-------------|
-| Per-user concurrent-session limit | Medium | Nothing caps how many SSH sessions one account may hold open |
-| Host key fingerprint in the UI | Medium | The API exposes it and can clear it; the Site Manager does not show it yet |
 | Internationalization (i18n) | Low | UI translations starting with English / Spanish |
 
 ### Later

webgate-2.7.0/VERSION

@@ -0,0 +1 @@
+2.7.0

{webgate-2.5.0 → webgate-2.7.0}/docs/LOCAL_TESTING.md

@@ -55,7 +55,7 @@ flowchart LR
     B -- SSH tunnel --> I
     style WG fill:#5cb85c,stroke:#449d44,color:#fff
     style B fill:#ffcc02,stroke:#e6a800,color:#333
-    style I fill:#fff3e0,stroke:#ff9800
+    style I fill:#b25e00,stroke:#ff9800,color:#fff
 ```
 
 `webgate` and `ssh-internal` share **no network**, so reaching `ssh-internal` is only possible via the bastion.

{webgate-2.5.0 → webgate-2.7.0}/docs/changelog.md

@@ -1,5 +1,93 @@
 # Changelog
 
+## v2.7.0 (2026-09-17) — single sign-on
+
+LDAP already existed, but no company running Entra ID, Okta or Google Workspace is
+going to keep a second directory for one tool. It was the first thing anyone asked
+about, and the thing most likely to decide whether webgate gets deployed at all.
+
+### Single sign-on (OpenID Connect)
+
+**Admin → Settings → Single sign-on**, alongside local accounts and LDAP rather than
+instead of them. Register one redirect URI with your provider, fill in the issuer,
+client ID, secret and scopes, and everything else — the endpoints, the signing keys —
+comes from the provider's discovery document.
+
+- **The ID token is actually verified**: signature against the provider's published
+  keys, plus issuer, audience, expiry, and a nonce tied to that one sign-in, so a token
+  captured from another flow cannot be replayed into this one. A token that merely
+  decodes proves nothing.
+- **Authorization code with PKCE**, so it is safe with or without a client secret.
+- **The in-progress sign-in lives in the database**, not in worker memory. The browser
+  can come back to a different worker than the one it left, which is the whole point of
+  the stateless design.
+- **The session token never travels in a URL.** The callback hands the page a one-time
+  code, good for about a minute, which it trades for a session — so nothing sensitive
+  reaches browser history or a proxy log.
+- **A provider group grants nothing until an admin maps it**, exactly as LDAP works. A
+  directory group created next month cannot quietly open a webgate group that happens
+  to share its name. A separate admin-groups list grants admin.
+- Sign-ins are audited as `sso_login`, with the groups granted.
+- Accounts created this way have **no local password** — nothing to reset, nothing to
+  leak.
+
+Twenty-one tests, run against a real identity provider started for the test: it
+publishes a discovery document and a JWKS and signs its own tokens, so the
+verification is exercised rather than mocked away. A token signed with the wrong key,
+issued for another audience, expired, or carrying another sign-in's nonce is refused,
+and each of those is a test.
+
+[Setup, and what to do when nobody gets any groups](https://kalexnolasco.github.io/webgate/guide/sso/).
+
+354 tests: 345 unit, 9 browser.
+
+---
+
+## v2.6.0 (2026-09-16) — rotating the secret key no longer breaks everything
+
+### Fixed
+
+- **A changed `WEBGATE_SECRET_KEY` made webgate fall over instead of explaining
+  itself.** v2.2.0 refuses the shipped default, which asks every existing install to
+  set a real one; doing that leaves rows encrypted under the old key. `decrypt_value`
+  raised a bare Fernet error from twelve call sites and none of them caught it. The
+  status monitor died on its first sweep and froze every server's dot; opening a
+  terminal failed the WebSocket **upgrade**, so the browser got a 500 with nothing in
+  it. Found on the public demo, by walking into it.
+
+  An unreadable credential is now its own error, naming the server, why it happened
+  and what to do. The monitor marks that one server offline and carries on, the
+  terminal answers with an error frame, SFTP returns 502, and a connection test
+  reports it.
+
+- **The demo banner covered the top of the interface.** It was `position: fixed` with
+  nothing making room for it, so the app bar sat underneath. It is in flow now, which
+  also holds when it wraps to two lines on a narrow screen. Only visible with
+  `WEBGATE_DEMO_MODE=true`, which is why no test caught it.
+
+- **Diagrams that did not show.** Nine style directives set a pale fill and left the
+  label to the theme, so on GitHub's dark background they were light text on a light
+  box. All 21 diagrams in the repository now render, and every label is readable on
+  both grounds — checked with the Mermaid version GitHub actually uses, in a browser,
+  one diagram per page.
+
+### Added
+
+- **The pinned host key is visible.** The fingerprint has been in the API since
+  v2.0.0 and nothing showed it. Servers carry a shield when a key is pinned, the edit
+  form shows the fingerprint, and an admin can clear it there — with the consequence
+  spelled out, since accepting a new key is the one moment the protection is stood
+  down.
+- **A cap on concurrent SSH sessions per account** (**Admin → Settings → Security**,
+  0 for none). There was nothing stopping a looping tab from opening sessions until
+  the worker ran out. Checked before the SSH connection is made, and counted per
+  worker — which the setting says, because a gateway behind a load balancer allows
+  that many on each.
+
+333 tests.
+
+---
+
 ## v2.5.0 (2026-09-16) — browser tests
 
 The audit gap in v2.4.0 was reported by a person using the interface, and no test in

webgate-2.7.0/docs/guide/sso.md

@@ -0,0 +1,83 @@
+# Single sign-on
+
+**Admin → Settings → Single sign-on.** OpenID Connect, which is what Entra ID, Okta,
+Google Workspace, Keycloak and Authentik all speak.
+
+LDAP still works, and so do local accounts. Turning this on adds a button to the
+sign-in screen; it does not take anything away.
+
+## What to register with your provider
+
+One redirect URI:
+
+```
+https://your-webgate/api/auth/sso/callback
+```
+
+Then fill in four things here: the **issuer URL**, the **client ID**, the **client
+secret** if your provider issued one, and the **scopes**. Everything else — the
+authorize and token endpoints, the signing keys — is read from
+`{issuer}/.well-known/openid-configuration`, so there is nothing else to copy across.
+
+| Provider | Issuer looks like |
+|---|---|
+| Entra ID | `https://login.microsoftonline.com/<tenant-id>/v2.0` |
+| Okta | `https://<org>.okta.com/oauth2/default` |
+| Google Workspace | `https://accounts.google.com` |
+| Keycloak | `https://<host>/realms/<realm>` |
+| Authentik | `https://<host>/application/o/<slug>/` |
+
+!!! tip "Behind a proxy that rewrites the host"
+    webgate works out its own address from the request. If a proxy changes it, set
+    **Public URL** and the redirect will be that plus `/api/auth/sso/callback`.
+
+## Groups decide what people can reach
+
+A group from your directory means nothing here until an admin maps it:
+
+```json
+{"infra-oncall": "prod", "platform": "core"}
+```
+
+An unmapped group grants nothing. That is deliberate: a directory group created next
+month must not quietly open a webgate group that happens to share its name.
+
+**Admin groups** is a separate list — membership in any of them makes the person a
+webgate admin, and admins see every server.
+
+Both are re-read on every sign-in, so removing somebody from a group in your directory
+takes effect the next time they sign in. It does not end a session already open; the
+session-token lifetime under **Security** decides that.
+
+### If nobody gets any groups
+
+Your provider is probably not sending the claim. Two things to check: the **scopes**
+usually need an extra one (`groups` on Okta and Keycloak, `GroupMember.Read.All`
+consented on Entra), and the **groups claim** has to match the name your provider
+uses. Entra sends group *object ids* by default rather than names, unless the app
+registration is set to emit names.
+
+## What happens on sign-in
+
+1. The button sends the browser to your provider, with PKCE and a one-time `state` and
+   `nonce`.
+2. Your provider sends it back to the callback with a code.
+3. webgate exchanges the code, then **verifies the ID token** — signature against your
+   provider's published keys, issuer, audience, expiry, and that the nonce matches the
+   one it issued for this sign-in.
+4. The account is created or refreshed, with the groups from the mapping.
+5. The browser is handed a **one-time code**, and trades it for a session. The session
+   token is never put in a URL, so it cannot end up in browser history or a proxy log.
+
+The in-progress sign-in lives in the database, not in memory, so the browser can come
+back to a different worker than the one it left. Abandoned attempts are cleared after
+ten minutes.
+
+## Notes
+
+- A person who signs in this way has **no local password**. There is nothing to reset
+  and nothing to leak; your provider is the credential.
+- 2FA is your provider's business here. webgate's own TOTP applies to local accounts.
+- Every sign-in is recorded as `sso_login` in the audit log, with the groups granted.
+- Turning SSO off leaves the accounts it created. They simply have no working password
+  until an admin sets one.

{webgate-2.5.0 → webgate-2.7.0}/docs/guide/users.md

@@ -42,8 +42,8 @@ flowchart LR
     BOB -->|sees| S3
 
     style ADMIN fill:#5cb85c,stroke:#449d44,color:#fff
-    style ALICE fill:#e8f0fe,stroke:#4a90d9
-    style BOB fill:#fff3e0,stroke:#ff9800
+    style ALICE fill:#2a6cb5,stroke:#4a90d9,color:#fff
+    style BOB fill:#b25e00,stroke:#ff9800,color:#fff
 ```
 
 ## Editing Groups

{webgate-2.5.0 → webgate-2.7.0}/mkdocs.yml

@@ -46,6 +46,7 @@ nav:
     - Split View: guide/split.md
     - User Management: guide/users.md
     - Access model (groups, LDAP, tags): guide/access-control.md
+    - Single sign-on (OIDC): guide/sso.md
     - Advanced (jump host, snippets, sharing, recording): guide/advanced.md
     - Integrations (webhooks, LDAP, API keys, reverse proxy): guide/integrations.md
     - Settings (admin panel): guide/settings.md

{webgate-2.5.0 → webgate-2.7.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "webgate"
-version = "2.5.0"
+version = "2.7.0"
 description = "Self-hosted web application for remote server management via SSH terminal and SFTP file browser"
 readme = "README.md"
 license = "MIT"

{webgate-2.5.0 → webgate-2.7.0}/src/webgate/app.py

@@ -13,6 +13,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from webgate import __version__
 from webgate.agent.routes import router as agent_router
 from webgate.agent.store import load_config
+from webgate.auth import oidc
 from webgate.auth.routes import limiter
 from webgate.auth.routes import router as auth_router
 from webgate.auth.service import seed_admin
@@ -95,7 +96,13 @@ def create_app() -> FastAPI:
         agent_available = False
         if not settings.demo_mode:
             agent_available = (await load_config(session)).enabled
-        return {"demo_mode": settings.demo_mode, "agent_available": agent_available}
+        return {
+            "demo_mode": settings.demo_mode,
+            "agent_available": agent_available,
+            # The sign-in screen needs this before anyone has authenticated.
+            "sso_enabled": oidc.enabled(),
+            "sso_name": oidc.provider_name() if oidc.enabled() else "",
+        }
 
     if settings.demo_mode:
         # In demo mode block any state-changing request on /api/* except an

{webgate-2.5.0 → webgate-2.7.0}/src/webgate/auth/models.py

@@ -77,6 +77,10 @@ class UserUpdateGroups(BaseModel):
     allowed_groups: list[str]
 
 
+class SsoExchange(BaseModel):
+    code: str
+
+
 class ChangePassword(BaseModel):
     new_password: str