oidc pkce support

2026-02-25 15:07:54 +02:00
parent 74b1c2ba98
commit d678307d2d
15 changed files with 253 additions and 4 deletions
@@ -298,6 +298,7 @@ return [
    'oidcFallback' => true,
    'oidcScopes' => ['profile', 'email', 'phone'],
    'oidcAuthorizationPrompt' => 'consent',
+    'oidcAuthorizationPkce' => true,
    'listViewSettingsDisabled' => false,
    'cleanupDeletedRecords' => true,
    'phoneNumberNumericSearch' => true,
@@ -166,6 +166,7 @@
        "oidcAllowAdminUser": "OIDC Allow OIDC login for admin users",
        "oidcLogoutUrl": "OIDC Logout URL",
        "oidcAuthorizationPrompt": "OIDC Authorization Prompt",
+        "oidcAuthorizationPkce": "OIDC Use PKCE",
        "pdfEngine": "PDF Engine",
        "quickSearchFullTextAppendWildcard": "Append wildcard in quick search",
        "authIpAddressCheck": "Restrict access by IP address",
@@ -130,6 +130,9 @@
        "oidcLogoutUrl": {
            "level": "admin"
        },
+        "oidcAuthorizationPkce": {
+            "level": "admin"
+        },
        "apiCorsAllowedMethodList": {
            "level": "admin"
        },
@@ -91,5 +91,8 @@
    },
    "applicationConfig": {
        "className": "Espo\\Core\\Utils\\Config\\ApplicationConfig"
+    },
+    "session": {
+        "className": "Espo\\Core\\Session\\DefaultSession"
    }
 }
@@ -104,7 +104,9 @@
                    {
                        "name": "oidcAuthorizationPrompt"
                    },
-                    false
+                    {
+                        "name": "oidcAuthorizationPkce"
+                    }
                ]
            ]
        },
@@ -84,6 +84,10 @@
                "select_account"
            ],
            "maxLength": 14
+        },
+        "oidcAuthorizationPkce": {
+            "type": "bool",
+            "default": true
        }
    }
 }
@@ -912,6 +912,10 @@
                "select_account"
            ]
        },
+        "oidcAuthorizationPkce": {
+            "type": "bool",
+            "default": true
+        },
        "pdfEngine": {
            "type": "enum",
            "view": "views/settings/fields/pdf-engine"