feature: the web service is an OpenID Provider, which signs the directory's users in to other systems, the clients being service accounts with redirect URIs.

2026-10-26 11:15:12 +01:00
1 parent d1d565b1d9
commit 8cac21845a
@@ -1,3 +1,32 @@
+vpn-router (0.27.0-1) unstable; urgency=medium
+
+  feature: the web service is an OpenID Provider, which signs the directory's users in to other systems, the clients being service accounts with redirect URIs.
+
+  * oidc.enabled turns on the OpenID Provider at the issuer
+    https://<wan.local_fqdn>:<https.web_port>, with discovery, JWKS,
+    authorize, token, userinfo and RP-initiated logout under /oidc/,
+    answered only through Caddy. The authorization code flow with PKCE
+    S256 and refresh tokens are offered; ID tokens are RS256, signed with
+    /etc/vpn-router/oidc.key, which the web service makes on its first run.
+  * Users sign in on the provider's page with the password and the TOTP
+    code or with a passkey; the session lasts 8 hours. The scopes openid,
+    profile, email and groups give sub (the entry's entryUUID), the names,
+    the e-mail address and the user's groups.
+  * A service account with redirect URIs is a client: its name is the
+    client ID and its password the secret. Its redirect URIs,
+    post-logout redirect URIs and allowed groups are set with
+    vpn-router-user add/update --redirect-uri, --post-logout-redirect-uri
+    and --allowed-group, and in /service-accounts as redirect_uris,
+    post_logout_redirect_uris and allowed_groups; GET /service-accounts
+    also answers the issuer. vpn-router-user list shows them.
+  * Changing a user's password, disabling, unlocking or removing the user
+    also revokes the user's codes, tokens and sessions of the provider.
+  * Renaming a group renames it in the clients that allow it, and a group
+    a client allows cannot be removed.
+  * The package depends on python3-oauthlib and python3-jwt.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Mon, 26 Oct 2026 14:00:00 +0100
+
 vpn-router (0.26.2-1) unstable; urgency=medium

  fix: a service account may be named by a GUID in lowercase, as the Router Manager proposes for a new one.
@@ -23,6 +23,8 @@ Depends: ${misc:Depends},
         python3-ldap,
         python3-pyotp,
         python3-fido2,
+         python3-jwt,
+         python3-oauthlib,
         python3-psycopg,
         python3-psutil,
         python3-prometheus-client,
@@ -49,7 +51,8 @@ Description: Linux VPN router with IPSec, road-warrior, OpenVPN and WireGuard su
 needs. Its two-level CA, whose root may be kept offline, has issuing CAs for
 the VPN clients, for site-to-site and for general use, and publishes their
 certificates and CRLs. Caddy, installed by the package from the Ubuntu
- archive or from Caddy's repository, serves HTTPS. It keeps metrics of the
+ archive or from Caddy's repository, serves HTTPS, and an optional OpenID
+ Provider signs the directory's users in to other systems. It keeps metrics of the
 router in PostgreSQL and serves them for an OpenTelemetry Collector, and
 makes scheduled backups to a local folder, copied to the cloud with rclone,
 or to a Proxmox Backup Server. Nothing in the package is specific to a cloud
@@ -6,6 +6,7 @@ src/usr/lib/vpn-router/vpnrouter_serve.py             usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_users.py             usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_passkeys.py          usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_auth.py              usr/lib/vpn-router/
+src/usr/lib/vpn-router/vpnrouter_oidc.py              usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_metrics.py           usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_status.py            usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_backup.py            usr/lib/vpn-router/
@@ -29,5 +30,6 @@ src/usr/lib/vpn-router/wait-for-libpq                 usr/lib/vpn-router/
 src/usr/lib/vpn-router/generate-config                usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_platforms/*.py       usr/lib/vpn-router/vpnrouter_platforms/
 src/usr/share/vpn-router/templates/*                  usr/share/vpn-router/templates/
+src/usr/share/vpn-router/sql/*                        usr/share/vpn-router/sql/
 src/usr/lib/systemd/system/caddy.service.d/vpn-router.conf usr/lib/systemd/system/caddy.service.d/
 src/usr/share/doc/vpn-router/vpn-router.json.example  usr/share/doc/vpn-router/
@@ -52,6 +52,7 @@ case "$1" in
              /etc/caddy/vpn-router.Caddyfile \
              /etc/vpn-router/vpn-router.json \
              /etc/vpn-router/web.key \
+              /etc/vpn-router/oidc.key \
              /etc/vpn-router/metrics.secret \
              /etc/systemd/system/vpn-router-backup.timer.d/schedule.conf \
              /etc/sudoers.d/vpn-router \