bruno/flowdeck
1
1
Fork 0
Code Issues 9 Pull Requests Actions 2 Packages Projects 1 Releases 20 Wiki Activity

feat: v6.7.0 — SSO/SAML + OIDC entreprise (SP SAML signé + OIDC PKCE, auto-provisioning, groupes IdP → rôles workspace, SSO only, onglet Settings « SSO / Enterprise », API /api/v2/sso/*, help, migration 23, docs + OpenAPI 439 chemins) · 802 tests verts
FlowDeck CI / lint (push) Successful in 1m28s
Details
FlowDeck CI / test (push) Successful in 11m52s
Details
FlowDeck CI / docker (push) Successful in 1m51s
Details

Browse Source
This commit is contained in:
bruno
2026-09-24 13:32:17 -04:00
parent 9562f30366
commit d074689b18
25 changed files with 4507 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/V6_SSO_SAML_Enterprise_Auth.md
+16 -14
View File
@@ -1,6 +1,6 @@
# V6.0.0 — SSO / SAML : Enterprise Authentication
> **Statut** : Conception détaillée — v6.0.0
> **Statut** : ✅ **Livré en v6.7.0** (2026-09-24) — conception historique ci-dessous
> **Date** : 2026-09-15
> **Route** : `feat/v6-sso-saml` → `develop` → `main`
> **Dépendances** : v4.0.0 Accounts & Integrations (OAuth2 Gitea/GitHub existant)
@@ -181,7 +181,7 @@ SSO_PROVIDER=saml
SSO_ENTITY_ID=https://sts.windows.net/{tenant-id}/
SSO_SSO_URL=https://login.microsoftonline.com/{tenant-id}/saml2
SSO_SLO_URL=https://login.microsoftonline.com/{tenant-id}/saml2/logout
SSO_X509_CERT="-----BEGIN CERTIFICATE-----\n..."
SSO_X509_CERTIFICATE="-----BEGIN CERTIFICATE-----\n..."
SSO_ATTRIBUTE_MAPPING={"login":"nameid","email":"email","full_name":"name"}
SSO_AUTO_PROVISION=true
SSO_DEFAULT_WORKSPACE_ID=1
@@ -432,18 +432,20 @@ ALTER TABLE users ADD COLUMN auth_method TEXT DEFAULT 'local';
## 9. Checklist d'implémentation
1. **`auth/providers/saml_provider.py`** — wrapper python3-saml ou pysaml2
2. **`auth/providers/oidc_provider.py`** — wrapper OIDC (authlib ou httpx)
3. **`auth/routers/sso.py`** — endpoints SSO/OIDC
4. **Migration `sso_config`** + `sso_login_history` + colonne `auth_method` sur `users`
5. **`services/sso_provisioning.py`** — auto-provision + group mapping
6. **Extension `settings.html`** — UI admin SSO
7. **Extension `login.html`** — boutons SSO
8. **SP metadata endpoint** (`/auth/saml/metadata`)
9. **Security** — validation assertions, rate limiting, audit log
10. **Tests** — tous les scénarios SSO
11. **Documentation utilisateur** — `/help` section SSO setup
12. **Dépendance** — `python3-saml` ou `pysaml2`, `authlib` dans requirements.txt
> ✅ **Tout est livré en v6.7.0** (`tests/test_v67_sso.py`, 38 tests) :
1. ✅ **`auth/providers/saml_provider.py`** — wrapper python3-saml (`app/auth/providers/saml_provider.py`)
2. ✅ **`auth/providers/oidc_provider.py`** — wrapper OIDC authlib (`app/auth/providers/oidc_provider.py`)
3. ✅ **`routers/sso.py`** — endpoints SSO/OIDC (`app/routers/sso.py` + API admin `/api/v2/sso/*`)
4. ✅ **Migration 23 `sso_config`** + `sso_login_history` + `sso_requests` + colonne `auth_method` sur `users` (déjà présente)
5. ✅ **`services/sso_provisioning.py`** — auto-provision + group mapping
6. ✅ **Extension `settings.html`** — UI admin SSO (onglet « SSO / Enterprise »)
7. ✅ **Extension page de login** — boutons SSO (nom dynamique)
8. ✅ **SP metadata endpoint** (`/auth/saml/metadata`)
9. ✅ **Security** — validation assertions (sign/aud/dest/InResponseTo), anti-replay `sso_requests`, rate limit login, historique
10. ✅ **Tests** — `tests/test_v67_sso.py` : 38 scénarios (flots SAML/OIDC, négatifs, groupes, sso_only, SLO)
11. ✅ **Documentation utilisateur** — `/help` section « SSO (Enterprise) »
12. ✅ **Dépendance** — `python3-saml==1.16.0`, `authlib==1.8.0`, `cryptography>=42.0` dans requirements.txt
---