I’m excited to add OpenID Connect sign-in to Riviamigo. You can now let people sign in through an identity provider you already use, while keeping local password sign-in available during setup. I focused on a safe rollout and recovery path, including a way to test the provider before turning SSO on and a documented way to disable it if you need to recover access.
Features
OpenID Connect single sign-on
Riviamigo can now connect to an OpenID Connect provider for SSO. Super-users can configure and test the connection in Settings > Authentication, then choose how it works alongside password login.
The new controls let you:
- Keep local password sign-in available alongside SSO, or disable it after you have tested SSO.
- Choose whether verified provider emails can link to existing accounts and whether new accounts can sign up.
- Limit access by email domain or a required provider claim.
- Choose the SSO button label and optionally start SSO automatically from the login page.
- Choose password, SSO, or both as the sign-in method for an invitation.
OIDC remains off by default, and the first owner is still created through the normal local setup flow. Client secrets are write-only and encrypted when stored. The OIDC setup and recovery guide walks through registering the exact callback and rolling out the provider safely.
Fixes
- Recovered expired browser sessions before sending users to a protected page.
- Prevented the browser from caching an outdated app shell after an update.
- Kept the MapLibre worker on the correct app asset path so maps work in the packaged frontend.
Development, builds, and maintenance
- Updated Rustls to address a security advisory, and documented a narrow, time-limited exception for the RSA dependency used for OIDC verification.
- Updated the runtime PCRE2 package to the security-fixed Debian version flagged by the image scan.
- Expanded frontend coverage for account management and OIDC failure paths, and fixed the Security workflow image scan.
- Added OIDC setup, configuration, and recovery documentation for self-hosters.