What's New
- Added OpenID Connect login for discovery-compatible providers such as Pocket ID and Authentik.
- Added OIDC configuration for the provider name, issuer URL, client credentials, and scopes in Settings.
- OIDC can be used alongside local password login or as the only login method.
- Added PKCE, state and nonce validation, signed ID token verification, and callback replay protection.
Setup
Set the SubTrackr Base URL, configure the provider in Settings, and register the displayed /auth/oidc/callback URL with the identity provider.
OIDC access is controlled by the identity provider. Assign the SubTrackr client only to the users or groups that should have access.
Existing local username/password authentication remains supported and requires no migration. If the Base URL uses HTTPS, access SubTrackr through HTTPS so secure login cookies work correctly.
Thanks to @Gandalf-the-Blue for requesting OIDC support and to @smokey007 and @Silther for the earlier discussion.