Skip to content

Comments

Adding environment params for CILogon and OIDC#126

Open
PhillipsOwen wants to merge 9 commits intodevelopfrom
issue-125
Open

Adding environment params for CILogon and OIDC#126
PhillipsOwen wants to merge 9 commits intodevelopfrom
issue-125

Conversation

@PhillipsOwen
Copy link

@PhillipsOwen PhillipsOwen commented Feb 18, 2026

Update the appstore deployment to support CILogon and open id connect (OIDC) enablement and configuration details.

the appstore is expecting the following environment parameters to be populated within the helm charts.
CILOGON_NAME
CILOGON_KEY
CILOGON_SITES
CILOGON_CLIENT_ID
CILOGON_SECRET
OIDC_NAME
OIDC_CLIENT_ID
OIDC_SECRET
OIDC_SERVER_URL

@waTeim
Copy link
Contributor

waTeim commented Feb 18, 2026

Ok so a couple of minor things. The values file should have some default values for all of these new variables, or at minimum some documentation. The good news is that helm if is falsey, so "" is considered false, and your if block disinclusion will work by default.

I don't think this is a bug-fix version (5.0.1) but is at least 5.1. It does seem to be backwards compatible though.

Likewise this requires a change to appstore container to work, so the chart needs a bump to the appversion. I suspect that version will be 4.4 (also more than simply a bug fix, but also backwards compatible).

I'm not sure sure about semantically treating OIDC as just more OAuth, but there's a argument to be had there. However, if OIDC is on and OAuth is also on, what happens to the user mapping. In other words should OIDC on mean the plain old OAuth is off because the user mapping logic will fail? Or can they co-exist, but you'd never do it in practice?

@PhillipsOwen
Copy link
Author

PhillipsOwen commented Feb 18, 2026

re defaults: i adopted the manner which was in already in use in the repo. the values.yaml has all params defined (new and old) and are set to the "" default.

re version : i should have paid more attention to the GH actions.
(1): yes backward compatible. params will default to "" if not set. updated to be 5.1.0 per your recommendation,
(2): updated to be 4.4.0. per your recommendation.

re OIDC: there should be an understanding that the SSO providers (UNC, Google, GitHub), federated identity brokers (CILogon) an open id connect broker (Dex) are mutually exclusive and should never occur together in the same deploy.

Copy link
Contributor

@frostyfan109 frostyfan109 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@waTeim waTeim self-requested a review February 18, 2026 19:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants