From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 7D24D1FF0EA for ; Thu, 13 Aug 2026 17:58:40 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 4931C21973; Thu, 13 Aug 2026 17:58:40 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=azharul.com; s=t28hkp5; t=1786373249; x=1786978049; darn=lists.proxmox.com; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=64sCD/CbsLr/QZisSGUZ2275AiTaul69U+vGa0NtKqo=; b=WCMYDqfq5vX5F1V1XfsLX6EVKbhHBsd93kObQmPum7QFkIM6y0Y94pXvA5Se3CkjrR WCx2nlHOcUWKxN0GYhwWanPUlVDgjKdSiGC7IVcnw+DBvMylqE6d/PrfWQt8LeobuDdg GLwv53/V4uwbz5giQQPa30nFHza3O4uhvUH1ACQG8rxZbcZhN/e2EzQ7UxQ6Yb8H07Ap xqjShL02IrO+yD0FNw5pTLpGvlNnGoRStMzv4QKurEqbyUs0sSI728lVUcmKxvCG8ubo X7Ji3RvaCHacyuS6kEkoTpEqUegu9RmUxaZnYqO3tz6wa7U6Te8biENaZ8QMj0DkYJ4U kqrw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786373249; x=1786978049; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=64sCD/CbsLr/QZisSGUZ2275AiTaul69U+vGa0NtKqo=; b=b939sYiCAKpbywBIAiPFGBuF1gL9oB2ZPEhDIvWWfV8dEZPZ0+VpvLFOwJMUKCCGp6 WKqHYwfuYhzEtNNMee+gRlqmvFUfGR2PSGJ8n7Wbp8HTPiBIyOX9sHu89FKq0M+kRJTu qhG03qTTre8RaHhZ0evcY8yjXrF63hiFLVB0eQqAlTlWssh2pfQfiAu8mmzsVeELQHB/ 6FvVBWpf+tl22k1hFizyQumLfK9Sb14pLUrPwSdNkQoM3jKaj8arjNqzlKTqCpzOkS9d tXUp9bqVCUC5AQ/BXMqnI2locH7OUv3sdve3+OlZ/Hp6rSyGRhtkJJ6j1422c+FMZVlR NDrA== X-Gm-Message-State: AOJu0Yy8gaqEMgxR+mGfYobhXVx2OTaoHWN9Rye+Aj9LQ4lYqcysK+YV ++Ge3dRs9+cW1iP0gUM0H+Z7wu4dPN9ZV82mgn5Lie+V3cHoSmM0fHqvrBqmsd7qSzAq01hgmN+ 1z/i6/w== X-Gm-Gg: AR+sD11uwMXnj59AkgOpoeiTfT0Wi7OtnAGcX5rRP6GVebp7VTS5tlD8nXrp7xfqnqW frAy3e/5jj0dtREckMdsZqerfziNEyYLaGblKQz2mXVekX04Hvqxg5Tv+pqXL2KyZ8xRI0eU/nH w8q4mn4qy2u9+xGGobab6OPEBPWc1wSLhw9/6IIUzVWtHCmJY3mzckAKbGeBD8Aicx8JhhPIYml h9PXKCNSUwMebSJcfb9xM5gJ5x6FW3plg06FFd1eRp++WH9ZOg3ogFhdTnldQhZYmkbdBF69YAm 4Yh2yRLZPEKbTfC3Aid2GYZOGo/QXwopOVKjjR4ebmos5T8iLjXcBHt8W9QqJmLFHqCxX1HU03J 01eYUMZfLK/xR52Pm9rZ5jXrDNfuey1mfe3nR1mYjmIMlIr/aMCYOgxepFC3t/B1NIBfTexyB0A TsLHKoBch047XvuEOQ87Cxt6q8zVK+P6wWtg5e63J/CgU+5rYbRRj4fAIkfUMqPib4xpwBWd+Y5 F9N07HQ1B7kNDUyzRNuIT2PWOlpC14645GaC8A//gkxjb2xuZl5t7BI+FO1qGLtDQcjCmLmRiex mqmKDEUi2HqbCB8feOvJuHjv1VezTQb9eDcPNS0KIMTb8DnhpxW3peFc5Z1bqtjnzuItLMiYWms KzTBQhMIKKUnb2LLrIOkYQjF57QY= X-Received: by 2002:a05:620a:bd3:b0:92e:ea8d:5c89 with SMTP id af79cd13be357-93671f33facmr2206609485a.40.1786373249100; Mon, 10 Aug 2026 07:47:29 -0700 (PDT) From: Azharul Haque To: pve-devel@lists.proxmox.com Subject: [PATCH v2 0/7] app: implement OpenID Connect (OAuth) realm login (#4281) Date: Mon, 10 Aug 2026 10:47:06 -0400 Message-ID: <20260810144713.75806-1-haque@azharul.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL -0.020 Adjusted score from AWL reputation of From: address DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy POISEN_SPAM_PILL 0.1 Meta: its spam POISEN_SPAM_PILL_1 0.1 random spam to be learned in bayes POISEN_SPAM_PILL_3 0.1 random spam to be learned in bayes RCVD_IN_DNSWL_NONE -0.0001 Sender listed at https://www.dnswl.org/, no trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record X-MailFrom: haque@azharul.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation Message-ID-Hash: G56H7HOEKAK7KDEIWG2VS4PNN4D6N4LV X-Message-ID-Hash: G56H7HOEKAK7KDEIWG2VS4PNN4D6N4LV X-Mailman-Approved-At: Thu, 13 Aug 2026 17:58:30 +0200 CC: haque@azharul.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The native Flutter "Proxmox VE Companion" app never implemented OpenID Connect / OAuth realm login (bug #4281[0]): selecting an OAuth realm just showed username/password fields that could never work. v2: resending as a single combined series across all three affected repositories, per feedback -- each patch subject is now prefixed with the (shortened) repository name it applies to. No functional changes from v1. This series spans three repositories and should be applied together: dart-api-client (2 patches): API-layer building blocks for OIDC login -- a `type` property on PveAccessDomainModel to detect OpenID realms, and helpers for PVE's /access/openid/auth-url and /access/openid/login endpoints. login-manager (3 patches): Login-form UI: hide username/password fields for OpenID realms and drive the OAuth flow via flutter_web_auth_2 (system browser / ASWebAuthenticationSession on iOS, Chrome Custom Tabs on Android -- deliberately not an in-app webview); a fix for a stale Continue button state when switching realms; and namespacing the OpenID redirect scheme under Proxmox's own reserved com.proxmox.* package prefix to avoid Android custom-URL-scheme collisions. flutter-frontend (2 patches): Android-side wiring: register flutter_web_auth_2's CallbackActivity in AndroidManifest.xml for the OpenID redirect scheme, and a follow-up fix to match a later rename of that scheme. No iOS-side changes are required here -- ASWebAuthenticationSession resolves the custom-scheme redirect at runtime without a static declaration equivalent to the Android manifest entry. Verified end-to-end against a real PVE server with an Authentik OIDC realm, on both Android and iOS. [0] https://bugzilla.proxmox.com/show_bug.cgi?id=4281 Azharul Haque (7): fix #4281: access: add `type` property to `PveAccessDomainModel` fix #4281: access: add OpenID Connect auth-url/login helpers fix #4281: ui: add OpenID Connect login flow to login form fix #4281: ui: fix stale Continue button state on realm switch fix #4281: ui: use a namespaced OpenID callback scheme fix #4281: android: register OpenID Connect callback activity fix #4281: android: match renamed OpenID callback scheme -- 2.50.1 (Apple Git-155)