github-starred/actual
2
0
Fork 0
mirror of https://github.com/actualbudget/actual.git synced 2026-07-16 07:04:23 -05:00
Code Issues 3.0k Packages Projects Releases 58 Wiki Activity

[PR #1164] [CLOSED] Add OpenID Connect authentication #73546

New Issue
Closed
opened 2026-05-16 14:42:49 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-05-16 14:42:49 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/actualbudget/actual/pull/1164
Author: @apilat
Created: 6/22/2023
Status: ❌ Closed

Base: master ← Head: openid

📝 Commits (5)

  • e3a1cd6 OpenId implementation
  • cb75f63 Fix bootstrap (doesn't include OpenID yet)
  • 03acb3b Add frontend for OpenID bootstrap
  • 2e13fed Address code review
  • 28c323e Fix typecheck and add release notes

📊 Changes

8 files changed (+257 additions, -37 deletions)

View changed files

📝 packages/desktop-client/src/components/manager/ManagementApp.js (+4 -0)
📝 packages/desktop-client/src/components/manager/subscribe/Bootstrap.tsx (+56 -12)
📝 packages/desktop-client/src/components/manager/subscribe/Login.tsx (+52 -19)
➕ packages/desktop-client/src/components/manager/subscribe/OpenIdCallback.tsx (+16 -0)
➕ packages/desktop-client/src/components/manager/subscribe/OpenIdForm.tsx (+76 -0)
📝 packages/loot-core/src/server/main.ts (+30 -5)
📝 packages/loot-core/src/types/main-handlers.d.ts (+17 -1)
➕ upcoming-release-notes/1164.md (+6 -0)

📄 Description

Partially addresses #61 and #515 by adding support for OpenID Connect and generally a more flexible approach to authenticating with the server. Sister PR for server available as actualbudget/actual-server#219

The flow of the bootstrap/login process is

  • client sends /bootstrap request which now accepts an additional parameter openid: {issuer, client_id, client_secret, server_hostname}.
  • client can request GET /login-methods to receive a list of supported login methods (currently password or openid)
  • client sends POST /login-openid with return_url parameter (pointing back to the frontend), server returns redirect_url leading to the openid issuer, client redirects
  • user authenticates with openid provider, which redirects to /login-openid/cb on server
  • server verifies openid authentication, then redirects to /login/openid-cb on client, passing the token
  • client saves token and registers sign in

Some of the changes in the code and not backwards compatible (most importantly server SQL schema and /account/bootstrap behavior). I'm not sure what the project's approach to such changes is - it might be possible to add in special cases to allow a client to connect to an older server. However, this might not be necessary if users are expected to self-host instances and upgrade the server and client in tandem.
A more pressing issue is database schema migration - I couldn't find any precedent for how this is done in the server so I would appreciate the maintainer's view on the best approach to do this.

For a user that doesn't use OpenID, this PR slightly changes the bootstrap behavior for passwords as well. Namely, after setting up the password in /bootstrap, the user isn't instantly granted access but instead redirected to /login. This is quite an important change for OpenID as otherwise the user has no way of knowing whether the OpenID configuration works at all. In the case of password authentication, misconfiguration is less likely but nevertheless double-checking the user remembers the password doesn't seem too inconvenient to me.

I am not very familiar with React, so let me know if I have broken any coding conventions. Likewise with web design, I welcome improvements to the presentation of the login/bootstrap screens.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/actualbudget/actual/pull/1164 **Author:** [@apilat](https://github.com/apilat) **Created:** 6/22/2023 **Status:** ❌ Closed **Base:** `master` ← **Head:** `openid` --- ### 📝 Commits (5) - [`e3a1cd6`](https://github.com/actualbudget/actual/commit/e3a1cd63c439178fe84a5e7a6f8a44c2e1c8ad36) OpenId implementation - [`cb75f63`](https://github.com/actualbudget/actual/commit/cb75f63667aaa45906ec88b83f3d2cac68c031e8) Fix bootstrap (doesn't include OpenID yet) - [`03acb3b`](https://github.com/actualbudget/actual/commit/03acb3b8c5b812d7e0ae38de9c84c335f6cf337c) Add frontend for OpenID bootstrap - [`2e13fed`](https://github.com/actualbudget/actual/commit/2e13fede6accdb701a247a9b0597d91a199b8bf3) Address code review - [`28c323e`](https://github.com/actualbudget/actual/commit/28c323e4cf64cc6cb343996708b91a8f2e443656) Fix typecheck and add release notes ### 📊 Changes **8 files changed** (+257 additions, -37 deletions) <details> <summary>View changed files</summary> 📝 `packages/desktop-client/src/components/manager/ManagementApp.js` (+4 -0) 📝 `packages/desktop-client/src/components/manager/subscribe/Bootstrap.tsx` (+56 -12) 📝 `packages/desktop-client/src/components/manager/subscribe/Login.tsx` (+52 -19) ➕ `packages/desktop-client/src/components/manager/subscribe/OpenIdCallback.tsx` (+16 -0) ➕ `packages/desktop-client/src/components/manager/subscribe/OpenIdForm.tsx` (+76 -0) 📝 `packages/loot-core/src/server/main.ts` (+30 -5) 📝 `packages/loot-core/src/types/main-handlers.d.ts` (+17 -1) ➕ `upcoming-release-notes/1164.md` (+6 -0) </details> ### 📄 Description Partially addresses #61 and #515 by adding support for OpenID Connect and generally a more flexible approach to authenticating with the server. Sister PR for server available as actualbudget/actual-server#219 The flow of the bootstrap/login process is - client sends `/bootstrap` request which now accepts an additional parameter `openid: {issuer, client_id, client_secret, server_hostname}`. - client can request `GET /login-methods` to receive a list of supported login methods (currently password or openid) - client sends `POST /login-openid` with `return_url` parameter (pointing back to the frontend), server returns `redirect_url` leading to the openid issuer, client redirects - user authenticates with openid provider, which redirects to `/login-openid/cb` on server - server verifies openid authentication, then redirects to `/login/openid-cb` on client, passing the token - client saves token and registers sign in Some of the changes in the code and not backwards compatible (most importantly server SQL schema and /account/bootstrap behavior). I'm not sure what the project's approach to such changes is - it might be possible to add in special cases to allow a client to connect to an older server. However, this might not be necessary if users are expected to self-host instances and upgrade the server and client in tandem. A more pressing issue is database schema migration - I couldn't find any precedent for how this is done in the server so I would appreciate the maintainer's view on the best approach to do this. For a user that doesn't use OpenID, this PR slightly changes the bootstrap behavior for passwords as well. Namely, after setting up the password in /bootstrap, the user isn't instantly granted access but instead redirected to /login. This is quite an important change for OpenID as otherwise the user has no way of knowing whether the OpenID configuration works at all. In the case of password authentication, misconfiguration is less likely but nevertheless double-checking the user remembers the password doesn't seem too inconvenient to me. I am not very familiar with React, so let me know if I have broken any coding conventions. Likewise with web design, I welcome improvements to the presentation of the login/bootstrap screens. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-05-16 14:42:49 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
AI generated
API
bank sync
budgeting
bug
can’t replicate
dependencies
docker
documentation
electron
experimental feature
feature
feedback
goal templates
good first issue
help wanted
importers
maintenance
needs info
needs testing
needs triage
needs votes
openid
payees
pull-request
Mirrored from GitHub Pull Request
 regression
reports
responsive
rules
schedules
server
✨ merged
split transactions
tech debt
tech-support
theme
transaction import
transaction reconciliation
transactions
translations
upstream
user interface
✅ approved
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/actual#73546
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?