Cordy/cairn-license-server
1
0
Fork 0
Code Issues 4 Pull requests Projects Releases Packages Wiki Activity Actions

Enable OAuth sign-in: register Google + Microsoft apps, set env (manual) #22

New issue
Open
opened 2026-08-24 00:11:56 +00:00 by Cordy · 1 comment
Cordy commented 2026-08-24 00:11:56 +00:00
Owner
Copy link

Code is live (#21, deployed). The buttons appear on enter.html automatically once the server has credentials — nothing else to deploy. Two registrations + one env edit:

1. Google (free, ~5 min)

console.cloud.google.com → new project (e.g. cairn-site) →

  • OAuth consent screen (now "Google Auth Platform / Branding"): External; app name Cairn; support email; authorized domain swisscairn.ch. Publish the app (stays in "production" — only openid/email scopes, no verification review needed).
  • Credentials → Create credentials → OAuth client ID → type Web application:
    • Authorized redirect URI: https://license.swisscairn.ch/v1/oauth/google/callback
  • Copy the client ID + secret.

2. Microsoft (free, ~5 min)

entra.microsoft.com → App registrations → New registration:

  • Supported account types: Accounts in any organizational directory and personal Microsoft accounts (the flow uses /common).
  • Platform Web, redirect URI: https://license.swisscairn.ch/v1/oauth/microsoft/callback
  • Certificates & secrets → new client secret (note the expiry — Entra caps at 24 months; calendar a renewal).
  • Token configuration → Add optional claim → ID → xms_edov (and email if offered). Without xms_edov, work/school accounts are treated as unverified (nOAuth guard) and can't auto-create/link — personal Microsoft accounts work either way.

3. VPS env

Append to /etc/cairn-license/env:

OAUTH_GOOGLE_CLIENT_ID=...
OAUTH_GOOGLE_CLIENT_SECRET=...
OAUTH_MICROSOFT_CLIENT_ID=...
OAUTH_MICROSOFT_CLIENT_SECRET=...

then sudo systemctl restart cairn-license-server.

4. Verify

  • curl -s https://license.swisscairn.ch/v1/oauth/providers → {"providers":["google","microsoft"]}
  • enter.html now shows both buttons; click through with a real Google account → should land in the dashboard.
  • Journal shows oauth sign-in enabled providers=... at boot and oauth sign-in provider=... account=created|linked|existing per login.

Notes: defaults OAUTH_PUBLIC_ORIGIN=https://license.swisscairn.ch and OAUTH_SITE_ORIGIN=https://www.swisscairn.ch need no env unless those move. OAuth-created accounts have no password; the normal reset-email flow sets one. Secrets live only in /etc/cairn-license/env — never in git.

Code is live (#21, deployed). The buttons appear on enter.html automatically once the server has credentials — nothing else to deploy. Two registrations + one env edit: ## 1. Google (free, ~5 min) [console.cloud.google.com](https://console.cloud.google.com) → new project (e.g. `cairn-site`) → - **OAuth consent screen** (now "Google Auth Platform / Branding"): External; app name `Cairn`; support email; authorized domain `swisscairn.ch`. Publish the app (stays in "production" — only openid/email scopes, no verification review needed). - **Credentials → Create credentials → OAuth client ID** → type **Web application**: - Authorized redirect URI: `https://license.swisscairn.ch/v1/oauth/google/callback` - Copy the client ID + secret. ## 2. Microsoft (free, ~5 min) [entra.microsoft.com](https://entra.microsoft.com) → App registrations → New registration: - Supported account types: **Accounts in any organizational directory and personal Microsoft accounts** (the flow uses `/common`). - Platform **Web**, redirect URI: `https://license.swisscairn.ch/v1/oauth/microsoft/callback` - **Certificates & secrets** → new client secret (note the expiry — Entra caps at 24 months; calendar a renewal). - **Token configuration → Add optional claim → ID → `xms_edov`** (and `email` if offered). Without `xms_edov`, work/school accounts are treated as unverified (nOAuth guard) and can't auto-create/link — personal Microsoft accounts work either way. ## 3. VPS env Append to `/etc/cairn-license/env`: ``` OAUTH_GOOGLE_CLIENT_ID=... OAUTH_GOOGLE_CLIENT_SECRET=... OAUTH_MICROSOFT_CLIENT_ID=... OAUTH_MICROSOFT_CLIENT_SECRET=... ``` then `sudo systemctl restart cairn-license-server`. ## 4. Verify - `curl -s https://license.swisscairn.ch/v1/oauth/providers` → `{"providers":["google","microsoft"]}` - enter.html now shows both buttons; click through with a real Google account → should land in the dashboard. - Journal shows `oauth sign-in enabled providers=...` at boot and `oauth sign-in provider=... account=created|linked|existing` per login. Notes: defaults `OAUTH_PUBLIC_ORIGIN=https://license.swisscairn.ch` and `OAUTH_SITE_ORIGIN=https://www.swisscairn.ch` need no env unless those move. OAuth-created accounts have no password; the normal reset-email flow sets one. Secrets live only in `/etc/cairn-license/env` — never in git.
Cordy commented 2026-08-24 00:34:56 +00:00
Author
Owner
Copy link

Parked 2026-08-24 at the Google consent screen — prerequisite missing.

The "Get started" wizard requires a user support email (shown publicly for consent concerns), and the dropdown only offers the signed-in Google account's own address or Google Groups that account owns/manages — free-text entry is not allowed. Neither exists yet:

  • Set up a proper swisscairn.ch support address (e.g. support@swisscairn.ch, or reuse sales@swisscairn.ch) on the mail side.
  • Make that address selectable in Google's dropdown — either sign the Cloud project up under that identity, or (usual route without Workspace) create a Google Group at groups.google.com with the swisscairn address as a member and the console account as owner/manager; the group then appears in the support-email dropdown.

Then resume at §1 of this issue (consent wizard → client → publish). Microsoft (§2) has no such prerequisite and could be done independently — its registration only wants redirect URI + secret.

**Parked 2026-08-24 at the Google consent screen — prerequisite missing.** The "Get started" wizard requires a **user support email** (shown publicly for consent concerns), and the dropdown only offers the signed-in Google account's own address or Google Groups that account owns/manages — free-text entry is not allowed. Neither exists yet: - [ ] Set up a proper `swisscairn.ch` support address (e.g. `support@swisscairn.ch`, or reuse `sales@swisscairn.ch`) on the mail side. - [ ] Make that address selectable in Google's dropdown — either sign the Cloud project up under that identity, or (usual route without Workspace) create a **Google Group** at [groups.google.com](https://groups.google.com) with the swisscairn address as a member and the console account as owner/manager; the group then appears in the support-email dropdown. Then resume at §1 of this issue (consent wizard → client → publish). Microsoft (§2) has no such prerequisite and could be done independently — its registration only wants redirect URI + secret.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Cordy/cairn-license-server#22
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?