Skip to content

Navigation Menu

Appearance settings

- AI CODE CREATION
  GitHub CopilotWrite better code with AI
  GitHub Copilot appDirect agents from issue to merge
  MCP Registry^NewIntegrate external tools
- DEVELOPER WORKFLOWS
  ActionsAutomate any workflow
  CodespacesInstant dev environments
  IssuesPlan and track work
  Code ReviewManage code changes
- APPLICATION SECURITY
  GitHub Advanced SecurityFind and fix vulnerabilities
  Code securitySecure your code as you build
  Secret protectionStop leaks before they start
- EXPLORE
  Why GitHub
  Documentation
  Blog
  Changelog
  Marketplace
View all features
- BY COMPANY SIZE
  Enterprises
  Small and medium teams
  Startups
  Nonprofits
- BY USE CASE
  App Modernization
  DevSecOps
  DevOps
  CI/CD
  View all use cases
- BY INDUSTRY
  Healthcare
  Financial services
  Manufacturing
  Government
  View all industries
View all solutions
- EXPLORE BY TOPIC
  AI
  Software Development
  DevOps
  Security
  View all topics
- EXPLORE BY TYPE
  Customer stories
  Events & webinars
  Ebooks & reports
  Business insights
  GitHub Skills
- SUPPORT & SERVICES
  Documentation
  Customer support
  Community forum
  Trust center
  Partners
View all resources
- COMMUNITY
  GitHub SponsorsFund open source developers
- PROGRAMS
  Security Lab
  Maintainer Community
  Accelerator
  GitHub Stars
  Archive Program
- REPOSITORIES
  Topics
  Trending
  Collections
- ENTERPRISE SOLUTIONS
  Enterprise platformAI-powered developer platform
- AVAILABLE ADD-ONS
  GitHub Advanced SecurityEnterprise-grade security features
  Copilot for BusinessEnterprise-grade AI features
  Premium SupportEnterprise-grade 24/7 support
Pricing

Search code, repositories, users, issues, pull requests...

Search

Clear

Search syntax tips

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches

Use saved searches to filter your results more quickly

Name

Query

To see all available qualifiers, see our documentation.

Appearance settings

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

Uh oh!

There was an error while loading. Please reload this page.

dotCMS / core Public

Notifications You must be signed in to change notification settings
Fork 480
Star 946

Code
Issues 927
Pull requests 43
Discussions
Actions
Projects
Security and quality
Insights

Additional navigation options

Code
Issues
Pull requests
Discussions
Actions
Projects
Security and quality
Insights

feat(auth): migrate dotAuth (OAuth/OIDC + SAML) from plugin to core#36228

Open

swicken wants to merge 138 commits into

maindotCMS/core:mainfrom

feat/dotauth-core-migrationdotCMS/core:feat/dotauth-core-migrationCopy head branch name to clipboard

Conversation Commits138 (138)Checks Files changed

Open

feat(auth): migrate dotAuth (OAuth/OIDC + SAML) from plugin to core#36228
swicken wants to merge 138 commits into
mainfrom
feat/dotauth-core-migration

Commits

Commits on Jun 18, 2026

feat(auth): migrate OAuth 2.0 / OIDC provider from plugin to core
swicken
committed
docs(auth): add dotAuth phase-2 design doc and implementation plan
swicken
committed
refactor(auth): rename AppSecrets key dotOAuth -> dotAuth
swicken
committed
chore(auth): remove dotOAuth apps YAML; portlet is the sole editor
swicken
committed
feat(auth): add dotAuth REST DTOs
swicken
committed
feat(auth): add DotAuthResource REST endpoints
swicken
committed
feat(auth): wire /v1/dotauth into DotRestApplication
swicken
committed
feat(auth): register dotAuth portlet in portlet.xml
swicken
committed
feat(auth): add dotAuth i18n keys
swicken
committed
feat(dot-auth): scaffold Nx library libs/portlets/dot-auth
swicken
committed
feat(dot-auth): data-access service and models
swicken
committed
feat(dot-auth): list SignalStore
swicken
committed
feat(dot-auth): list component, edit dialog, shell and routes
swicken
committed
feat(dot-auth): register dotAuth route in app shell
swicken
committed
feat(dot-auth): add startup task to register dotAuth portlet in Settings layout
swicken
committed
fix(dot-auth): rename p-inputSwitch to p-toggleswitch; apply lint auto-fixes; regenerate openapi
swicken
committed
fix(auth): lowercase host identifiers when looking up in appKeysByHost map
swicken
committed
fix(auth): lowercase APP_KEY lookup in listSites; add temp /v1/dotauth/debug
swicken
committed
docs(auth): add dotAuth phase-3 SAML integration design
swicken
committed
docs(auth): add dotAuth phase-3 implementation plan
swicken
committed
feat(auth): add DotAuthProtocol enum
swicken
committed
feat(auth): add ProtocolHandler strategy interface
swicken
committed
refactor(auth): extract OAuthProtocolHandler from DotAuthResource
swicken
committed
feat(auth): add SamlProtocolHandler with SAML_SECRET_KEYS
swicken
committed
feat(auth): add protocol field to DotAuth REST DTOs
swicken
committed
chore(auth): update phase-3 tasks.json — tasks 0-4,6 complete
swicken
committed
feat(auth): DotAuthResource dispatches on protocol; dual-key read/write/delete + MX
swicken
committed
feat(dot-auth): widen models to discriminated union on protocol
swicken
committed
feat(dot-auth): protocol column + composed status tag in list
swicken
committed
feat(dot-auth): protocol toggle + SAML fieldsets in edit dialog
swicken
committed
feat(dot-auth): i18n keys for SAML protocol + fieldsets
swicken
committed
test(dot-auth): SAML coverage for list component + storeAlso fix store initialState missing the new `protocol` field on systemand add `isolatedModules: true` to tsconfig.spec.json per repo standard.
swicken
committed
test(dot-auth): SAML + protocol-switch coverage for edit component
swicken
committed
fix(auth): correct HostAPI import in DotAuthResourceTest
swicken
committed
fix(dot-auth): use TextareaModule + pTextarea; stabilize list/store specs
swicken
committed
fix(dot-auth): drop unused store variable in list component spec
swicken
committed
feat(dot-auth): SAML custom attributes + metadata download button
swicken
committed
feat(dot-auth): widen edit dialog to min(96vw, 1040px) for SAML density
swicken
committed
feat(dot-auth): redirect /apps/dotsaml-config to the dotAuth portlet
swicken
committed
feat(dot-auth): hide dotsaml-config from the Apps grid
swicken
committed
chore(auth): remove temp /v1/dotauth/debug endpoint
swicken
committed
chore(auth): finalize phase-3 tasks.json — all tasks complete
swicken
committed
refactor(dot-auth): address PR review findings
swicken
committed
style(dot-auth): prettier-format shell template and route callback
swicken
committed
fix(oauth): harden OAuth/OIDC flow against PR-review security findings
swicken
committed
fix(dotauth): harden REST endpoints, startup task, and plugin path-collision check
swicken
committed
refactor(dot-auth): align components with ANGULAR_STANDARDS
swicken
committed
test(dot-auth): close PR-review coverage gaps in the dotAuth spec suite
swicken
committed
chore(dot-auth): remove planning docs from PR scope
swicken
committed
fix(oauth): tighten OIDC/OAuth flow against alg, mode, session, and VTL leaks
swicken
committed
fix(dotauth): save-first atomicity, case-insensitive SYSTEM_HOST, SAML key guard
swicken
committed
test(dotauth): normalize new backend tests to JUnit 5
swicken
committed
fix(dot-auth): @for track order, loadSites recovery, edit-component error routing
swicken
committed
fix(dot-apps): scope import-success Subject and rename export-button predicate
swicken
committed
feat(oauth): add BuildRolesStrategy and extract resolveOrProvisionUser
swicken
committed
feat(oidc): expose validateIdTokenAndExtractClaims returning full claim set
swicken
committed
feat(dotauth): add DotAuthSession model and cache for session-ref bearer tokens
swicken
committed
feat(dotauth): add OAuth exchange endpoint and session-ref credential processor
swicken
committed
chore(justfile): add dev-run-headless recipes for oauth exchange flag
swicken
committed
fix(dotauth): tighten OIDC iss check + stop leaking exception detail
swicken
committed
test(dotauth): cover the exchange guard paths, role-strategy, and OIDC claims
swicken
committed
docs(dotauth): flag OAuth role-wipe default and logout-via-bearer trade-off
swicken
committed
fix(dotauth): close role-sync race and clampExpirationDays misconfig gaps
swicken
committed
fix(auth): address dotAuth review findings
swicken
committed
fix(auth): address jsanca review feedback
swicken
committed
fix(auth): avoid leaking OIDC validation details
swicken
committed
fix(oauth): sync JIT user profile names
swicken
committed
Hash OAuth user ids
swicken
committed
feat(dotauth): add OAuth role sync strategy option
swicken
committed
proper error handling
swicken
committed
make things required
swicken
committed
initial redesign commit
swicken
committed
dotAuth UI redesign + headless security wiring
swicken
committed
refactor(dotauth): extract config into child components and clean up list
swicken
committed
chore(dotauth): remove legacy dot-auth-edit component
swicken
committed
fix(dotauth): wire SAML metadata fetch button with placeholder toast
swicken
committed
fix(dotauth): rename change outputs to fieldChange to avoid native event collision
swicken
committed
fix(dotauth): save headless config when no SSO protocol is selected
swicken
committed
refactor(dotauth): separate headless config into own app key (system-only)
swicken
committed
refactor(dotauth): split SSO and headless into separate config pages
swicken
committed
fix(dotauth): update specs after dialog-to-routed-config refactor
swicken
committed
style(dotauth): apply formatter fixes from pre-commit hook
swicken
committed
chore(dotauth): remove dead code, extract i18n, improve accessibility
swicken
committed
chore(dotauth): refresh headless dev reload flow
swicken
committed
feat(dotauth): handle unauthorized SSO users
swicken
committed
feat(dotauth): refine SSO configuration UI
swicken
committed
feat(dotauth): add config bundle import export
swicken
committed
fix(dotauth): harden export endpoint and fix i18n gaps
swicken
committed
fix(dotauth): replace per-call ObjectMapper with static singleton
swicken
committed
fix(dotauth): remove unused stats computed from list store
swicken
committed
fix(dotauth): surface URL validation rejections in standard logs
swicken
committed
chore(dotauth): apply formatter whitespace cleanup
swicken
committed
fix(dotauth): eliminate SSRF DNS rebinding and require admin for session revoke
swicken
committed
fix(dotauth): deduplicate auth utilities and harden config parsing
swicken
committed
fix(dotauth): fix ConfirmationService crash, i18n gaps, and dead code
swicken
committed
fix(dotauth): auto-derive OAuth callback URL from request like SAML does
swicken
committed
fix(build): add missing <name> to docker imagesMap in child POM
swicken
committed
fix(dotauth): add missing TOC i18n keys, fix ACS URL and section spacing
swicken
committed
chore(dotauth): apply auto-formatting and add structuredClone polyfill
swicken
committed
test(dotauth): add mapper unit tests for config view/payload round-trip
swicken
committed
fix(dotauth): map OIDC autoProvision from its own field instead of the SSO-enabled toggle
swicken
committed
fix(dotauth): address code review findings across OAuth/OIDC layer
swicken
committed
refactor(dotauth): remove unused CORE_REST_PATHS OSGI conflict guard
swicken
committed
fix(dotauth): add missing @ApiResponses and register session cache with CacheLocator
swicken
committed
fix(dotauth): let non-OAuth logout requests fall through to LogoutResource
swicken
committed
feat(dotauth): auto-generate SAML SP signing keypair on save
swicken
committed
feat(dotauth): add SAML metadata fetch and restructure IdP section
swicken
committed
refactor(dotauth): remove dead imports from DotAuthResource
swicken
committed
refactor(dotauth): use UtilMethods.isSet() for null/blank guards in DotAuthResource
swicken
committed
refactor(dotauth): promote SecureRandom to static field and use UtilMethods.isSet() in SamlKeyPairGenerator
swicken
committed
refactor(dotauth): use UtilMethods.isSet() for blank check in SamlProtocolHandler
swicken
committed
refactor(dotauth): extract duplicate isInternalHost() SSRF guard to shared OAuthSsrfGuard
swicken
committed
ci: re-trigger PR checks after cancelled run
swicken
committed
refactor(dotauth): extract SQL to static constants in startup task to satisfy semgrep
swicken
committed
fix(dotauth): align unit tests with listSites search() API and new portlet count
swicken
committed
fix(dotauth): enforce autoProvision, honor per-IdP config, fix logout id_token_hint
swicken
committed
fix(dotauth): add SSRF guard to proxy endpoints, namespace users by issuer
swicken
committed
fix(dotauth): translate IdP role behavior, validate IdP issuer, consolidate SSRF guard
swicken
committed
fix(dotauth): harden OIDC token validation — JWKS refresh, at_hash, nonce timing
swicken
committed
add to justfile
swicken
committed
fix SAML generation
swicken
committed
undo launch.json change
swicken
committed
stuff
swicken
committed
fix(dotauth): deterministic protocol resolution, toast timing, save correctness
swicken
committed
fix(security): harden OAuth callback, response size limits, redirect sanitization
swicken
committed
Visual changes
swicken
committed
fix(saml): gate only back-end SAML logins through the no-access role check
swicken
committed
fix(dotauth): address adversarial security review findings
swicken
committed
fix(dotauth): resolve merge-blocking review findings
swicken
committed
chore(dotauth): apply Tailwind v4 var-shorthand normalization from lint fixer
swicken
committed
fix(dotauth): fail closed on id_token replay fingerprint
swicken
committed
fix(dotauth): allow 60s clock skew on OIDC id_token exp check
swicken
committed
chore(core-web): sync pnpm-lock after yarn→pnpm rebase
swicken
committed
style(dot-auth): apply prettier formatting to two templates
swicken
committed

Commits on Jun 22, 2026

test(portal): bump expected portlet count to 55 for dotAuth portlet
swicken
committed
fix(dotauth): derive OAuth callback URL from request when not configured
swicken
committed
fix(dotauth): remove non-functional View audit log link from emergency controls
swicken
committed
fix(dotauth): return to originally-requested page after front-end OAuth login
swicken
committed

Footer

© 2026 GitHub, Inc.

Footer navigation

Terms
Privacy
Security
Status
Community
Docs
Contact

You can’t perform that action at this time.