feat(core): Add OIDC support for SSO #15988

RicardoE105 · 2025-06-03T17:33:48Z

Summary

Implement OIDC support for single sign on.

Related Linear tickets, Github issues, and Community forum posts

closes https://linear.app/n8n/issue/PAY-2836/spike-implement-support-for-oidc-authentication-method-for-sso

Review / Merge checklist

PR title and summary are descriptive. (conventions)
Docs updated or follow-up ticket created.
Tests included.
PR Labeled with release/backport (if the PR is an urgent fix that needs to be backported)

codecov · 2025-06-12T07:41:14Z

Codecov Report

Attention: Patch coverage is 71.06918% with 138 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...kages/frontend/editor-ui/src/views/SettingsSso.vue	81.73%	42 Missing ⚠️
...s/cli/src/sso.ee/oidc/routes/oidc.controller.ee.ts	0.00%	31 Missing ⚠️
...ackages/frontend/editor-ui/src/stores/sso.store.ts	50.00%	22 Missing ⚠️
...kages/frontend/@n8n/rest-api-client/src/api/sso.ts	7.69%	12 Missing ⚠️
packages/cli/src/sso.ee/oidc/oidc.service.ee.ts	89.13%	1 Missing and 9 partials ⚠️
packages/cli/src/server.ts	0.00%	6 Missing ⚠️
...ges/frontend/editor-ui/src/components/SSOLogin.vue	33.33%	4 Missing ⚠️
packages/@n8n/api-types/src/dto/oidc/config.dto.ts	0.00%	3 Missing ⚠️
packages/cli/src/controllers/me.controller.ts	62.50%	3 Missing ⚠️
packages/cli/src/services/frontend.service.ts	0.00%	2 Missing ⚠️
... and 3 more

📢 Thoughts on this report? Let us know!

cubic-dev-ai

cubic found 7 issues across 41 files. Review them in cubic.dev

_{React with 👍 or 👎 to teach cubic. Tag @cubic-dev-ai to give specific feedback.}

packages/frontend/editor-ui/src/components/SSOLogin.vue

packages/frontend/@n8n/design-system/src/components/N8nUsersList/UsersList.vue

packages/frontend/editor-ui/src/views/SettingsPersonalView.vue

packages/cli/src/server.ts

packages/cli/src/auth/auth.service.ts

packages/@n8n/db/src/entities/user.ts

packages/frontend/@n8n/rest-api-client/src/api/sso.ts

guillaumejacquart

Some comments
I was wondering: we don’t handle refresh tokens — is that a deliberate choice?

packages/@n8n/db/src/entities/user.ts

packages/@n8n/api-types/src/dto/oidc/config.dto.ts

guillaumejacquart · 2025-06-13T08:16:52Z

packages/cli/src/controllers/me.controller.ts

 		const isEmailBeingChanged = email !== currentEmail;
+		const isFirstNameChanged = firstName !== currentFirstName;


(completely optional, just if you think it makes sense)
Maybe we could have some kind of map of auth method => check if can change profile, in order to merge both ldap / oids and saml check into one (because it's doing the same business logic)

packages/cli/src/controllers/me.controller.ts

packages/cli/src/controllers/password-reset.controller.ts

packages/cli/src/sso.ee/oidc/oidc.service.ee.ts

guillaumejacquart · 2025-06-13T08:35:36Z

packages/cli/src/sso.ee/oidc/oidc.service.ee.ts

+	}
+
+	private cachedOidcConfiguration:
+		| Promise<{


Not sure I see the point of having a promise here

A the promise is in the wrong place. the idea is that we can have a code path in getOidcConfiguration that doesn't yield to avoid race conditions.

guillaumejacquart · 2025-06-13T08:38:23Z

packages/cli/src/sso.ee/saml/saml-helpers.ts

@@ -32,6 +33,10 @@ export function getSamlLoginLabel(): string {
 	return config.getEnv(SAML_LOGIN_LABEL);
 }

+export function isOidcLoginEnabled(): boolean {


Does it make sense to have a function called isOidcLoginEnabled is the saml-helper file ?

packages/cli/src/sso.ee/oidc/oidc.service.ee.ts

packages/frontend/editor-ui/src/views/SettingsSso.vue

afitzek · 2025-06-13T10:39:26Z

Some comments I was wondering: we don’t handle refresh tokens — is that a deliberate choice?

I don't see why we need refresh tokens. We are just using OIDC for a one time login to fetch the id token from the provider, after that we authenticate the user with our internal mechanism.

guillaumejacquart

Well done on the fixes
Some more comments !

guillaumejacquart · 2025-06-13T12:04:22Z

packages/cli/src/controllers/password-reset.controller.ts

 			!(
 				user &&
 				(hasGlobalScope(user, 'user:resetPassword') || user.settings?.allowSSOManualLogin === true)
 			)
 		) {
+			const currentAuthenticationMethod = isSamlCurrentAuthenticationMethod() ? 'SAML' : 'OIDC';
 			this.logger.debug(
 				'Request to send password reset email failed because login is handled by SAML',


Suggested change

'Request to send password reset email failed because login is handled by SAML',

`Request to send password reset email failed because login is handled by ${currentAuthenticationMethod}`,

guillaumejacquart · 2025-06-13T12:05:19Z

packages/cli/src/controllers/password-reset.controller.ts

@@ -76,17 +79,18 @@ export class PasswordResetController {
 		}

 		if (
-			isSamlCurrentAuthenticationMethod() &&
+			(isSamlCurrentAuthenticationMethod() || isOidcCurrentAuthenticationMethod()) &&
 			!(
 				user &&


Is it worth checking is user exist at that point. code would already have failed before if user was falsy

guillaumejacquart · 2025-06-13T12:06:26Z

packages/cli/src/services/user.service.ts


 		let publicUser: PublicUser = {
 			...rest,
-			signInType: ldapIdentity ? 'ldap' : 'email',
+			signInType: providerType ? providerType : 'email',


optional:

Suggested change

signInType: providerType ? providerType : 'email',

signInType: providerType ?? 'email',

guillaumejacquart · 2025-06-13T12:09:42Z

packages/cli/src/sso.ee/oidc/oidc.service.ee.ts

+			throw new BadRequestError('Email needs to be verified');
+		}
+
+		if (!userInfo.email) {


might be worth checking the email exist before it is verified (in case user wants to debug his login issues)

guillaumejacquart · 2025-06-13T12:10:36Z

packages/cli/src/sso.ee/oidc/oidc.service.ee.ts

+		}
+
+		const openidUser = await this.authIdentityRepository.findOne({
+			where: { providerId: claims.sub },


just for future proofing here, could we also add to the where the provider type ?

packages/cli/src/sso.ee/oidc/oidc.service.ee.ts

packages/cli/src/sso.ee/oidc/routes/oidc.controller.ee.ts

guillaumejacquart

Looks good to me 👏

github-actions · 2025-06-13T13:29:29Z

✅ All Cypress E2E specs passed

github-actions · 2025-06-13T14:08:12Z

✅ All Cypress E2E specs passed

n8n-assistant bot added core Enhancement outside /nodes-base and /editor-ui n8n team Authored by the n8n team labels Jun 3, 2025

RicardoE105 force-pushed the pay-2836-spike-implement-support-for-oidc-authentication-method-for branch 2 times, most recently from 05a9b19 to e02da5e Compare June 3, 2025 18:24

RicardoE105 changed the title ~~OIDC MVP~~ feat: Add OIDC support Jun 3, 2025

afitzek force-pushed the pay-2836-spike-implement-support-for-oidc-authentication-method-for branch 2 times, most recently from 1e58dbc to bb6adbd Compare June 11, 2025 15:42

afitzek changed the title ~~feat: Add OIDC support~~ feat(core): Add OIDC support for SSO Jun 12, 2025

afitzek force-pushed the pay-2836-spike-implement-support-for-oidc-authentication-method-for branch 2 times, most recently from d8cce48 to 4ec25f1 Compare June 12, 2025 08:33

afitzek marked this pull request as ready for review June 12, 2025 10:09

afitzek requested a review from guillaumejacquart June 12, 2025 10:09

cubic-dev-ai bot reviewed Jun 12, 2025

View reviewed changes

guillaumejacquart reviewed Jun 13, 2025

View reviewed changes

guillaumejacquart previously approved these changes Jun 13, 2025

View reviewed changes

RicardoE105 and others added 11 commits June 13, 2025 15:42

OIDC implementation for SSO

98115fe

Improvements

a6109f7

only log error if user is trying to enabled MFA with another auth method

de3d3b4

fix typecheck issue

a9da7f4

Upgrade openid-client dependency and some refactoring

c81a435

Fix typecheck

4e971c9

jest config refactor

a898beb

fix linting

ac3a245

Remove unwanted change

1241a32

Fix FE tests

9244f00

address comments

8f849e1

afitzek added 4 commits June 13, 2025 15:42

Fix typecheck

72e5b37

Addressed comments

0e08a54

Address comments

0488a65

Address comments

86fc1ad

afitzek dismissed guillaumejacquart’s stale review via 86fc1ad June 13, 2025 13:46

afitzek force-pushed the pay-2836-spike-implement-support-for-oidc-authentication-method-for branch from 87c9895 to 86fc1ad Compare June 13, 2025 13:46

guillaumejacquart approved these changes Jun 13, 2025

View reviewed changes

afitzek merged commit 30148df into master Jun 13, 2025
47 of 48 checks passed

afitzek deleted the pay-2836-spike-implement-support-for-oidc-authentication-method-for branch June 13, 2025 14:18

		const isEmailBeingChanged = email !== currentEmail;
		const isFirstNameChanged = firstName !== currentFirstName;

	'Request to send password reset email failed because login is handled by SAML',
	`Request to send password reset email failed because login is handled by ${currentAuthenticationMethod}`,

	signInType: providerType ? providerType : 'email',
	signInType: providerType ?? 'email',

feat(core): Add OIDC support for SSO #15988

feat(core): Add OIDC support for SSO #15988

Conversation

RicardoE105 commented Jun 3, 2025 • edited by afitzek Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Linear tickets, Github issues, and Community forum posts

Review / Merge checklist

Uh oh!

codecov bot commented Jun 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

guillaumejacquart left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

afitzek commented Jun 13, 2025

Uh oh!

guillaumejacquart left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

guillaumejacquart left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jun 13, 2025

Uh oh!

github-actions bot commented Jun 13, 2025

Uh oh!

Uh oh!

Uh oh!

RicardoE105 commented Jun 3, 2025 •

edited by afitzek

Loading

codecov bot commented Jun 12, 2025 •

edited

Loading