kevinveenbirkenbach 161a7b0583 fix(oidc-flavor): return empty flavor when services.oidc.enabled is false ...

Reason: the lookup only consulted services.ldap.enabled, so even with OIDC
fully disabled it would still return "sociallogin" (or "oidc_login" when
LDAP was on). Nextcloud's services.yml then enables the matching OIDC
plugin, which redirects to Keycloak — but the Keycloak client's
redirectUris correctly excludes apps with oidc.enabled=false, so the
handoff dies with "Invalid parameter: redirect_uri". Caused all 3
nextcloud variant-1 Playwright errors (`nextcloud login`,
`nextcloud talk admin settings`, `biber logs into nextcloud via OIDC`).

The lookup now short-circuits to "" when oidc.enabled is falsy, which
makes all three plugin gates (oidc_login, sociallogin, user_oidc) compare
false and 06_setup_plugin.yml's disable branch take over. Existing
flavor-selection paths (oidc.enabled=true) are unchanged. Adds two
regression tests covering the new short-circuit and updates the
`_apps` test helper to default oidc.enabled=true so existing
flavor-selection tests stay focused on the ldap/flavor axis.

2026-05-18 01:09:01 +02:00

..

action

Add uri_probe action plugin for short reachability checks

2026-03-31 20:35:57 +02:00

filter

fix(canonical-domains-map): resolve DOMAIN_PRIMARY Jinja template before composing default domains

2026-05-17 19:29:37 +02:00

lookup

fix(oidc-flavor): return empty flavor when services.oidc.enabled is false

2026-05-18 01:09:01 +02:00

__init__.py

…