Undocumented OIDC/OAuth breaking change in Forgejo v12.0 #2053

jlh commented 2025年07月27日 13:37:29 +02:00

Comment

Hi, thanks for the great codeforge.

Unfortunately, Forgejo v12 breaks all existing OAuth clients due to a breaking change in the issuer string:

PR: remove the trailing slash from the issuer in OAuth claims. If the Forgejo instance is used as an OAuth2 provider, all OIDC clients must ensure they read the updated configuration. For instance, if the OAuth2 client is a Forgejo instance, the already configured authentication source must be updated from the /admin/auths web page. Nothing needs to be modified, it is enough to click on the Update authentication source button.

https://codeberg.org/forgejo/forgejo/milestone/12836

This change is not documented in the Forgejo v12 blog or Codeberg social media.

I am a bit frustrated, as I have been locked out of my Kubernetes cluster while I was on vacation due to multiple of my OIDC clients breaking. Example of kube-login OIDC being broken:

error: get-token: authentication error: oidc error: oidc discovery error: oidc: issuer did not match the issuer returned by provider, expected "https://codeberg.org/" got "https://codeberg.org"

While I do not check the Codeberg Mastodon often, I would have liked to see some notice about this. I think that this is something that should be included in the main changelog, as I believe it affects all users of Codeberg OAuth.

In any case, thank you for the great codeforge and I appreciate the new features being worked on.

### Comment Hi, thanks for the great codeforge. Unfortunately, Forgejo v12 breaks all existing OAuth clients due to a breaking change in the issuer string: > PR: remove the trailing slash from the issuer in OAuth claims. If the Forgejo instance is used as an OAuth2 provider, all OIDC clients must ensure they read the updated configuration. For instance, if the OAuth2 client is a Forgejo instance, the already configured authentication source must be updated from the /admin/auths web page. Nothing needs to be modified, it is enough to click on the Update authentication source button. https://codeberg.org/forgejo/forgejo/milestone/12836 This change is not documented in the Forgejo v12 blog or Codeberg social media. I am a bit frustrated, as I have been locked out of my Kubernetes cluster while I was on vacation due to multiple of my OIDC clients breaking. Example of kube-login OIDC being broken: ``` error: get-token: authentication error: oidc error: oidc discovery error: oidc: issuer did not match the issuer returned by provider, expected "https://codeberg.org/" got "https://codeberg.org" ``` While I do not check the Codeberg Mastodon often, I would have liked to see some notice about this. I think that this is something that should be included in the main changelog, as I believe it affects all users of Codeberg OAuth. In any case, thank you for the great codeforge and I appreciate the new features being worked on.

fnetX commented 2025年07月27日 16:58:24 +02:00

Please add your case to forgejo/forgejo#8634.

Please add your case to https://codeberg.org/forgejo/forgejo/issues/8634.

fnetX commented 2025年07月27日 17:08:20 +02:00

(For the record, the Forgejo release blog posts introduce releases to users, they are no replacement for the changelog, which is linked from the blog post. The regression only became known after the blog post was published. The changelog was updated accordingly.

Codeberg immediately reverted the breaking changes for Oauth2 clients. However, since OIDC clients should auto-refresh the metadata and it was confirmed to work with Forgejo, no further action was considered necessary. Reverting this change is tricky, because it would break the clients that have updated again.

I understand that more social media presence might have been useful to you. https://social.anoxinon.de/@Codeberg/114901902682414788 declares the status page for the canonical source of information, which also references the Forgejo issue I shared above.

I appreciate a hint on where you might have looked for more information and which channels we should update, that are read by sysadmins interacting with Codeberg, without annoying regular users.)

(For the record, the Forgejo release blog posts introduce releases to users, they are no replacement for the changelog, which is linked from the blog post. The regression only became known after the blog post was published. The changelog was updated accordingly. Codeberg immediately reverted the breaking changes for Oauth2 clients. However, since OIDC clients should auto-refresh the metadata and it was confirmed to work with Forgejo, no further action was considered necessary. Reverting this change is tricky, because it would break the clients that have updated *again*. I understand that more social media presence might have been useful to you. https://social.anoxinon.de/@Codeberg/114901902682414788 declares the status page for the canonical source of information, which also references the Forgejo issue I shared above. I appreciate a hint on where you might have looked for more information and which channels we should update, that are read by sysadmins interacting with Codeberg, without annoying regular users.)