Password login exists. OIDC does not, and it is how the hosted deployment is meant to
authenticate: the same binary with OIDC pointed at an identity provider, with no special code path.
Scope:
- authorization code flow with PKCE, discovery through the provider's well-known document
- map a verified claim to a local user, creating the account on first login if configured
- keep password login working alongside it, since a self-hoster with no IdP still needs a way in
- an admin switch to disable password login once OIDC is trusted
Acceptance: an unverified email claim never auto-creates or takes over an account. That is the
classic account-takeover path in OIDC integrations and it deserves a test, not a code review.
Password login exists. OIDC does not, and it is how the hosted deployment is meant to
authenticate: the same binary with OIDC pointed at an identity provider, with no special code path.
Scope:
Acceptance: an unverified email claim never auto-creates or takes over an account. That is the
classic account-takeover path in OIDC integrations and it deserves a test, not a code review.