From 815e8a90cbabfc8f02474e7d328aae6fe31acf63 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 11:57:00 +0000
Subject: [PATCH 01/40] Add OIDC authentication support to backend and frontend

This commit introduces OpenID Connect (OIDC) authentication support. Backend changes include new OIDC settings, migration, validation, and endpoints for OIDC login and callback, as well as utility functions for OIDC flows. The frontend adds OIDC login UI, settings management, and connection testing. Both backend and frontend enums, schemas, and services are updated to support OIDC configuration and integration.
---
 .../c1d4e5f6a7b8_add_oidc_settings.py         |  50 ++++++
 backend/app/api/auth_api.py                   | 135 ++++++++++++++-
 backend/app/api/settings_api.py               |  42 +++++
 backend/app/core/auth_core.py                 | 160 +++++++++++++++++-
 backend/app/enums/settings_enum.py            |   8 +
 backend/app/schemas/auth_schema.py            |  15 +-
 backend/app/schemas/settings_schema.py        |  17 +-
 backend/app/schemas/validators.py             |  53 ++++++
 backend/requirements.txt                      |   1 +
 frontend/public/i18n/en.json                  |  32 +++-
 .../src/app/entities/auth/auth-api.service.ts |  13 ++
 .../entities/settings/settings-api.service.ts |   4 +
 .../entities/settings/settings-interface.ts   |   9 +
 .../src/app/features/auth-page/auth-page.html |  20 +++
 .../src/app/features/auth-page/auth-page.scss |  13 ++
 .../src/app/features/auth-page/auth-page.ts   |  25 ++-
 .../settings-page-form.html                   |  11 ++
 .../settings-page-form/settings-page-form.ts  |  61 ++++++-
 .../features/settings-page/settings-page.html |  17 +-
 .../features/settings-page/settings-page.ts   |  11 +-
 20 files changed, 687 insertions(+), 10 deletions(-)
 create mode 100644 backend/alembic/versions/c1d4e5f6a7b8_add_oidc_settings.py

diff --git a/backend/alembic/versions/c1d4e5f6a7b8_add_oidc_settings.py b/backend/alembic/versions/c1d4e5f6a7b8_add_oidc_settings.py
new file mode 100644
index 0000000..913f095
--- /dev/null
+++ b/backend/alembic/versions/c1d4e5f6a7b8_add_oidc_settings.py
@@ -0,0 +1,50 @@
+"""add_oidc_settings
+
+Revision ID: c1d4e5f6a7b8
+Revises: b8dc3f40419f
+Create Date: 2025-10-28 12:00:00.000000
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision = 'c1d4e5f6a7b8'
+down_revision = 'b8dc3f40419f'
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    """Add OIDC settings to the settings table."""
+    op.execute(
+        sa.text(
+            """
+        INSERT INTO settings (key, value, value_type) VALUES
+        ('OIDC_ENABLED', 'FALSE', 'bool'),
+        ('OIDC_WELL_KNOWN_URL', '', 'str'),
+        ('OIDC_CLIENT_ID', '', 'str'),
+        ('OIDC_CLIENT_SECRET', '', 'str'),
+        ('OIDC_REDIRECT_URI', '', 'str'),
+        ('OIDC_SCOPES', 'openid profile email', 'str')
+        """
+        )
+    )
+
+
+def downgrade() -> None:
+    """Remove OIDC settings from the settings table."""
+    op.execute(
+        sa.text(
+            """
+        DELETE FROM settings WHERE key IN (
+            'OIDC_ENABLED',
+            'OIDC_WELL_KNOWN_URL', 
+            'OIDC_CLIENT_ID',
+            'OIDC_CLIENT_SECRET',
+            'OIDC_REDIRECT_URI',
+            'OIDC_SCOPES'
+        )
+        """
+        )
+    )
\ No newline at end of file
diff --git a/backend/app/api/auth_api.py b/backend/app/api/auth_api.py
index 5f83e1d..7f28177 100644
--- a/backend/app/api/auth_api.py
+++ b/backend/app/api/auth_api.py
@@ -1,5 +1,7 @@
 from typing import Any
 from datetime import timedelta
+import secrets
+import urllib.parse
 from fastapi import (
     APIRouter,
     Depends,
@@ -8,7 +10,7 @@
     Request,
     status,
 )
-from fastapi.responses import PlainTextResponse
+from fastapi.responses import PlainTextResponse, RedirectResponse
 from app.helpers.delay_to_minimum import delay_to_minimum
 from app.config import Config
 from app.helpers.now import now
@@ -20,6 +22,12 @@
     is_authorized,
     read_password_hash,
     write_password_hash,
+    is_oidc_enabled,
+    get_oidc_config,
+    fetch_oidc_discovery,
+    create_oidc_authorization_url,
+    exchange_oidc_code,
+    create_oidc_user_session,
 )
 from app.schemas.auth_schema import PasswordSetRequestBody
 
@@ -165,3 +173,128 @@ def set_password(request: Request, payload: PasswordSetRequestBody):
 def is_password_set():
     password_hash: str | None = read_password_hash()
     return password_hash not in [None, ""]
+
+
+@router.get(
+    path="/oidc/enabled",
+    description="Check if OIDC authentication is enabled",
+    response_model=bool,
+)
+def oidc_enabled():
+    return is_oidc_enabled()
+
+
+@router.get(
+    path="/oidc/login",
+    description="Initiate OIDC login flow",
+)
+async def oidc_login(request: Request):
+    if not is_oidc_enabled():
+        raise HTTPException(
+            status_code=400, detail="OIDC authentication is not enabled"
+        )
+    
+    config = get_oidc_config()
+    
+    if not all([config['well_known_url'], config['client_id'], config['redirect_uri']]):
+        raise HTTPException(
+            status_code=400, detail="OIDC configuration is incomplete"
+        )
+    
+    # Generate state parameter for CSRF protection
+    state = secrets.token_urlsafe(32)
+    
+    # Store state in session/cookie for verification later
+    # For simplicity, we'll use a cookie (in production, consider using a database)
+    
+    try:
+        discovery_doc = await fetch_oidc_discovery(config['well_known_url'])
+        authorization_url = create_oidc_authorization_url(discovery_doc, config, state)
+        
+        response = RedirectResponse(url=authorization_url, status_code=302)
+        response.set_cookie(
+            key="oidc_state",
+            value=state,
+            httponly=True,
+            samesite="strict",
+            secure=Config.HTTPS,
+            max_age=300,  # 5 minutes
+        )
+        return response
+        
+    except Exception as e:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Error initiating OIDC login: {str(e)}"
+        )
+
+
+@router.get(
+    path="/oidc/callback",
+    description="Handle OIDC callback",
+)
+async def oidc_callback(
+    request: Request,
+    response: Response,
+    code: str = None,
+    state: str = None,
+    error: str = None,
+):
+    if error:
+        raise HTTPException(
+            status_code=400,
+            detail=f"OIDC authentication error: {error}"
+        )
+    
+    if not code or not state:
+        raise HTTPException(
+            status_code=400,
+            detail="Missing authorization code or state parameter"
+        )
+    
+    # Verify state parameter
+    stored_state = request.cookies.get("oidc_state")
+    if not stored_state or stored_state != state:
+        raise HTTPException(
+            status_code=400,
+            detail="Invalid state parameter - possible CSRF attack"
+        )
+    
+    config = get_oidc_config()
+    
+    try:
+        discovery_doc = await fetch_oidc_discovery(config['well_known_url'])
+        user_data = await exchange_oidc_code(code, state, discovery_doc, config)
+        tokens = create_oidc_user_session(user_data)
+        
+        # Set authentication cookies
+        response.set_cookie(
+            key="access_token",
+            value=tokens["access_token"],
+            httponly=True,
+            samesite="strict",
+            secure=Config.HTTPS,
+            domain=Config.DOMAIN,
+            max_age=Config.ACCESS_TOKEN_LIFETIME_MIN * 60,
+        )
+        response.set_cookie(
+            key="refresh_token",
+            value=tokens["refresh_token"],
+            httponly=True,
+            samesite="strict",
+            secure=Config.HTTPS,
+            domain=Config.DOMAIN,
+            max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
+        )
+        
+        # Clear the state cookie
+        response.delete_cookie("oidc_state")
+        
+        # Redirect to main application
+        return RedirectResponse(url="/containers", status_code=302)
+        
+    except Exception as e:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Error processing OIDC callback: {str(e)}"
+        )
diff --git a/backend/app/api/settings_api.py b/backend/app/api/settings_api.py
index 3c8dc14..27f7978 100644
--- a/backend/app/api/settings_api.py
+++ b/backend/app/api/settings_api.py
@@ -12,6 +12,7 @@
     SettingsPatchRequestItem,
     TestNotificationRequestBody,
 )
+from app.core.auth_core import fetch_oidc_discovery
 from app.core.notifications_core import send_notification
 from app.core.cron_manager import CronManager
 from app.enums.settings_enum import ESettingKey
@@ -117,3 +118,44 @@ async def test_notification(data: TestNotificationRequestBody):
 )
 def get_available_timezones() -> set[str]:
     return VALID_TIMEZONES
+
+
+@router.post(
+    "/test_oidc",
+    status_code=200,
+    description="Test OIDC well-known URL connectivity",
+)
+async def test_oidc_connection(data: dict):
+    """Test if the OIDC well-known URL is accessible and returns valid configuration"""
+    well_known_url = data.get("well_known_url")
+    if not well_known_url:
+        raise HTTPException(400, "well_known_url is required")
+    
+    try:
+        discovery_doc = await fetch_oidc_discovery(well_known_url)
+        
+        # Check if required endpoints exist
+        required_endpoints = ["authorization_endpoint", "token_endpoint"]
+        missing_endpoints = [ep for ep in required_endpoints if ep not in discovery_doc]
+        
+        if missing_endpoints:
+            raise HTTPException(
+                400, 
+                f"OIDC discovery document is missing required endpoints: {missing_endpoints}"
+            )
+        
+        return {
+            "status": "success",
+            "message": "OIDC configuration is valid",
+            "endpoints": {
+                "authorization_endpoint": discovery_doc.get("authorization_endpoint"),
+                "token_endpoint": discovery_doc.get("token_endpoint"),
+                "userinfo_endpoint": discovery_doc.get("userinfo_endpoint"),
+                "issuer": discovery_doc.get("issuer")
+            }
+        }
+        
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(500, f"Error testing OIDC connection: {str(e)}")
diff --git a/backend/app/core/auth_core.py b/backend/app/core/auth_core.py
index a26c35c..4612d9a 100644
--- a/backend/app/core/auth_core.py
+++ b/backend/app/core/auth_core.py
@@ -1,11 +1,18 @@
-from typing import Any
+from typing import Any, Dict, Optional
 from datetime import datetime, timedelta
 from fastapi import HTTPException, Request
 from jose import jwt, JWTError
 import bcrypt
 import os
+import asyncio
+import aiohttp
+from authlib.integrations.requests_client import OAuth2Session
+from authlib.oidc.core import CodeIDToken
+from authlib.common.errors import AuthlibBaseError
 from app.config import Config
 from app.helpers.now import now
+from app.helpers.settings_storage import SettingsStorage
+from app.enums.settings_enum import ESettingKey
 
 
 def verify_password(plain: str, hashed: str) -> bool:
@@ -80,3 +87,154 @@ def write_password_hash(password_hash: str) -> None:
         _ = f.write(password_hash)
         f.flush()
         f.close()
+
+
+def is_oidc_enabled() -> bool:
+    """Check if OIDC authentication is enabled"""
+    try:
+        return SettingsStorage.get(ESettingKey.OIDC_ENABLED) == "true"
+    except:
+        return False
+
+
+def get_oidc_config() -> Dict[str, str]:
+    """Get OIDC configuration from settings"""
+    return {
+        'well_known_url': SettingsStorage.get(ESettingKey.OIDC_WELL_KNOWN_URL),
+        'client_id': SettingsStorage.get(ESettingKey.OIDC_CLIENT_ID),
+        'client_secret': SettingsStorage.get(ESettingKey.OIDC_CLIENT_SECRET),
+        'redirect_uri': SettingsStorage.get(ESettingKey.OIDC_REDIRECT_URI),
+        'scopes': SettingsStorage.get(ESettingKey.OIDC_SCOPES).split()
+    }
+
+
+async def fetch_oidc_discovery(well_known_url: str) -> Dict[str, Any]:
+    """Fetch OIDC discovery document from well-known URL"""
+    try:
+        async with aiohttp.ClientSession() as session:
+            async with session.get(well_known_url) as response:
+                if response.status == 200:
+                    return await response.json()
+                else:
+                    raise HTTPException(
+                        status_code=400, 
+                        detail=f"Failed to fetch OIDC discovery document: {response.status}"
+                    )
+    except aiohttp.ClientError as e:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Error fetching OIDC discovery document: {str(e)}"
+        )
+
+
+def create_oidc_authorization_url(discovery_doc: Dict[str, Any], config: Dict[str, str], state: str) -> str:
+    """Create OIDC authorization URL"""
+    try:
+        client = OAuth2Session(
+            client_id=config['client_id'],
+            redirect_uri=config['redirect_uri'],
+            scope=config['scopes']
+        )
+        
+        authorization_url, _ = client.create_authorization_url(
+            discovery_doc['authorization_endpoint'],
+            state=state
+        )
+        return authorization_url
+    except AuthlibBaseError as e:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Error creating authorization URL: {str(e)}"
+        )
+
+
+async def exchange_oidc_code(
+    code: str, 
+    state: str, 
+    discovery_doc: Dict[str, Any], 
+    config: Dict[str, str]
+) -> Dict[str, Any]:
+    """Exchange authorization code for tokens"""
+    try:
+        client = OAuth2Session(
+            client_id=config['client_id'],
+            redirect_uri=config['redirect_uri']
+        )
+        
+        # Exchange code for token
+        token = client.fetch_token(
+            discovery_doc['token_endpoint'],
+            code=code,
+            client_secret=config['client_secret']
+        )
+        
+        # Verify and decode ID token if present
+        if 'id_token' in token:
+            # For production, you should verify the ID token signature
+            # For now, we'll decode without verification (not recommended for production)
+            id_token_claims = jwt.get_unverified_claims(token['id_token'])
+            return {
+                'access_token': token.get('access_token'),
+                'id_token_claims': id_token_claims
+            }
+        
+        # If no ID token, fetch user info from userinfo endpoint
+        if 'userinfo_endpoint' in discovery_doc:
+            async with aiohttp.ClientSession() as session:
+                headers = {'Authorization': f"Bearer {token['access_token']}"}
+                async with session.get(discovery_doc['userinfo_endpoint'], headers=headers) as response:
+                    if response.status == 200:
+                        user_info = await response.json()
+                        return {
+                            'access_token': token.get('access_token'),
+                            'user_info': user_info
+                        }
+        
+        raise HTTPException(
+            status_code=400,
+            detail="Unable to retrieve user information from OIDC provider"
+        )
+        
+    except AuthlibBaseError as e:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Error exchanging authorization code: {str(e)}"
+        )
+
+
+def create_oidc_user_session(user_data: Dict[str, Any]) -> Dict[str, str]:
+    """Create user session tokens after OIDC authentication"""
+    # Extract user identifier (email, sub, or preferred_username)
+    user_claims = user_data.get('id_token_claims', user_data.get('user_info', {}))
+    
+    user_id = (
+        user_claims.get('email') or 
+        user_claims.get('sub') or 
+        user_claims.get('preferred_username') or
+        'unknown_user'
+    )
+    
+    # Create JWT tokens with OIDC user info
+    access_token = create_token(
+        data={
+            "type": "access",
+            "oidc": True,
+            "user_id": user_id,
+            "user_info": user_claims
+        },
+        expires_delta=timedelta(minutes=Config.ACCESS_TOKEN_LIFETIME_MIN)
+    )
+    
+    refresh_token = create_token(
+        data={
+            "type": "refresh", 
+            "oidc": True,
+            "user_id": user_id
+        },
+        expires_delta=timedelta(minutes=Config.REFRESH_TOKEN_LIFETIME_MIN)
+    )
+    
+    return {
+        "access_token": access_token,
+        "refresh_token": refresh_token
+    }
diff --git a/backend/app/enums/settings_enum.py b/backend/app/enums/settings_enum.py
index 5b8682c..183ac35 100644
--- a/backend/app/enums/settings_enum.py
+++ b/backend/app/enums/settings_enum.py
@@ -11,6 +11,14 @@ class ESettingKey(str, Enum):
     NOTIFICATION_URL = "NOTIFICATION_URL"
     TIMEZONE = "TIMEZONE"
     DOCKER_TIMEOUT = "DOCKER_TIMEOUT"
+    
+    # OIDC Settings
+    OIDC_ENABLED = "OIDC_ENABLED"
+    OIDC_WELL_KNOWN_URL = "OIDC_WELL_KNOWN_URL"
+    OIDC_CLIENT_ID = "OIDC_CLIENT_ID"
+    OIDC_CLIENT_SECRET = "OIDC_CLIENT_SECRET"
+    OIDC_REDIRECT_URI = "OIDC_REDIRECT_URI"
+    OIDC_SCOPES = "OIDC_SCOPES"
 
 
 class ESettingType(str, Enum):
diff --git a/backend/app/schemas/auth_schema.py b/backend/app/schemas/auth_schema.py
index d72a79e..40c92e7 100644
--- a/backend/app/schemas/auth_schema.py
+++ b/backend/app/schemas/auth_schema.py
@@ -1,4 +1,5 @@
 from pydantic import BaseModel, field_validator
+from typing import Dict, Any, Optional
 from .validators import password_validator
 
 
@@ -9,4 +10,16 @@ class PasswordSetRequestBody(BaseModel):
     @field_validator("password", "confirm_password")
     @classmethod
     def validate_password(cls, v: str) -> str:
-        return password_validator(v)
\ No newline at end of file
+        return password_validator(v)
+
+
+class OIDCConfigResponse(BaseModel):
+    enabled: bool
+    client_id: Optional[str] = None
+    redirect_uri: Optional[str] = None
+    scopes: Optional[str] = None
+
+
+class OIDCLoginResponse(BaseModel):
+    authorization_url: str
+    state: str
\ No newline at end of file
diff --git a/backend/app/schemas/settings_schema.py b/backend/app/schemas/settings_schema.py
index ec384b2..418f43c 100644
--- a/backend/app/schemas/settings_schema.py
+++ b/backend/app/schemas/settings_schema.py
@@ -2,7 +2,13 @@
 from typing import Union, cast
 from datetime import datetime
 from app.enums.settings_enum import ESettingKey
-from .validators import validate_cron_expr, validate_timezone
+from .validators import (
+    validate_cron_expr, 
+    validate_timezone,
+    validate_oidc_well_known_url,
+    validate_oidc_client_id,
+    validate_oidc_scopes
+)
 
 
 class SettingsPatchRequestItem(BaseModel):
@@ -17,6 +23,15 @@ def validate_setting(self):
         elif self.key == ESettingKey.TIMEZONE:
             _ = validate_timezone(cast(str, self.value))
             return self
+        elif self.key == ESettingKey.OIDC_WELL_KNOWN_URL:
+            self.value = validate_oidc_well_known_url(cast(str, self.value))
+            return self
+        elif self.key == ESettingKey.OIDC_CLIENT_ID:
+            self.value = validate_oidc_client_id(cast(str, self.value))
+            return self
+        elif self.key == ESettingKey.OIDC_SCOPES:
+            self.value = validate_oidc_scopes(cast(str, self.value))
+            return self
         else:
             return self
 
diff --git a/backend/app/schemas/validators.py b/backend/app/schemas/validators.py
index 68864cd..220adf9 100644
--- a/backend/app/schemas/validators.py
+++ b/backend/app/schemas/validators.py
@@ -2,6 +2,7 @@
 from datetime import datetime
 from cronsim import CronSim, CronSimError
 from zoneinfo import available_timezones
+from urllib.parse import urlparse
 
 
 VALID_TIMEZONES = available_timezones()
@@ -42,3 +43,55 @@ def validate_timezone(tz: str) -> str:
     if tz in VALID_TIMEZONES:
         return tz
     raise ValueError(f"Invalid timezone: {tz}")
+
+
+def validate_oidc_well_known_url(url: str) -> str:
+    """Validate OIDC well-known URL format"""
+    if not url:
+        return url  # Allow empty for disabled OIDC
+    
+    parsed = urlparse(url)
+    if not parsed.scheme or parsed.scheme not in ['http', 'https']:
+        raise ValueError("OIDC well-known URL must start with http:// or https://")
+    
+    if not parsed.netloc:
+        raise ValueError("Invalid OIDC well-known URL format")
+    
+    # Ensure it ends with the well-known path or allow custom paths
+    if not url.endswith('/.well-known/openid_configuration') and '/.well-known/' not in url:
+        raise ValueError("OIDC URL should point to a well-known configuration endpoint")
+    
+    return url
+
+
+def validate_oidc_client_id(client_id: str) -> str:
+    """Validate OIDC Client ID"""
+    if not client_id:
+        return client_id  # Allow empty for disabled OIDC
+    
+    # Basic validation - client IDs are typically alphanumeric with some special chars
+    if not re.match(r'^[a-zA-Z0-9._-]+$', client_id):
+        raise ValueError("OIDC Client ID contains invalid characters")
+    
+    return client_id
+
+
+def validate_oidc_scopes(scopes: str) -> str:
+    """Validate OIDC scopes"""
+    if not scopes:
+        return "openid"  # Default to openid scope
+    
+    # Split scopes and validate each one
+    scope_list = scopes.split()
+    valid_scope_pattern = r'^[a-zA-Z0-9._:-]+$'
+    
+    for scope in scope_list:
+        if not re.match(valid_scope_pattern, scope):
+            raise ValueError(f"Invalid OIDC scope: {scope}")
+    
+    # Ensure 'openid' is always included
+    if 'openid' not in scope_list:
+        scope_list.insert(0, 'openid')
+        scopes = ' '.join(scope_list)
+    
+    return scopes
diff --git a/backend/requirements.txt b/backend/requirements.txt
index d00e579..7a01be3 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -49,6 +49,7 @@ python-dateutil==2.9.0.post0
 python-dotenv==1.1.1
 python-jose==3.5.0
 python-multipart==0.0.20
+authlib==1.3.2
 python-on-whales==0.78.0
 PyYAML==6.0.2
 requests==2.32.5
diff --git a/frontend/public/i18n/en.json b/frontend/public/i18n/en.json
index 5ae9744..821474f 100644
--- a/frontend/public/i18n/en.json
+++ b/frontend/public/i18n/en.json
@@ -49,7 +49,9 @@
       "MEDIUM": "Average complexity",
       "STRONG": "Complex password"
     },
-    "PASSWORD_HINTS": ["At least one lowercase", "At least one uppercase", "At least one numeric"]
+    "PASSWORD_HINTS": ["At least one lowercase", "At least one uppercase", "At least one numeric"],
+    "OR": "Or",
+    "LOGIN_WITH_OIDC": "Login with OIDC"
   },
   "HOSTS": {
     "NO_HOSTS_FOUND": "No hosts found",
@@ -156,7 +158,8 @@
     "VALUE": "Value",
     "SECTIONS": {
       "CHANGE_PASSWORD": "Change password",
-      "APP_SETTINGS": "App settings"
+      "APP_SETTINGS": "App settings",
+      "OIDC_SETTINGS": "OIDC Authentication Settings"
     },
     "BY_KEY": {
       "CRONTAB_EXPR": {
@@ -177,6 +180,31 @@
       "DOCKER_TIMEOUT": {
         "LABEL": "Docker timeout",
         "HINT": "Docker CLI call timeout. This applies primarily to API methods and does not apply to, for example, container re-creation or image pulling."
+      },
+      "OIDC_ENABLED": {
+        "LABEL": "Enable OIDC Authentication",
+        "HINT": "Enable OpenID Connect authentication alongside password authentication"
+      },
+      "OIDC_WELL_KNOWN_URL": {
+        "LABEL": "OIDC Well-Known URL",
+        "HINT": "The well-known configuration URL of your OIDC provider (e.g., https://auth.example.com/.well-known/openid_configuration)",
+        "TEST": "Test OIDC connection"
+      },
+      "OIDC_CLIENT_ID": {
+        "LABEL": "OIDC Client ID",
+        "HINT": "The client identifier registered with your OIDC provider"
+      },
+      "OIDC_CLIENT_SECRET": {
+        "LABEL": "OIDC Client Secret",
+        "HINT": "The client secret for your OIDC application (keep this secure)"
+      },
+      "OIDC_REDIRECT_URI": {
+        "LABEL": "OIDC Redirect URI",
+        "HINT": "The redirect URI configured in your OIDC provider (e.g., https://tugtainer.example.com/auth/oidc/callback)"
+      },
+      "OIDC_SCOPES": {
+        "LABEL": "OIDC Scopes",
+        "HINT": "Space-separated list of OAuth2 scopes to request (openid is always included)"
       }
     }
   }
diff --git a/frontend/src/app/entities/auth/auth-api.service.ts b/frontend/src/app/entities/auth/auth-api.service.ts
index b0bf140..87232b8 100644
--- a/frontend/src/app/entities/auth/auth-api.service.ts
+++ b/frontend/src/app/entities/auth/auth-api.service.ts
@@ -38,4 +38,17 @@ export class AuthApiService extends BaseApiService<'/auth'> {
   isPasswordSet(): Observable<boolean> {
     return this.httpClient.get<boolean>(`${this.basePath}/is_password_set`);
   }
+
+  isOidcEnabled(): Observable<boolean> {
+    return this.httpClient.get<boolean>(`${this.basePath}/oidc/enabled`);
+  }
+
+  initiateOidcLogin(): Observable<any> {
+    // This will redirect to the OIDC provider, so we don't expect a JSON response
+    window.location.href = `${this.basePath}/oidc/login`;
+    return new Observable(subscriber => {
+      // This observable won't emit since we're redirecting
+      subscriber.complete();
+    });
+  }
 }
diff --git a/frontend/src/app/entities/settings/settings-api.service.ts b/frontend/src/app/entities/settings/settings-api.service.ts
index cf3b253..ed084c1 100644
--- a/frontend/src/app/entities/settings/settings-api.service.ts
+++ b/frontend/src/app/entities/settings/settings-api.service.ts
@@ -24,4 +24,8 @@ export class SettingsApiService extends BaseApiService<'/settings'> {
   getAvailableTimezones(): Observable<string[]> {
     return this.httpClient.get<string[]>(`${this.basePath}/available_timezones`);
   }
+
+  testOidcConnection(well_known_url: string): Observable<any> {
+    return this.httpClient.post(`${this.basePath}/test_oidc`, { well_known_url });
+  }
 }
diff --git a/frontend/src/app/entities/settings/settings-interface.ts b/frontend/src/app/entities/settings/settings-interface.ts
index be4618a..12a788a 100644
--- a/frontend/src/app/entities/settings/settings-interface.ts
+++ b/frontend/src/app/entities/settings/settings-interface.ts
@@ -18,4 +18,13 @@ export enum ESettingKey {
   CRONTAB_EXPR = 'CRONTAB_EXPR',
   NOTIFICATION_URL = 'NOTIFICATION_URL',
   TIMEZONE = 'TIMEZONE',
+  DOCKER_TIMEOUT = 'DOCKER_TIMEOUT',
+  
+  // OIDC Settings
+  OIDC_ENABLED = 'OIDC_ENABLED',
+  OIDC_WELL_KNOWN_URL = 'OIDC_WELL_KNOWN_URL',
+  OIDC_CLIENT_ID = 'OIDC_CLIENT_ID',
+  OIDC_CLIENT_SECRET = 'OIDC_CLIENT_SECRET',
+  OIDC_REDIRECT_URI = 'OIDC_REDIRECT_URI',
+  OIDC_SCOPES = 'OIDC_SCOPES',
 }
diff --git a/frontend/src/app/features/auth-page/auth-page.html b/frontend/src/app/features/auth-page/auth-page.html
index ff5fbb3..845fcd2 100644
--- a/frontend/src/app/features/auth-page/auth-page.html
+++ b/frontend/src/app/features/auth-page/auth-page.html
@@ -6,6 +6,26 @@
       (OnSubmit)="onSubmitLogin($event)"
     >
     </app-login-form>
+    
+    @if (isOidcEnabled()) {
+      <div class="oidc-login-section">
+        <p-divider type="horizontal" align="center">
+          <span>{{ 'AUTH.OR' | translate }}</span>
+        </p-divider>
+        
+        <p-button
+          [loading]="isLoading()"
+          severity="secondary"
+          class="oidc-login-button"
+          (onClick)="onOidcLogin()"
+        >
+          <i class="pi pi-id-card"></i>
+          <span pButtonLabel>
+            {{ 'AUTH.LOGIN_WITH_OIDC' | translate }}
+          </span>
+        </p-button>
+      </div>
+    }
   } @else {
     <app-new-password-form
       [isLoading]="isLoading()"
diff --git a/frontend/src/app/features/auth-page/auth-page.scss b/frontend/src/app/features/auth-page/auth-page.scss
index ed16955..fdeb632 100644
--- a/frontend/src/app/features/auth-page/auth-page.scss
+++ b/frontend/src/app/features/auth-page/auth-page.scss
@@ -12,4 +12,17 @@
   .auth {
     @include mx.floating-card-surface;
   }
+
+  .oidc-login-section {
+    margin-top: 1rem;
+    
+    .oidc-login-button {
+      width: 100%;
+      justify-content: center;
+    }
+    
+    p-divider {
+      margin: 1rem 0;
+    }
+  }
 }
diff --git a/frontend/src/app/features/auth-page/auth-page.ts b/frontend/src/app/features/auth-page/auth-page.ts
index e039a55..d15295f 100644
--- a/frontend/src/app/features/auth-page/auth-page.ts
+++ b/frontend/src/app/features/auth-page/auth-page.ts
@@ -7,10 +7,13 @@ import { NewPasswordForm } from 'src/app/shared/components/new-password-form/new
 import { LoginForm } from './login-form/login-form';
 import { Logo } from 'src/app/shared/components/logo/logo';
 import { ToastService } from 'src/app/core/services/toast.service';
+import { ButtonModule } from 'primeng/button';
+import { DividerModule } from 'primeng/divider';
+import { TranslatePipe } from '@ngx-translate/core';
 
 @Component({
   selector: 'app-auth',
-  imports: [NewPasswordForm, LoginForm, Logo],
+  imports: [NewPasswordForm, LoginForm, Logo, ButtonModule, DividerModule, TranslatePipe],
   templateUrl: './auth-page.html',
   styleUrl: './auth-page.scss',
   changeDetection: ChangeDetectionStrategy.OnPush,
@@ -22,9 +25,11 @@ export class AuthPage implements OnInit {
 
   public readonly isLoading = signal<boolean>(false);
   public readonly isPasswordSet = signal<boolean>(null);
+  public readonly isOidcEnabled = signal<boolean>(false);
 
   ngOnInit(): void {
     this.updateIsPasswordSet();
+    this.updateIsOidcEnabled();
   }
 
   private updateIsPasswordSet(): void {
@@ -72,4 +77,22 @@ export class AuthPage implements OnInit {
         },
       });
   }
+
+  private updateIsOidcEnabled(): void {
+    this.authApiService
+      .isOidcEnabled()
+      .subscribe({
+        next: (res) => {
+          this.isOidcEnabled.set(res);
+        },
+        error: (error) => {
+          console.warn('Could not check OIDC status:', error);
+          this.isOidcEnabled.set(false);
+        },
+      });
+  }
+
+  onOidcLogin(): void {
+    this.authApiService.initiateOidcLogin().subscribe();
+  }
 }
diff --git a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.html b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.html
index 9a3e614..d0d9a83 100644
--- a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.html
+++ b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.html
@@ -32,6 +32,17 @@
             >
             </p-button>
           }
+          @case (ESettingKey.OIDC_WELL_KNOWN_URL) {
+            <p-button
+              icon="pi pi-link"
+              severity="contrast"
+              rounded="true"
+              [pTooltip]="'SETTINGS.BY_KEY.OIDC_WELL_KNOWN_URL.TEST' | translate"
+              tooltipPosition="left"
+              (onClick)="onTestOidc()"
+            >
+            </p-button>
+          }
         }
 
         @if (keyTranslates[key]?.HINT; as hint) {
diff --git a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts
index be0eaa5..6af91da 100644
--- a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts
+++ b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts
@@ -3,6 +3,7 @@ import {
   Component,
   computed,
   inject,
+  input,
   output,
   signal,
 } from '@angular/core';
@@ -61,6 +62,8 @@ export class SettingsPageForm {
   private readonly toastService = inject(ToastService);
 
   public readonly OnSubmit = output<ISettingUpdate[]>();
+  public readonly includeKeys = input<ESettingKey[]>();
+  public readonly excludeKeys = input<ESettingKey[]>();
 
   public readonly ESettingKey = ESettingKey;
   public readonly keyTranslates = this.translateService.instant('SETTINGS.BY_KEY');
@@ -100,6 +103,19 @@ export class SettingsPageForm {
     return null;
   };
 
+  private urlValidator: ValidatorFn = (control: AbstractControl<string>) => {
+    const value = control.value;
+    if (!!value) {
+      try {
+        new URL(value);
+        return null;
+      } catch {
+        return { urlValidator: true };
+      }
+    }
+    return null;
+  };
+
   constructor() {
     this.updateSettings();
   }
@@ -116,7 +132,19 @@ export class SettingsPageForm {
       .subscribe({
         next: (list) => {
           this.formArray.clear();
-          for (const item of list) {
+          let filteredList = list;
+          
+          // Filter based on includeKeys or excludeKeys
+          const includeKeys = this.includeKeys();
+          const excludeKeys = this.excludeKeys();
+          
+          if (includeKeys && includeKeys.length > 0) {
+            filteredList = list.filter(item => includeKeys.includes(item.key));
+          } else if (excludeKeys && excludeKeys.length > 0) {
+            filteredList = list.filter(item => !excludeKeys.includes(item.key));
+          }
+          
+          for (const item of filteredList) {
             const form = this.getFormGroup(item);
             this.formArray.push(form);
           }
@@ -148,6 +176,12 @@ export class SettingsPageForm {
         return [Validators.required, this.cronValidator];
       case ESettingKey.TIMEZONE:
         return [Validators.required, this.timezoneValidator];
+      case ESettingKey.OIDC_WELL_KNOWN_URL:
+        return [this.urlValidator];
+      case ESettingKey.OIDC_CLIENT_ID:
+        return [];
+      case ESettingKey.OIDC_REDIRECT_URI:
+        return [this.urlValidator];
       default:
         return [];
     }
@@ -176,6 +210,31 @@ export class SettingsPageForm {
       });
   }
 
+  public onTestOidc(): void {
+    this.isLoading.set(true);
+    const wellKnownUrl = this.formArray.value.find(
+      (item) => item.key === ESettingKey.OIDC_WELL_KNOWN_URL,
+    ).value as string;
+    
+    if (!wellKnownUrl) {
+      this.toastService.error('OIDC Well-Known URL is required for testing');
+      this.isLoading.set(false);
+      return;
+    }
+    
+    this.settingsApiService
+      .testOidcConnection(wellKnownUrl)
+      .pipe(finalize(() => this.isLoading.set(false)))
+      .subscribe({
+        next: (response) => {
+          this.toastService.success(`OIDC Connection Test Successful. Provider: ${response.endpoints?.issuer || 'Unknown'}`);
+        },
+        error: (error) => {
+          this.toastService.error(error);
+        },
+      });
+  }
+
   public submit(): void {
     if (this.formArray.invalid) {
       this.formArray.controls.forEach((c) => {
diff --git a/frontend/src/app/features/settings-page/settings-page.html b/frontend/src/app/features/settings-page/settings-page.html
index 3ceb292..12c6861 100644
--- a/frontend/src/app/features/settings-page/settings-page.html
+++ b/frontend/src/app/features/settings-page/settings-page.html
@@ -17,7 +17,22 @@
       {{ 'SETTINGS.SECTIONS.APP_SETTINGS' | translate }}
     </p-accordion-header>
     <p-accordion-content>
-      <app-settings-page-form (OnSubmit)="onSubmitSettings($event)"></app-settings-page-form>
+      <app-settings-page-form 
+        [excludeKeys]="oidcSettingKeys" 
+        (OnSubmit)="onSubmitSettings($event)"
+      ></app-settings-page-form>
+    </p-accordion-content>
+  </p-accordion-panel>
+
+  <p-accordion-panel value="2">
+    <p-accordion-header>
+      {{ 'SETTINGS.SECTIONS.OIDC_SETTINGS' | translate }}
+    </p-accordion-header>
+    <p-accordion-content>
+      <app-settings-page-form 
+        [includeKeys]="oidcSettingKeys" 
+        (OnSubmit)="onSubmitSettings($event)"
+      ></app-settings-page-form>
     </p-accordion-content>
   </p-accordion-panel>
 </p-accordion>
diff --git a/frontend/src/app/features/settings-page/settings-page.ts b/frontend/src/app/features/settings-page/settings-page.ts
index 7a08a50..fe39a33 100644
--- a/frontend/src/app/features/settings-page/settings-page.ts
+++ b/frontend/src/app/features/settings-page/settings-page.ts
@@ -6,7 +6,7 @@ import { TranslatePipe } from '@ngx-translate/core';
 import { AuthApiService } from 'src/app/entities/auth/auth-api.service';
 import { SettingsApiService } from 'src/app/entities/settings/settings-api.service';
 import { finalize } from 'rxjs';
-import { ISettingUpdate } from 'src/app/entities/settings/settings-interface';
+import { ISettingUpdate, ESettingKey } from 'src/app/entities/settings/settings-interface';
 import { DividerModule } from 'primeng/divider';
 import { AccordionModule } from 'primeng/accordion';
 import { ToastService } from 'src/app/core/services/toast.service';
@@ -24,6 +24,15 @@ export class SettingsPage {
   private readonly settingsApiService = inject(SettingsApiService);
 
   public readonly isLoading = signal<boolean>(false);
+  
+  public readonly oidcSettingKeys = [
+    ESettingKey.OIDC_ENABLED,
+    ESettingKey.OIDC_WELL_KNOWN_URL,
+    ESettingKey.OIDC_CLIENT_ID,
+    ESettingKey.OIDC_CLIENT_SECRET,
+    ESettingKey.OIDC_REDIRECT_URI,
+    ESettingKey.OIDC_SCOPES
+  ];
 
   public onSubmitNewPassword(body: ISetPasswordBody): void {
     this.isLoading.set(true);

From 35b950e6c8710a4b35548ee05f15f09f9598dbab Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 11:59:21 +0000
Subject: [PATCH 02/40] Fix auth page issue

---
 frontend/src/app/features/auth-page/auth-page.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/src/app/features/auth-page/auth-page.html b/frontend/src/app/features/auth-page/auth-page.html
index 845fcd2..c2df616 100644
--- a/frontend/src/app/features/auth-page/auth-page.html
+++ b/frontend/src/app/features/auth-page/auth-page.html
@@ -9,7 +9,7 @@
     
     @if (isOidcEnabled()) {
       <div class="oidc-login-section">
-        <p-divider type="horizontal" align="center">
+        <p-divider align="center">
           <span>{{ 'AUTH.OR' | translate }}</span>
         </p-divider>
         

From 492399cd34feca336827f5fe82e51ab5fd16ebf0 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 12:06:30 +0000
Subject: [PATCH 03/40] Attempt at fixing API settings

Bug in the settings API where it assumes CRONTAB_EXPR is always included when saving settings. When saving only OIDC settings, this fails.
---
 backend/app/api/settings_api.py | 44 ++++++++++++++++++++++++---------
 1 file changed, 32 insertions(+), 12 deletions(-)

diff --git a/backend/app/api/settings_api.py b/backend/app/api/settings_api.py
index 27f7978..76af8b9 100644
--- a/backend/app/api/settings_api.py
+++ b/backend/app/api/settings_api.py
@@ -77,20 +77,40 @@ async def change_system_settings(
 
     await session.commit()
 
-    cron_expr = [
+    # Only reschedule cron job if CRONTAB_EXPR or TIMEZONE were updated
+    cron_expr_items = [
         item for item in data if item.key == ESettingKey.CRONTAB_EXPR
-    ][0]
-    timezone = [
+    ]
+    timezone_items = [
         item for item in data if item.key == ESettingKey.TIMEZONE
-    ][0]
-
-    if cron_expr or timezone:
-        CronManager.schedule_job(
-            ECronJob.CHECK_CONTAINERS,
-            str(cron_expr.value),
-            str(timezone.value),
-            lambda: check_all(True),
-        )
+    ]
+
+    if cron_expr_items or timezone_items:
+        cron_expr = cron_expr_items[0] if cron_expr_items else None
+        timezone = timezone_items[0] if timezone_items else None
+        
+        # Get current values if not provided in the update
+        if not cron_expr:
+            stmt = select(SettingModel).where(SettingModel.key == ESettingKey.CRONTAB_EXPR).limit(1)
+            result = await session.execute(stmt)
+            cron_setting = result.scalar_one_or_none()
+            if cron_setting:
+                cron_expr = type('obj', (object,), {'value': cron_setting.value})()
+        
+        if not timezone:
+            stmt = select(SettingModel).where(SettingModel.key == ESettingKey.TIMEZONE).limit(1)
+            result = await session.execute(stmt)
+            timezone_setting = result.scalar_one_or_none()
+            if timezone_setting:
+                timezone = type('obj', (object,), {'value': timezone_setting.value})()
+        
+        if cron_expr and timezone:
+            CronManager.schedule_job(
+                ECronJob.CHECK_CONTAINERS,
+                str(cron_expr.value),
+                str(timezone.value),
+                lambda: check_all(True),
+            )
 
     return {"status": "updated", "count": len(data)}
 

From 9c685a86fddd88ac28d7f7735cd199a3f1b464e5 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 12:11:03 +0000
Subject: [PATCH 04/40] Fix boolean

Error checking if OIDC was enabled, stopped the auth method from showing.
---
 backend/app/core/auth_core.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/app/core/auth_core.py b/backend/app/core/auth_core.py
index 4612d9a..bf9e01d 100644
--- a/backend/app/core/auth_core.py
+++ b/backend/app/core/auth_core.py
@@ -92,7 +92,7 @@ def write_password_hash(password_hash: str) -> None:
 def is_oidc_enabled() -> bool:
     """Check if OIDC authentication is enabled"""
     try:
-        return SettingsStorage.get(ESettingKey.OIDC_ENABLED) == "true"
+        return SettingsStorage.get(ESettingKey.OIDC_ENABLED) is True
     except:
         return False
 

From 9ccab18f1fbf94c9841fd81fe91bd6b6da850727 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 12:16:35 +0000
Subject: [PATCH 05/40] Various fixes

- fix an issue in the token exchange where I'm using the session outside its context

- fix cookie domain logging and session context in the token exchange

- added debug logging
---
 backend/app/api/auth_api.py   | 14 ++++--
 backend/app/core/auth_core.py | 87 ++++++++++++++++++++---------------
 2 files changed, 60 insertions(+), 41 deletions(-)

diff --git a/backend/app/api/auth_api.py b/backend/app/api/auth_api.py
index 7f28177..4c692d9 100644
--- a/backend/app/api/auth_api.py
+++ b/backend/app/api/auth_api.py
@@ -263,9 +263,16 @@ async def oidc_callback(
     config = get_oidc_config()
     
     try:
+        print(f"OIDC Callback - Code: {code}, State: {state}")  # Debug print
         discovery_doc = await fetch_oidc_discovery(config['well_known_url'])
+        print(f"OIDC Discovery successful")  # Debug print
         user_data = await exchange_oidc_code(code, state, discovery_doc, config)
+        print(f"OIDC Token exchange successful: {user_data}")  # Debug print
         tokens = create_oidc_user_session(user_data)
+        print(f"OIDC Session created")  # Debug print
+        
+        # Create response for redirect
+        response = RedirectResponse(url="/containers", status_code=302)
         
         # Set authentication cookies
         response.set_cookie(
@@ -274,7 +281,7 @@ async def oidc_callback(
             httponly=True,
             samesite="strict",
             secure=Config.HTTPS,
-            domain=Config.DOMAIN,
+            domain=Config.DOMAIN if Config.DOMAIN else None,
             max_age=Config.ACCESS_TOKEN_LIFETIME_MIN * 60,
         )
         response.set_cookie(
@@ -283,15 +290,14 @@ async def oidc_callback(
             httponly=True,
             samesite="strict",
             secure=Config.HTTPS,
-            domain=Config.DOMAIN,
+            domain=Config.DOMAIN if Config.DOMAIN else None,
             max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
         )
         
         # Clear the state cookie
         response.delete_cookie("oidc_state")
         
-        # Redirect to main application
-        return RedirectResponse(url="/containers", status_code=302)
+        return response
         
     except Exception as e:
         raise HTTPException(
diff --git a/backend/app/core/auth_core.py b/backend/app/core/auth_core.py
index bf9e01d..90211e0 100644
--- a/backend/app/core/auth_core.py
+++ b/backend/app/core/auth_core.py
@@ -6,9 +6,7 @@
 import os
 import asyncio
 import aiohttp
-from authlib.integrations.requests_client import OAuth2Session
-from authlib.oidc.core import CodeIDToken
-from authlib.common.errors import AuthlibBaseError
+from urllib.parse import urlencode
 from app.config import Config
 from app.helpers.now import now
 from app.helpers.settings_storage import SettingsStorage
@@ -130,18 +128,24 @@ async def fetch_oidc_discovery(well_known_url: str) -> Dict[str, Any]:
 def create_oidc_authorization_url(discovery_doc: Dict[str, Any], config: Dict[str, str], state: str) -> str:
     """Create OIDC authorization URL"""
     try:
-        client = OAuth2Session(
-            client_id=config['client_id'],
-            redirect_uri=config['redirect_uri'],
-            scope=config['scopes']
-        )
+        # Manually build the authorization URL
+        auth_endpoint = discovery_doc['authorization_endpoint']
+        scopes = ' '.join(config['scopes'])
+        
+        params = {
+            'client_id': config['client_id'],
+            'redirect_uri': config['redirect_uri'],
+            'scope': scopes,
+            'response_type': 'code',
+            'state': state
+        }
+        
+        # Build query string
+        query_string = urlencode(params)
+        authorization_url = f"{auth_endpoint}?{query_string}"
         
-        authorization_url, _ = client.create_authorization_url(
-            discovery_doc['authorization_endpoint'],
-            state=state
-        )
         return authorization_url
-    except AuthlibBaseError as e:
+    except Exception as e:
         raise HTTPException(
             status_code=400,
             detail=f"Error creating authorization URL: {str(e)}"
@@ -156,31 +160,40 @@ async def exchange_oidc_code(
 ) -> Dict[str, Any]:
     """Exchange authorization code for tokens"""
     try:
-        client = OAuth2Session(
-            client_id=config['client_id'],
-            redirect_uri=config['redirect_uri']
-        )
-        
-        # Exchange code for token
-        token = client.fetch_token(
-            discovery_doc['token_endpoint'],
-            code=code,
-            client_secret=config['client_secret']
-        )
+        # Prepare token exchange request
+        token_endpoint = discovery_doc['token_endpoint']
         
-        # Verify and decode ID token if present
-        if 'id_token' in token:
-            # For production, you should verify the ID token signature
-            # For now, we'll decode without verification (not recommended for production)
-            id_token_claims = jwt.get_unverified_claims(token['id_token'])
-            return {
-                'access_token': token.get('access_token'),
-                'id_token_claims': id_token_claims
-            }
+        data = {
+            'grant_type': 'authorization_code',
+            'code': code,
+            'redirect_uri': config['redirect_uri'],
+            'client_id': config['client_id'],
+            'client_secret': config['client_secret']
+        }
         
-        # If no ID token, fetch user info from userinfo endpoint
-        if 'userinfo_endpoint' in discovery_doc:
-            async with aiohttp.ClientSession() as session:
+        # Exchange code for token
+        async with aiohttp.ClientSession() as session:
+            async with session.post(token_endpoint, data=data) as response:
+                if response.status != 200:
+                    error_text = await response.text()
+                    raise HTTPException(
+                        status_code=400,
+                        detail=f"Token exchange failed: {error_text}"
+                    )
+                
+                token = await response.json()
+            
+            # Verify and decode ID token if present
+            if 'id_token' in token:
+                # For now, we'll decode without verification (not recommended for production)
+                id_token_claims = jwt.get_unverified_claims(token['id_token'])
+                return {
+                    'access_token': token.get('access_token'),
+                    'id_token_claims': id_token_claims
+                }
+            
+            # If no ID token, fetch user info from userinfo endpoint
+            if 'userinfo_endpoint' in discovery_doc:
                 headers = {'Authorization': f"Bearer {token['access_token']}"}
                 async with session.get(discovery_doc['userinfo_endpoint'], headers=headers) as response:
                     if response.status == 200:
@@ -195,7 +208,7 @@ async def exchange_oidc_code(
             detail="Unable to retrieve user information from OIDC provider"
         )
         
-    except AuthlibBaseError as e:
+    except Exception as e:
         raise HTTPException(
             status_code=400,
             detail=f"Error exchanging authorization code: {str(e)}"

From bf482b68210980d7047f9cf9ddcffa5638bfeb9e Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 12:28:39 +0000
Subject: [PATCH 06/40] Relax OIDC cookie settings and add debug prints

Changed OIDC state cookie 'samesite' from 'strict' to 'lax' and 'secure' to False to facilitate HTTP testing and cross-origin redirects. Added debug print statements to log state and cookies during OIDC callback for easier troubleshooting.
---
 backend/app/api/auth_api.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/backend/app/api/auth_api.py b/backend/app/api/auth_api.py
index 4c692d9..92ee589 100644
--- a/backend/app/api/auth_api.py
+++ b/backend/app/api/auth_api.py
@@ -216,8 +216,8 @@ async def oidc_login(request: Request):
             key="oidc_state",
             value=state,
             httponly=True,
-            samesite="strict",
-            secure=Config.HTTPS,
+            samesite="lax",  # Changed from strict to lax for cross-origin redirects
+            secure=False,  # Set to False for HTTP testing
             max_age=300,  # 5 minutes
         )
         return response
@@ -254,10 +254,12 @@ async def oidc_callback(
     
     # Verify state parameter
     stored_state = request.cookies.get("oidc_state")
+    print(f"OIDC Callback Debug - Received state: {state}, Stored state: {stored_state}")  # Debug print
+    print(f"OIDC Callback Debug - All cookies: {dict(request.cookies)}")  # Debug print
     if not stored_state or stored_state != state:
         raise HTTPException(
             status_code=400,
-            detail="Invalid state parameter - possible CSRF attack"
+            detail=f"Invalid state parameter - received: {state}, stored: {stored_state}"
         )
     
     config = get_oidc_config()

From 2dbd5efcfb1d75bd16cd27916cfee5ee1e9abd17 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 12:36:11 +0000
Subject: [PATCH 07/40] Add OIDC user info display to settings page

---
 backend/app/api/auth_api.py                   | 40 +++++++++++++++++++
 frontend/public/i18n/en.json                  |  6 +++
 .../src/app/entities/auth/auth-api.service.ts |  4 ++
 .../settings-page-form/settings-page-form.ts  | 27 +++++++++++++
 .../features/settings-page/settings-page.html | 26 ++++++++++++
 .../features/settings-page/settings-page.scss | 31 ++++++++++++++
 6 files changed, 134 insertions(+)

diff --git a/backend/app/api/auth_api.py b/backend/app/api/auth_api.py
index 92ee589..5822f09 100644
--- a/backend/app/api/auth_api.py
+++ b/backend/app/api/auth_api.py
@@ -175,6 +175,46 @@ def is_password_set():
     return password_hash not in [None, ""]
 
 
+def get_current_user(request: Request) -> dict[str, Any]:
+    """Dependency to get current user from access token"""
+    access_token: str | None = request.cookies.get("access_token")
+    if not access_token:
+        raise HTTPException(
+            status_code=401, detail="Missing access token"
+        )
+    
+    payload: dict[str, Any] = verify_token(access_token)
+    if payload.get("type") != "access":
+        raise HTTPException(
+            status_code=401, detail="Invalid access token"
+        )
+    
+    return payload
+
+
+@router.get(
+    path="/user/info",
+    description="Get current authenticated user information",
+)
+def get_user_info(current_user: dict[str, Any] = Depends(get_current_user)):
+    user_info = {
+        "is_oidc": current_user.get("oidc", False),
+        "user_id": current_user.get("user_id", ""),
+    }
+    
+    # If OIDC user, include additional user info
+    if current_user.get("oidc") and current_user.get("user_info"):
+        oidc_info = current_user.get("user_info", {})
+        user_info.update({
+            "email": oidc_info.get("email", ""),
+            "name": oidc_info.get("name", ""),
+            "preferred_username": oidc_info.get("preferred_username", ""),
+            "sub": oidc_info.get("sub", ""),
+        })
+    
+    return user_info
+
+
 @router.get(
     path="/oidc/enabled",
     description="Check if OIDC authentication is enabled",
diff --git a/frontend/public/i18n/en.json b/frontend/public/i18n/en.json
index 821474f..02e25b6 100644
--- a/frontend/public/i18n/en.json
+++ b/frontend/public/i18n/en.json
@@ -206,6 +206,12 @@
         "LABEL": "OIDC Scopes",
         "HINT": "Space-separated list of OAuth2 scopes to request (openid is always included)"
       }
+    },
+    "OIDC": {
+      "CURRENT_USER": "Currently Authenticated User",
+      "EMAIL": "Email",
+      "NAME": "Name",
+      "USERNAME": "Username"
     }
   }
 }
diff --git a/frontend/src/app/entities/auth/auth-api.service.ts b/frontend/src/app/entities/auth/auth-api.service.ts
index 87232b8..c1708aa 100644
--- a/frontend/src/app/entities/auth/auth-api.service.ts
+++ b/frontend/src/app/entities/auth/auth-api.service.ts
@@ -51,4 +51,8 @@ export class AuthApiService extends BaseApiService<'/auth'> {
       subscriber.complete();
     });
   }
+
+  getUserInfo(): Observable<any> {
+    return this.httpClient.get(`${this.basePath}/user/info`, { withCredentials: true });
+  }
 }
diff --git a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts
index 6af91da..6f8786e 100644
--- a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts
+++ b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts
@@ -20,6 +20,7 @@ import {
 import { TranslatePipe, TranslateService } from '@ngx-translate/core';
 import { catchError, finalize, of } from 'rxjs';
 import { SettingsApiService } from 'src/app/entities/settings/settings-api.service';
+import { AuthApiService } from 'src/app/entities/auth/auth-api.service';
 import {
   ESettingKey,
   ESettingValueType,
@@ -58,6 +59,7 @@ import { ToastService } from 'src/app/core/services/toast.service';
 })
 export class SettingsPageForm {
   private readonly settingsApiService = inject(SettingsApiService);
+  private readonly authApiService = inject(AuthApiService);
   private readonly translateService = inject(TranslateService);
   private readonly toastService = inject(ToastService);
 
@@ -73,6 +75,10 @@ export class SettingsPageForm {
   private readonly timezones = toSignal(
     this.settingsApiService.getAvailableTimezones().pipe(catchError(() => of([]))),
   );
+
+  // User info signals
+  public readonly userInfo = signal<any>(null);
+  public readonly isLoadingUserInfo = signal<boolean>(false);
   public readonly timezonesSearch = signal<string>(null);
   public readonly displayedTimezones = computed<string[]>(() => {
     const timezones = this.timezones();
@@ -118,6 +124,7 @@ export class SettingsPageForm {
 
   constructor() {
     this.updateSettings();
+    this.loadUserInfo();
   }
 
   private updateSettings(): void {
@@ -155,6 +162,26 @@ export class SettingsPageForm {
       });
   }
 
+  private loadUserInfo(): void {
+    this.isLoadingUserInfo.set(true);
+    this.authApiService
+      .getUserInfo()
+      .pipe(
+        finalize(() => {
+          this.isLoadingUserInfo.set(false);
+        }),
+        catchError((error) => {
+          // Silently fail if user is not authenticated (e.g., using password auth)
+          return of(null);
+        }),
+      )
+      .subscribe({
+        next: (userInfo) => {
+          this.userInfo.set(userInfo);
+        },
+      });
+  }
+
   private getFormGroup(data: ISetting): FormGroup<TInterfaceToForm<ISetting>> {
     const form = new FormGroup<TInterfaceToForm<ISetting>>({
       key: new FormControl<ESettingKey>(data.key),
diff --git a/frontend/src/app/features/settings-page/settings-page.html b/frontend/src/app/features/settings-page/settings-page.html
index 12c6861..becdf90 100644
--- a/frontend/src/app/features/settings-page/settings-page.html
+++ b/frontend/src/app/features/settings-page/settings-page.html
@@ -32,7 +32,33 @@
       <app-settings-page-form 
         [includeKeys]="oidcSettingKeys" 
         (OnSubmit)="onSubmitSettings($event)"
+        #oidcSettingsForm
       ></app-settings-page-form>
+
+      <!-- OIDC User Info Display -->
+      @if (oidcSettingsForm.userInfo(); as userInfo) {
+        @if (userInfo.is_oidc) {
+          <div class="oidc-user-info">
+            <h4>{{ 'SETTINGS.OIDC.CURRENT_USER' | translate }}</h4>
+            <div class="user-info-field">
+              <strong>{{ 'SETTINGS.OIDC.EMAIL' | translate }}:</strong> 
+              <span>{{ userInfo.email || 'N/A' }}</span>
+            </div>
+            @if (userInfo.name) {
+              <div class="user-info-field">
+                <strong>{{ 'SETTINGS.OIDC.NAME' | translate }}:</strong> 
+                <span>{{ userInfo.name }}</span>
+              </div>
+            }
+            @if (userInfo.preferred_username) {
+              <div class="user-info-field">
+                <strong>{{ 'SETTINGS.OIDC.USERNAME' | translate }}:</strong> 
+                <span>{{ userInfo.preferred_username }}</span>
+              </div>
+            }
+          </div>
+        }
+      }
     </p-accordion-content>
   </p-accordion-panel>
 </p-accordion>
diff --git a/frontend/src/app/features/settings-page/settings-page.scss b/frontend/src/app/features/settings-page/settings-page.scss
index 636016d..eca908b 100644
--- a/frontend/src/app/features/settings-page/settings-page.scss
+++ b/frontend/src/app/features/settings-page/settings-page.scss
@@ -4,3 +4,34 @@
   overflow: hidden;
   overflow-y: auto;
 }
+
+.oidc-user-info {
+  margin-top: 1rem;
+  padding: 1rem;
+  background-color: var(--p-content-background);
+  border: 1px solid var(--p-content-border-color);
+  border-radius: var(--p-border-radius-md);
+
+  h4 {
+    margin-top: 0;
+    margin-bottom: 0.75rem;
+    color: var(--p-text-color);
+    font-size: 1rem;
+    font-weight: 600;
+  }
+
+  .user-info-field {
+    margin-bottom: 0.5rem;
+    display: flex;
+    gap: 0.5rem;
+    
+    strong {
+      color: var(--p-text-color);
+      min-width: 80px;
+    }
+    
+    span {
+      color: var(--p-text-muted-color);
+    }
+  }
+}

From 7916c49bff904ea085deb38062cdf7be2af0e342 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 12:54:41 +0000
Subject: [PATCH 08/40] Add clear instructions in the UI

Some notes to assist the user in setting up their OIDC config
---
 frontend/public/i18n/en.json                       |  4 +++-
 .../app/features/settings-page/settings-page.html  | 14 ++++++++++++++
 .../app/features/settings-page/settings-page.ts    |  7 ++++++-
 3 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/frontend/public/i18n/en.json b/frontend/public/i18n/en.json
index 02e25b6..5112277 100644
--- a/frontend/public/i18n/en.json
+++ b/frontend/public/i18n/en.json
@@ -211,7 +211,9 @@
       "CURRENT_USER": "Currently Authenticated User",
       "EMAIL": "Email",
       "NAME": "Name",
-      "USERNAME": "Username"
+      "USERNAME": "Username",
+      "REDIRECT_SETUP_TITLE": "Important: OIDC Provider Setup",
+      "REDIRECT_SETUP_MESSAGE": "In your OIDC provider, you must register this exact redirect URI as an allowed callback URL:"
     }
   }
 }
diff --git a/frontend/src/app/features/settings-page/settings-page.html b/frontend/src/app/features/settings-page/settings-page.html
index becdf90..d693caa 100644
--- a/frontend/src/app/features/settings-page/settings-page.html
+++ b/frontend/src/app/features/settings-page/settings-page.html
@@ -29,6 +29,20 @@
       {{ 'SETTINGS.SECTIONS.OIDC_SETTINGS' | translate }}
     </p-accordion-header>
     <p-accordion-content>
+      <!-- OIDC Setup Info -->
+      <p-message 
+        severity="info" 
+        [closable]="false"
+        class="oidc-redirect-info">
+        <ng-template pTemplate="content">
+          <div class="redirect-url-info">
+            <strong>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_TITLE' | translate }}</strong>
+            <p>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_MESSAGE' | translate }}</p>
+            <code class="redirect-example">{{ currentUrl }}/api/auth/oidc/callback</code>
+          </div>
+        </ng-template>
+      </p-message>
+
       <app-settings-page-form 
         [includeKeys]="oidcSettingKeys" 
         (OnSubmit)="onSubmitSettings($event)"
diff --git a/frontend/src/app/features/settings-page/settings-page.ts b/frontend/src/app/features/settings-page/settings-page.ts
index fe39a33..0f82a3a 100644
--- a/frontend/src/app/features/settings-page/settings-page.ts
+++ b/frontend/src/app/features/settings-page/settings-page.ts
@@ -9,11 +9,12 @@ import { finalize } from 'rxjs';
 import { ISettingUpdate, ESettingKey } from 'src/app/entities/settings/settings-interface';
 import { DividerModule } from 'primeng/divider';
 import { AccordionModule } from 'primeng/accordion';
+import { MessageModule } from 'primeng/message';
 import { ToastService } from 'src/app/core/services/toast.service';
 
 @Component({
   selector: 'app-settings-page',
-  imports: [NewPasswordForm, TranslatePipe, SettingsPageForm, DividerModule, AccordionModule],
+  imports: [NewPasswordForm, TranslatePipe, SettingsPageForm, DividerModule, AccordionModule, MessageModule],
   templateUrl: './settings-page.html',
   styleUrl: './settings-page.scss',
   changeDetection: ChangeDetectionStrategy.OnPush,
@@ -34,6 +35,10 @@ export class SettingsPage {
     ESettingKey.OIDC_SCOPES
   ];
 
+  public get currentUrl(): string {
+    return window.location.origin;
+  }
+
   public onSubmitNewPassword(body: ISetPasswordBody): void {
     this.isLoading.set(true);
     this.authApiService

From 6b24007ee45febab61784d4067b35e5af7b9e7ec Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 12:54:56 +0000
Subject: [PATCH 09/40] Update the CSS

Fix the CSS
---
 .../features/settings-page/settings-page.scss | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/frontend/src/app/features/settings-page/settings-page.scss b/frontend/src/app/features/settings-page/settings-page.scss
index eca908b..2ca0206 100644
--- a/frontend/src/app/features/settings-page/settings-page.scss
+++ b/frontend/src/app/features/settings-page/settings-page.scss
@@ -5,6 +5,30 @@
   overflow-y: auto;
 }
 
+.oidc-redirect-info {
+  margin-bottom: 1.5rem;
+  
+  .redirect-url-info {
+    p {
+      margin: 0.5rem 0;
+      line-height: 1.5;
+    }
+    
+    .redirect-example {
+      display: block;
+      margin-top: 0.75rem;
+      padding: 0.5rem;
+      background-color: var(--p-surface-100);
+      border: 1px solid var(--p-surface-300);
+      border-radius: var(--p-border-radius-sm);
+      font-family: 'Courier New', monospace;
+      color: var(--p-primary-color);
+      word-break: break-all;
+      font-size: 0.9rem;
+    }
+  }
+}
+
 .oidc-user-info {
   margin-top: 1rem;
   padding: 1rem;

From fb1ed240c0cf392aaaccdc1a63640dd617be2203 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 12:58:26 +0000
Subject: [PATCH 10/40] Better  instructions in settings page

Clarifies the OIDC provider setup instructions
---
 frontend/public/i18n/en.json                               | 5 +++--
 frontend/src/app/features/settings-page/settings-page.html | 2 +-
 frontend/src/app/features/settings-page/settings-page.ts   | 4 ----
 3 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/frontend/public/i18n/en.json b/frontend/public/i18n/en.json
index 5112277..76860ba 100644
--- a/frontend/public/i18n/en.json
+++ b/frontend/public/i18n/en.json
@@ -212,8 +212,9 @@
       "EMAIL": "Email",
       "NAME": "Name",
       "USERNAME": "Username",
-      "REDIRECT_SETUP_TITLE": "Important: OIDC Provider Setup",
-      "REDIRECT_SETUP_MESSAGE": "In your OIDC provider, you must register this exact redirect URI as an allowed callback URL:"
+      "REDIRECT_SETUP_TITLE": "Important: OIDC Provider Setup", 
+      "REDIRECT_SETUP_MESSAGE": "In your OIDC provider, you must register your Tugtainer URL followed by '/api/auth/oidc/callback' as an allowed callback URL.",
+      "REDIRECT_SETUP_EXAMPLE": "Example: https://your-tugtainer-domain.com/api/auth/oidc/callback"
     }
   }
 }
diff --git a/frontend/src/app/features/settings-page/settings-page.html b/frontend/src/app/features/settings-page/settings-page.html
index d693caa..fe2108c 100644
--- a/frontend/src/app/features/settings-page/settings-page.html
+++ b/frontend/src/app/features/settings-page/settings-page.html
@@ -38,7 +38,7 @@
           <div class="redirect-url-info">
             <strong>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_TITLE' | translate }}</strong>
             <p>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_MESSAGE' | translate }}</p>
-            <code class="redirect-example">{{ currentUrl }}/api/auth/oidc/callback</code>
+            <code class="redirect-example">{{ 'SETTINGS.OIDC.REDIRECT_SETUP_EXAMPLE' | translate }}</code>
           </div>
         </ng-template>
       </p-message>
diff --git a/frontend/src/app/features/settings-page/settings-page.ts b/frontend/src/app/features/settings-page/settings-page.ts
index 0f82a3a..6829b1a 100644
--- a/frontend/src/app/features/settings-page/settings-page.ts
+++ b/frontend/src/app/features/settings-page/settings-page.ts
@@ -35,10 +35,6 @@ export class SettingsPage {
     ESettingKey.OIDC_SCOPES
   ];
 
-  public get currentUrl(): string {
-    return window.location.origin;
-  }
-
   public onSubmitNewPassword(body: ISetPasswordBody): void {
     this.isLoading.set(true);
     this.authApiService

From c9236e0470f5aa22c73fc8c262c3970014613036 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 13:03:13 +0000
Subject: [PATCH 11/40] Make CSS look better

Fix css as it didn't appear very well.
---
 .../features/settings-page/settings-page.html | 19 +++++++------------
 .../features/settings-page/settings-page.scss | 13 +++++++++++++
 .../features/settings-page/settings-page.ts   |  3 +--
 3 files changed, 21 insertions(+), 14 deletions(-)

diff --git a/frontend/src/app/features/settings-page/settings-page.html b/frontend/src/app/features/settings-page/settings-page.html
index fe2108c..8f8dabb 100644
--- a/frontend/src/app/features/settings-page/settings-page.html
+++ b/frontend/src/app/features/settings-page/settings-page.html
@@ -30,18 +30,13 @@
     </p-accordion-header>
     <p-accordion-content>
       <!-- OIDC Setup Info -->
-      <p-message 
-        severity="info" 
-        [closable]="false"
-        class="oidc-redirect-info">
-        <ng-template pTemplate="content">
-          <div class="redirect-url-info">
-            <strong>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_TITLE' | translate }}</strong>
-            <p>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_MESSAGE' | translate }}</p>
-            <code class="redirect-example">{{ 'SETTINGS.OIDC.REDIRECT_SETUP_EXAMPLE' | translate }}</code>
-          </div>
-        </ng-template>
-      </p-message>
+      <div class="oidc-redirect-info">
+        <div class="redirect-url-info">
+          <strong>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_TITLE' | translate }}</strong>
+          <p>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_MESSAGE' | translate }}</p>
+          <code class="redirect-example">{{ 'SETTINGS.OIDC.REDIRECT_SETUP_EXAMPLE' | translate }}</code>
+        </div>
+      </div>
 
       <app-settings-page-form 
         [includeKeys]="oidcSettingKeys" 
diff --git a/frontend/src/app/features/settings-page/settings-page.scss b/frontend/src/app/features/settings-page/settings-page.scss
index 2ca0206..14cb5dc 100644
--- a/frontend/src/app/features/settings-page/settings-page.scss
+++ b/frontend/src/app/features/settings-page/settings-page.scss
@@ -7,11 +7,24 @@
 
 .oidc-redirect-info {
   margin-bottom: 1.5rem;
+  padding: 1rem;
+  background-color: var(--p-blue-50);
+  border: 1px solid var(--p-blue-200);
+  border-left: 4px solid var(--p-blue-500);
+  border-radius: var(--p-border-radius-md);
   
   .redirect-url-info {
+    strong {
+      color: var(--p-blue-700);
+      font-size: 1rem;
+      display: block;
+      margin-bottom: 0.5rem;
+    }
+    
     p {
       margin: 0.5rem 0;
       line-height: 1.5;
+      color: var(--p-text-color);
     }
     
     .redirect-example {
diff --git a/frontend/src/app/features/settings-page/settings-page.ts b/frontend/src/app/features/settings-page/settings-page.ts
index 6829b1a..fe39a33 100644
--- a/frontend/src/app/features/settings-page/settings-page.ts
+++ b/frontend/src/app/features/settings-page/settings-page.ts
@@ -9,12 +9,11 @@ import { finalize } from 'rxjs';
 import { ISettingUpdate, ESettingKey } from 'src/app/entities/settings/settings-interface';
 import { DividerModule } from 'primeng/divider';
 import { AccordionModule } from 'primeng/accordion';
-import { MessageModule } from 'primeng/message';
 import { ToastService } from 'src/app/core/services/toast.service';
 
 @Component({
   selector: 'app-settings-page',
-  imports: [NewPasswordForm, TranslatePipe, SettingsPageForm, DividerModule, AccordionModule, MessageModule],
+  imports: [NewPasswordForm, TranslatePipe, SettingsPageForm, DividerModule, AccordionModule],
   templateUrl: './settings-page.html',
   styleUrl: './settings-page.scss',
   changeDetection: ChangeDetectionStrategy.OnPush,

From af191e8a7757a4089b66b0bb57797e549aeea9e0 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 13:06:50 +0000
Subject: [PATCH 12/40] Fix CSS colours

---
 .../app/features/settings-page/settings-page.scss  | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/frontend/src/app/features/settings-page/settings-page.scss b/frontend/src/app/features/settings-page/settings-page.scss
index 14cb5dc..b40872d 100644
--- a/frontend/src/app/features/settings-page/settings-page.scss
+++ b/frontend/src/app/features/settings-page/settings-page.scss
@@ -8,14 +8,14 @@
 .oidc-redirect-info {
   margin-bottom: 1.5rem;
   padding: 1rem;
-  background-color: var(--p-blue-50);
-  border: 1px solid var(--p-blue-200);
-  border-left: 4px solid var(--p-blue-500);
+  background-color: var(--p-surface-ground);
+  border: 1px solid var(--p-surface-border);
+  border-left: 4px solid var(--p-primary-color);
   border-radius: var(--p-border-radius-md);
   
   .redirect-url-info {
     strong {
-      color: var(--p-blue-700);
+      color: var(--p-primary-color);
       font-size: 1rem;
       display: block;
       margin-bottom: 0.5rem;
@@ -31,11 +31,11 @@
       display: block;
       margin-top: 0.75rem;
       padding: 0.5rem;
-      background-color: var(--p-surface-100);
-      border: 1px solid var(--p-surface-300);
+      background-color: var(--p-surface-200);
+      border: 1px solid var(--p-surface-border);
       border-radius: var(--p-border-radius-sm);
       font-family: 'Courier New', monospace;
-      color: var(--p-primary-color);
+      color: var(--p-text-color);
       word-break: break-all;
       font-size: 0.9rem;
     }

From 17858ab157e0d409a6f2068dfe75d07cbdac65be Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 13:24:27 +0000
Subject: [PATCH 13/40] Update settings-page.scss

---
 frontend/src/app/features/settings-page/settings-page.scss | 2 --
 1 file changed, 2 deletions(-)

diff --git a/frontend/src/app/features/settings-page/settings-page.scss b/frontend/src/app/features/settings-page/settings-page.scss
index b40872d..438cebc 100644
--- a/frontend/src/app/features/settings-page/settings-page.scss
+++ b/frontend/src/app/features/settings-page/settings-page.scss
@@ -31,8 +31,6 @@
       display: block;
       margin-top: 0.75rem;
       padding: 0.5rem;
-      background-color: var(--p-surface-200);
-      border: 1px solid var(--p-surface-border);
       border-radius: var(--p-border-radius-sm);
       font-family: 'Courier New', monospace;
       color: var(--p-text-color);

From 08445cf729c264e46552cb3dba5eac304b79447c Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 14:06:45 +0000
Subject: [PATCH 14/40] Update authlub py package to latest

---
 backend/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/requirements.txt b/backend/requirements.txt
index 7a01be3..0dd0402 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -49,7 +49,7 @@ python-dateutil==2.9.0.post0
 python-dotenv==1.1.1
 python-jose==3.5.0
 python-multipart==0.0.20
-authlib==1.3.2
+authlib==1.6.5
 python-on-whales==0.78.0
 PyYAML==6.0.2
 requests==2.32.5

From d13ada203fee52eb492637cf3042f769a1d602b9 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 11:57:00 +0000
Subject: [PATCH 15/40] Add OIDC authentication support to backend and frontend

This commit introduces OpenID Connect (OIDC) authentication support. Backend changes include new OIDC settings, migration, validation, and endpoints for OIDC login and callback, as well as utility functions for OIDC flows. The frontend adds OIDC login UI, settings management, and connection testing. Both backend and frontend enums, schemas, and services are updated to support OIDC configuration and integration.
---
 .../c1d4e5f6a7b8_add_oidc_settings.py         |  50 ++++++
 backend/api/auth_api.py                       | 145 +++++++++++++++-
 backend/api/settings_api.py                   |  54 +++++-
 backend/core/auth_core.py                     | 164 +++++++++++++++++-
 backend/enums/settings_enum.py                |   9 +
 backend/requirements.txt                      |   1 +
 backend/schemas/auth_schema.py                |  15 +-
 backend/schemas/settings_schema.py            |  32 +++-
 backend/schemas/validators.py                 |  53 ++++++
 frontend/public/i18n/en.json                  |  36 +++-
 .../src/app/entities/auth/auth-api.service.ts |  13 ++
 .../entities/settings/settings-api.service.ts |   4 +
 .../entities/settings/settings-interface.ts   |   9 +
 .../src/app/features/auth-page/auth-page.html |  20 +++
 .../src/app/features/auth-page/auth-page.scss |  13 ++
 .../src/app/features/auth-page/auth-page.ts   |  25 ++-
 .../settings-page-form.html                   |  11 ++
 .../settings-page-form/settings-page-form.ts  |  61 ++++++-
 .../features/settings-page/settings-page.html |  17 +-
 .../features/settings-page/settings-page.ts   |  11 +-
 20 files changed, 717 insertions(+), 26 deletions(-)
 create mode 100644 backend/alembic/versions/c1d4e5f6a7b8_add_oidc_settings.py

diff --git a/backend/alembic/versions/c1d4e5f6a7b8_add_oidc_settings.py b/backend/alembic/versions/c1d4e5f6a7b8_add_oidc_settings.py
new file mode 100644
index 0000000..913f095
--- /dev/null
+++ b/backend/alembic/versions/c1d4e5f6a7b8_add_oidc_settings.py
@@ -0,0 +1,50 @@
+"""add_oidc_settings
+
+Revision ID: c1d4e5f6a7b8
+Revises: b8dc3f40419f
+Create Date: 2025-10-28 12:00:00.000000
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision = 'c1d4e5f6a7b8'
+down_revision = 'b8dc3f40419f'
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    """Add OIDC settings to the settings table."""
+    op.execute(
+        sa.text(
+            """
+        INSERT INTO settings (key, value, value_type) VALUES
+        ('OIDC_ENABLED', 'FALSE', 'bool'),
+        ('OIDC_WELL_KNOWN_URL', '', 'str'),
+        ('OIDC_CLIENT_ID', '', 'str'),
+        ('OIDC_CLIENT_SECRET', '', 'str'),
+        ('OIDC_REDIRECT_URI', '', 'str'),
+        ('OIDC_SCOPES', 'openid profile email', 'str')
+        """
+        )
+    )
+
+
+def downgrade() -> None:
+    """Remove OIDC settings from the settings table."""
+    op.execute(
+        sa.text(
+            """
+        DELETE FROM settings WHERE key IN (
+            'OIDC_ENABLED',
+            'OIDC_WELL_KNOWN_URL', 
+            'OIDC_CLIENT_ID',
+            'OIDC_CLIENT_SECRET',
+            'OIDC_REDIRECT_URI',
+            'OIDC_SCOPES'
+        )
+        """
+        )
+    )
\ No newline at end of file
diff --git a/backend/api/auth_api.py b/backend/api/auth_api.py
index b90c6d1..7f28177 100644
--- a/backend/api/auth_api.py
+++ b/backend/api/auth_api.py
@@ -1,5 +1,7 @@
 from typing import Any
 from datetime import timedelta
+import secrets
+import urllib.parse
 from fastapi import (
     APIRouter,
     Depends,
@@ -8,11 +10,11 @@
     Request,
     status,
 )
-from fastapi.responses import PlainTextResponse
-from backend.helpers.delay_to_minimum import delay_to_minimum
-from backend.config import Config
-from backend.helpers.now import now
-from backend.core.auth_core import (
+from fastapi.responses import PlainTextResponse, RedirectResponse
+from app.helpers.delay_to_minimum import delay_to_minimum
+from app.config import Config
+from app.helpers.now import now
+from app.core.auth_core import (
     get_password_hash,
     verify_token,
     verify_password,
@@ -20,8 +22,14 @@
     is_authorized,
     read_password_hash,
     write_password_hash,
+    is_oidc_enabled,
+    get_oidc_config,
+    fetch_oidc_discovery,
+    create_oidc_authorization_url,
+    exchange_oidc_code,
+    create_oidc_user_session,
 )
-from backend.schemas.auth_schema import PasswordSetRequestBody
+from app.schemas.auth_schema import PasswordSetRequestBody
 
 
 router: APIRouter = APIRouter(prefix="/auth", tags=["auth"])
@@ -165,3 +173,128 @@ def set_password(request: Request, payload: PasswordSetRequestBody):
 def is_password_set():
     password_hash: str | None = read_password_hash()
     return password_hash not in [None, ""]
+
+
+@router.get(
+    path="/oidc/enabled",
+    description="Check if OIDC authentication is enabled",
+    response_model=bool,
+)
+def oidc_enabled():
+    return is_oidc_enabled()
+
+
+@router.get(
+    path="/oidc/login",
+    description="Initiate OIDC login flow",
+)
+async def oidc_login(request: Request):
+    if not is_oidc_enabled():
+        raise HTTPException(
+            status_code=400, detail="OIDC authentication is not enabled"
+        )
+    
+    config = get_oidc_config()
+    
+    if not all([config['well_known_url'], config['client_id'], config['redirect_uri']]):
+        raise HTTPException(
+            status_code=400, detail="OIDC configuration is incomplete"
+        )
+    
+    # Generate state parameter for CSRF protection
+    state = secrets.token_urlsafe(32)
+    
+    # Store state in session/cookie for verification later
+    # For simplicity, we'll use a cookie (in production, consider using a database)
+    
+    try:
+        discovery_doc = await fetch_oidc_discovery(config['well_known_url'])
+        authorization_url = create_oidc_authorization_url(discovery_doc, config, state)
+        
+        response = RedirectResponse(url=authorization_url, status_code=302)
+        response.set_cookie(
+            key="oidc_state",
+            value=state,
+            httponly=True,
+            samesite="strict",
+            secure=Config.HTTPS,
+            max_age=300,  # 5 minutes
+        )
+        return response
+        
+    except Exception as e:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Error initiating OIDC login: {str(e)}"
+        )
+
+
+@router.get(
+    path="/oidc/callback",
+    description="Handle OIDC callback",
+)
+async def oidc_callback(
+    request: Request,
+    response: Response,
+    code: str = None,
+    state: str = None,
+    error: str = None,
+):
+    if error:
+        raise HTTPException(
+            status_code=400,
+            detail=f"OIDC authentication error: {error}"
+        )
+    
+    if not code or not state:
+        raise HTTPException(
+            status_code=400,
+            detail="Missing authorization code or state parameter"
+        )
+    
+    # Verify state parameter
+    stored_state = request.cookies.get("oidc_state")
+    if not stored_state or stored_state != state:
+        raise HTTPException(
+            status_code=400,
+            detail="Invalid state parameter - possible CSRF attack"
+        )
+    
+    config = get_oidc_config()
+    
+    try:
+        discovery_doc = await fetch_oidc_discovery(config['well_known_url'])
+        user_data = await exchange_oidc_code(code, state, discovery_doc, config)
+        tokens = create_oidc_user_session(user_data)
+        
+        # Set authentication cookies
+        response.set_cookie(
+            key="access_token",
+            value=tokens["access_token"],
+            httponly=True,
+            samesite="strict",
+            secure=Config.HTTPS,
+            domain=Config.DOMAIN,
+            max_age=Config.ACCESS_TOKEN_LIFETIME_MIN * 60,
+        )
+        response.set_cookie(
+            key="refresh_token",
+            value=tokens["refresh_token"],
+            httponly=True,
+            samesite="strict",
+            secure=Config.HTTPS,
+            domain=Config.DOMAIN,
+            max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
+        )
+        
+        # Clear the state cookie
+        response.delete_cookie("oidc_state")
+        
+        # Redirect to main application
+        return RedirectResponse(url="/containers", status_code=302)
+        
+    except Exception as e:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Error processing OIDC callback: {str(e)}"
+        )
diff --git a/backend/api/settings_api.py b/backend/api/settings_api.py
index 63d6f77..5fcd404 100644
--- a/backend/api/settings_api.py
+++ b/backend/api/settings_api.py
@@ -13,12 +13,13 @@
     SettingsPatchRequestItem,
     TestNotificationRequestBody,
 )
-from backend.core.notifications_core import send_notification
-from backend.core.cron_manager import CronManager
-from backend.enums.settings_enum import ESettingKey
-from backend.enums.cron_jobs_enum import ECronJob
-from backend.core.containers_core import check_all
-from backend.exception import TugException
+from app.core.auth_core import fetch_oidc_discovery
+from app.core.notifications_core import send_notification
+from app.core.cron_manager import CronManager
+from app.enums.settings_enum import ESettingKey
+from app.enums.cron_jobs_enum import ECronJob
+from app.core.containers_core import check_all
+from app.exception import TugException
 
 VALID_TIMEZONES = available_timezones()
 
@@ -123,3 +124,44 @@ async def test_notification(data: TestNotificationRequestBody):
 )
 def get_available_timezones() -> set[str]:
     return VALID_TIMEZONES
+
+
+@router.post(
+    "/test_oidc",
+    status_code=200,
+    description="Test OIDC well-known URL connectivity",
+)
+async def test_oidc_connection(data: dict):
+    """Test if the OIDC well-known URL is accessible and returns valid configuration"""
+    well_known_url = data.get("well_known_url")
+    if not well_known_url:
+        raise HTTPException(400, "well_known_url is required")
+    
+    try:
+        discovery_doc = await fetch_oidc_discovery(well_known_url)
+        
+        # Check if required endpoints exist
+        required_endpoints = ["authorization_endpoint", "token_endpoint"]
+        missing_endpoints = [ep for ep in required_endpoints if ep not in discovery_doc]
+        
+        if missing_endpoints:
+            raise HTTPException(
+                400, 
+                f"OIDC discovery document is missing required endpoints: {missing_endpoints}"
+            )
+        
+        return {
+            "status": "success",
+            "message": "OIDC configuration is valid",
+            "endpoints": {
+                "authorization_endpoint": discovery_doc.get("authorization_endpoint"),
+                "token_endpoint": discovery_doc.get("token_endpoint"),
+                "userinfo_endpoint": discovery_doc.get("userinfo_endpoint"),
+                "issuer": discovery_doc.get("issuer")
+            }
+        }
+        
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(500, f"Error testing OIDC connection: {str(e)}")
diff --git a/backend/core/auth_core.py b/backend/core/auth_core.py
index 9a853f9..4612d9a 100644
--- a/backend/core/auth_core.py
+++ b/backend/core/auth_core.py
@@ -1,11 +1,18 @@
-from typing import Any
+from typing import Any, Dict, Optional
 from datetime import datetime, timedelta
 from fastapi import HTTPException, Request
 from jose import jwt, JWTError
 import bcrypt
 import os
-from backend.config import Config
-from backend.helpers.now import now
+import asyncio
+import aiohttp
+from authlib.integrations.requests_client import OAuth2Session
+from authlib.oidc.core import CodeIDToken
+from authlib.common.errors import AuthlibBaseError
+from app.config import Config
+from app.helpers.now import now
+from app.helpers.settings_storage import SettingsStorage
+from app.enums.settings_enum import ESettingKey
 
 
 def verify_password(plain: str, hashed: str) -> bool:
@@ -80,3 +87,154 @@ def write_password_hash(password_hash: str) -> None:
         _ = f.write(password_hash)
         f.flush()
         f.close()
+
+
+def is_oidc_enabled() -> bool:
+    """Check if OIDC authentication is enabled"""
+    try:
+        return SettingsStorage.get(ESettingKey.OIDC_ENABLED) == "true"
+    except:
+        return False
+
+
+def get_oidc_config() -> Dict[str, str]:
+    """Get OIDC configuration from settings"""
+    return {
+        'well_known_url': SettingsStorage.get(ESettingKey.OIDC_WELL_KNOWN_URL),
+        'client_id': SettingsStorage.get(ESettingKey.OIDC_CLIENT_ID),
+        'client_secret': SettingsStorage.get(ESettingKey.OIDC_CLIENT_SECRET),
+        'redirect_uri': SettingsStorage.get(ESettingKey.OIDC_REDIRECT_URI),
+        'scopes': SettingsStorage.get(ESettingKey.OIDC_SCOPES).split()
+    }
+
+
+async def fetch_oidc_discovery(well_known_url: str) -> Dict[str, Any]:
+    """Fetch OIDC discovery document from well-known URL"""
+    try:
+        async with aiohttp.ClientSession() as session:
+            async with session.get(well_known_url) as response:
+                if response.status == 200:
+                    return await response.json()
+                else:
+                    raise HTTPException(
+                        status_code=400, 
+                        detail=f"Failed to fetch OIDC discovery document: {response.status}"
+                    )
+    except aiohttp.ClientError as e:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Error fetching OIDC discovery document: {str(e)}"
+        )
+
+
+def create_oidc_authorization_url(discovery_doc: Dict[str, Any], config: Dict[str, str], state: str) -> str:
+    """Create OIDC authorization URL"""
+    try:
+        client = OAuth2Session(
+            client_id=config['client_id'],
+            redirect_uri=config['redirect_uri'],
+            scope=config['scopes']
+        )
+        
+        authorization_url, _ = client.create_authorization_url(
+            discovery_doc['authorization_endpoint'],
+            state=state
+        )
+        return authorization_url
+    except AuthlibBaseError as e:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Error creating authorization URL: {str(e)}"
+        )
+
+
+async def exchange_oidc_code(
+    code: str, 
+    state: str, 
+    discovery_doc: Dict[str, Any], 
+    config: Dict[str, str]
+) -> Dict[str, Any]:
+    """Exchange authorization code for tokens"""
+    try:
+        client = OAuth2Session(
+            client_id=config['client_id'],
+            redirect_uri=config['redirect_uri']
+        )
+        
+        # Exchange code for token
+        token = client.fetch_token(
+            discovery_doc['token_endpoint'],
+            code=code,
+            client_secret=config['client_secret']
+        )
+        
+        # Verify and decode ID token if present
+        if 'id_token' in token:
+            # For production, you should verify the ID token signature
+            # For now, we'll decode without verification (not recommended for production)
+            id_token_claims = jwt.get_unverified_claims(token['id_token'])
+            return {
+                'access_token': token.get('access_token'),
+                'id_token_claims': id_token_claims
+            }
+        
+        # If no ID token, fetch user info from userinfo endpoint
+        if 'userinfo_endpoint' in discovery_doc:
+            async with aiohttp.ClientSession() as session:
+                headers = {'Authorization': f"Bearer {token['access_token']}"}
+                async with session.get(discovery_doc['userinfo_endpoint'], headers=headers) as response:
+                    if response.status == 200:
+                        user_info = await response.json()
+                        return {
+                            'access_token': token.get('access_token'),
+                            'user_info': user_info
+                        }
+        
+        raise HTTPException(
+            status_code=400,
+            detail="Unable to retrieve user information from OIDC provider"
+        )
+        
+    except AuthlibBaseError as e:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Error exchanging authorization code: {str(e)}"
+        )
+
+
+def create_oidc_user_session(user_data: Dict[str, Any]) -> Dict[str, str]:
+    """Create user session tokens after OIDC authentication"""
+    # Extract user identifier (email, sub, or preferred_username)
+    user_claims = user_data.get('id_token_claims', user_data.get('user_info', {}))
+    
+    user_id = (
+        user_claims.get('email') or 
+        user_claims.get('sub') or 
+        user_claims.get('preferred_username') or
+        'unknown_user'
+    )
+    
+    # Create JWT tokens with OIDC user info
+    access_token = create_token(
+        data={
+            "type": "access",
+            "oidc": True,
+            "user_id": user_id,
+            "user_info": user_claims
+        },
+        expires_delta=timedelta(minutes=Config.ACCESS_TOKEN_LIFETIME_MIN)
+    )
+    
+    refresh_token = create_token(
+        data={
+            "type": "refresh", 
+            "oidc": True,
+            "user_id": user_id
+        },
+        expires_delta=timedelta(minutes=Config.REFRESH_TOKEN_LIFETIME_MIN)
+    )
+    
+    return {
+        "access_token": access_token,
+        "refresh_token": refresh_token
+    }
diff --git a/backend/enums/settings_enum.py b/backend/enums/settings_enum.py
index 7522236..183ac35 100644
--- a/backend/enums/settings_enum.py
+++ b/backend/enums/settings_enum.py
@@ -10,6 +10,15 @@ class ESettingKey(str, Enum):
     CRONTAB_EXPR = "CRONTAB_EXPR"
     NOTIFICATION_URL = "NOTIFICATION_URL"
     TIMEZONE = "TIMEZONE"
+    DOCKER_TIMEOUT = "DOCKER_TIMEOUT"
+    
+    # OIDC Settings
+    OIDC_ENABLED = "OIDC_ENABLED"
+    OIDC_WELL_KNOWN_URL = "OIDC_WELL_KNOWN_URL"
+    OIDC_CLIENT_ID = "OIDC_CLIENT_ID"
+    OIDC_CLIENT_SECRET = "OIDC_CLIENT_SECRET"
+    OIDC_REDIRECT_URI = "OIDC_REDIRECT_URI"
+    OIDC_SCOPES = "OIDC_SCOPES"
 
 
 class ESettingType(str, Enum):
diff --git a/backend/requirements.txt b/backend/requirements.txt
index d00e579..7a01be3 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -49,6 +49,7 @@ python-dateutil==2.9.0.post0
 python-dotenv==1.1.1
 python-jose==3.5.0
 python-multipart==0.0.20
+authlib==1.3.2
 python-on-whales==0.78.0
 PyYAML==6.0.2
 requests==2.32.5
diff --git a/backend/schemas/auth_schema.py b/backend/schemas/auth_schema.py
index d72a79e..40c92e7 100644
--- a/backend/schemas/auth_schema.py
+++ b/backend/schemas/auth_schema.py
@@ -1,4 +1,5 @@
 from pydantic import BaseModel, field_validator
+from typing import Dict, Any, Optional
 from .validators import password_validator
 
 
@@ -9,4 +10,16 @@ class PasswordSetRequestBody(BaseModel):
     @field_validator("password", "confirm_password")
     @classmethod
     def validate_password(cls, v: str) -> str:
-        return password_validator(v)
\ No newline at end of file
+        return password_validator(v)
+
+
+class OIDCConfigResponse(BaseModel):
+    enabled: bool
+    client_id: Optional[str] = None
+    redirect_uri: Optional[str] = None
+    scopes: Optional[str] = None
+
+
+class OIDCLoginResponse(BaseModel):
+    authorization_url: str
+    state: str
\ No newline at end of file
diff --git a/backend/schemas/settings_schema.py b/backend/schemas/settings_schema.py
index 8d02069..95aec22 100644
--- a/backend/schemas/settings_schema.py
+++ b/backend/schemas/settings_schema.py
@@ -1,8 +1,14 @@
 from pydantic import BaseModel, RootModel, model_validator
 from typing import Union, cast
 from datetime import datetime
-from backend.enums.settings_enum import ESettingKey
-from .validators import validate_cron_expr, validate_timezone
+from app.enums.settings_enum import ESettingKey
+from .validators import (
+    validate_cron_expr, 
+    validate_timezone,
+    validate_oidc_well_known_url,
+    validate_oidc_client_id,
+    validate_oidc_scopes
+)
 
 
 class SettingsPatchRequestItem(BaseModel):
@@ -12,10 +18,28 @@ class SettingsPatchRequestItem(BaseModel):
     @model_validator(mode="after")
     def validate_setting(self):
         if self.key == ESettingKey.CRONTAB_EXPR:
-            _ = validate_cron_expr(str(self.value))
+            _ = validate_cron_expr(cast(str, self.value))
             return self
         elif self.key == ESettingKey.TIMEZONE:
-            _ = validate_timezone(str(self.value))
+            _ = validate_timezone(cast(str, self.value))
+            return self
+        elif self.key == ESettingKey.OIDC_WELL_KNOWN_URL:
+            self.value = validate_oidc_well_known_url(cast(str, self.value))
+            return self
+        elif self.key == ESettingKey.OIDC_CLIENT_ID:
+            self.value = validate_oidc_client_id(cast(str, self.value))
+            return self
+        elif self.key == ESettingKey.OIDC_SCOPES:
+            self.value = validate_oidc_scopes(cast(str, self.value))
+            return self
+        elif self.key == ESettingKey.OIDC_WELL_KNOWN_URL:
+            self.value = validate_oidc_well_known_url(cast(str, self.value))
+            return self
+        elif self.key == ESettingKey.OIDC_CLIENT_ID:
+            self.value = validate_oidc_client_id(cast(str, self.value))
+            return self
+        elif self.key == ESettingKey.OIDC_SCOPES:
+            self.value = validate_oidc_scopes(cast(str, self.value))
             return self
         else:
             return self
diff --git a/backend/schemas/validators.py b/backend/schemas/validators.py
index 68864cd..220adf9 100644
--- a/backend/schemas/validators.py
+++ b/backend/schemas/validators.py
@@ -2,6 +2,7 @@
 from datetime import datetime
 from cronsim import CronSim, CronSimError
 from zoneinfo import available_timezones
+from urllib.parse import urlparse
 
 
 VALID_TIMEZONES = available_timezones()
@@ -42,3 +43,55 @@ def validate_timezone(tz: str) -> str:
     if tz in VALID_TIMEZONES:
         return tz
     raise ValueError(f"Invalid timezone: {tz}")
+
+
+def validate_oidc_well_known_url(url: str) -> str:
+    """Validate OIDC well-known URL format"""
+    if not url:
+        return url  # Allow empty for disabled OIDC
+    
+    parsed = urlparse(url)
+    if not parsed.scheme or parsed.scheme not in ['http', 'https']:
+        raise ValueError("OIDC well-known URL must start with http:// or https://")
+    
+    if not parsed.netloc:
+        raise ValueError("Invalid OIDC well-known URL format")
+    
+    # Ensure it ends with the well-known path or allow custom paths
+    if not url.endswith('/.well-known/openid_configuration') and '/.well-known/' not in url:
+        raise ValueError("OIDC URL should point to a well-known configuration endpoint")
+    
+    return url
+
+
+def validate_oidc_client_id(client_id: str) -> str:
+    """Validate OIDC Client ID"""
+    if not client_id:
+        return client_id  # Allow empty for disabled OIDC
+    
+    # Basic validation - client IDs are typically alphanumeric with some special chars
+    if not re.match(r'^[a-zA-Z0-9._-]+$', client_id):
+        raise ValueError("OIDC Client ID contains invalid characters")
+    
+    return client_id
+
+
+def validate_oidc_scopes(scopes: str) -> str:
+    """Validate OIDC scopes"""
+    if not scopes:
+        return "openid"  # Default to openid scope
+    
+    # Split scopes and validate each one
+    scope_list = scopes.split()
+    valid_scope_pattern = r'^[a-zA-Z0-9._:-]+$'
+    
+    for scope in scope_list:
+        if not re.match(valid_scope_pattern, scope):
+            raise ValueError(f"Invalid OIDC scope: {scope}")
+    
+    # Ensure 'openid' is always included
+    if 'openid' not in scope_list:
+        scope_list.insert(0, 'openid')
+        scopes = ' '.join(scope_list)
+    
+    return scopes
diff --git a/frontend/public/i18n/en.json b/frontend/public/i18n/en.json
index c60592d..59680e6 100644
--- a/frontend/public/i18n/en.json
+++ b/frontend/public/i18n/en.json
@@ -50,7 +50,9 @@
       "MEDIUM": "Average complexity",
       "STRONG": "Complex password"
     },
-    "PASSWORD_HINTS": ["At least one lowercase", "At least one uppercase", "At least one numeric"]
+    "PASSWORD_HINTS": ["At least one lowercase", "At least one uppercase", "At least one numeric"],
+    "OR": "Or",
+    "LOGIN_WITH_OIDC": "Login with OIDC"
   },
   "HOSTS": {
     "NO_HOSTS_FOUND": "No hosts found",
@@ -138,7 +140,8 @@
     "VALUE": "Value",
     "SECTIONS": {
       "CHANGE_PASSWORD": "Change password",
-      "APP_SETTINGS": "App settings"
+      "APP_SETTINGS": "App settings",
+      "OIDC_SETTINGS": "OIDC Authentication Settings"
     },
     "BY_KEY": {
       "CRONTAB_EXPR": {
@@ -155,6 +158,35 @@
       "TIMEZONE": {
         "LABEL": "Timezone",
         "HINT": "Timezone in IANA format, e.g. Europe/Moscow"
+      },
+      "DOCKER_TIMEOUT": {
+        "LABEL": "Docker timeout",
+        "HINT": "Docker CLI call timeout. This applies primarily to API methods and does not apply to, for example, container re-creation or image pulling."
+      },
+      "OIDC_ENABLED": {
+        "LABEL": "Enable OIDC Authentication",
+        "HINT": "Enable OpenID Connect authentication alongside password authentication"
+      },
+      "OIDC_WELL_KNOWN_URL": {
+        "LABEL": "OIDC Well-Known URL",
+        "HINT": "The well-known configuration URL of your OIDC provider (e.g., https://auth.example.com/.well-known/openid_configuration)",
+        "TEST": "Test OIDC connection"
+      },
+      "OIDC_CLIENT_ID": {
+        "LABEL": "OIDC Client ID",
+        "HINT": "The client identifier registered with your OIDC provider"
+      },
+      "OIDC_CLIENT_SECRET": {
+        "LABEL": "OIDC Client Secret",
+        "HINT": "The client secret for your OIDC application (keep this secure)"
+      },
+      "OIDC_REDIRECT_URI": {
+        "LABEL": "OIDC Redirect URI",
+        "HINT": "The redirect URI configured in your OIDC provider (e.g., https://tugtainer.example.com/auth/oidc/callback)"
+      },
+      "OIDC_SCOPES": {
+        "LABEL": "OIDC Scopes",
+        "HINT": "Space-separated list of OAuth2 scopes to request (openid is always included)"
       }
     }
   }
diff --git a/frontend/src/app/entities/auth/auth-api.service.ts b/frontend/src/app/entities/auth/auth-api.service.ts
index b0bf140..87232b8 100644
--- a/frontend/src/app/entities/auth/auth-api.service.ts
+++ b/frontend/src/app/entities/auth/auth-api.service.ts
@@ -38,4 +38,17 @@ export class AuthApiService extends BaseApiService<'/auth'> {
   isPasswordSet(): Observable<boolean> {
     return this.httpClient.get<boolean>(`${this.basePath}/is_password_set`);
   }
+
+  isOidcEnabled(): Observable<boolean> {
+    return this.httpClient.get<boolean>(`${this.basePath}/oidc/enabled`);
+  }
+
+  initiateOidcLogin(): Observable<any> {
+    // This will redirect to the OIDC provider, so we don't expect a JSON response
+    window.location.href = `${this.basePath}/oidc/login`;
+    return new Observable(subscriber => {
+      // This observable won't emit since we're redirecting
+      subscriber.complete();
+    });
+  }
 }
diff --git a/frontend/src/app/entities/settings/settings-api.service.ts b/frontend/src/app/entities/settings/settings-api.service.ts
index cf3b253..ed084c1 100644
--- a/frontend/src/app/entities/settings/settings-api.service.ts
+++ b/frontend/src/app/entities/settings/settings-api.service.ts
@@ -24,4 +24,8 @@ export class SettingsApiService extends BaseApiService<'/settings'> {
   getAvailableTimezones(): Observable<string[]> {
     return this.httpClient.get<string[]>(`${this.basePath}/available_timezones`);
   }
+
+  testOidcConnection(well_known_url: string): Observable<any> {
+    return this.httpClient.post(`${this.basePath}/test_oidc`, { well_known_url });
+  }
 }
diff --git a/frontend/src/app/entities/settings/settings-interface.ts b/frontend/src/app/entities/settings/settings-interface.ts
index be4618a..12a788a 100644
--- a/frontend/src/app/entities/settings/settings-interface.ts
+++ b/frontend/src/app/entities/settings/settings-interface.ts
@@ -18,4 +18,13 @@ export enum ESettingKey {
   CRONTAB_EXPR = 'CRONTAB_EXPR',
   NOTIFICATION_URL = 'NOTIFICATION_URL',
   TIMEZONE = 'TIMEZONE',
+  DOCKER_TIMEOUT = 'DOCKER_TIMEOUT',
+  
+  // OIDC Settings
+  OIDC_ENABLED = 'OIDC_ENABLED',
+  OIDC_WELL_KNOWN_URL = 'OIDC_WELL_KNOWN_URL',
+  OIDC_CLIENT_ID = 'OIDC_CLIENT_ID',
+  OIDC_CLIENT_SECRET = 'OIDC_CLIENT_SECRET',
+  OIDC_REDIRECT_URI = 'OIDC_REDIRECT_URI',
+  OIDC_SCOPES = 'OIDC_SCOPES',
 }
diff --git a/frontend/src/app/features/auth-page/auth-page.html b/frontend/src/app/features/auth-page/auth-page.html
index ff5fbb3..845fcd2 100644
--- a/frontend/src/app/features/auth-page/auth-page.html
+++ b/frontend/src/app/features/auth-page/auth-page.html
@@ -6,6 +6,26 @@
       (OnSubmit)="onSubmitLogin($event)"
     >
     </app-login-form>
+    
+    @if (isOidcEnabled()) {
+      <div class="oidc-login-section">
+        <p-divider type="horizontal" align="center">
+          <span>{{ 'AUTH.OR' | translate }}</span>
+        </p-divider>
+        
+        <p-button
+          [loading]="isLoading()"
+          severity="secondary"
+          class="oidc-login-button"
+          (onClick)="onOidcLogin()"
+        >
+          <i class="pi pi-id-card"></i>
+          <span pButtonLabel>
+            {{ 'AUTH.LOGIN_WITH_OIDC' | translate }}
+          </span>
+        </p-button>
+      </div>
+    }
   } @else {
     <app-new-password-form
       [isLoading]="isLoading()"
diff --git a/frontend/src/app/features/auth-page/auth-page.scss b/frontend/src/app/features/auth-page/auth-page.scss
index ed16955..fdeb632 100644
--- a/frontend/src/app/features/auth-page/auth-page.scss
+++ b/frontend/src/app/features/auth-page/auth-page.scss
@@ -12,4 +12,17 @@
   .auth {
     @include mx.floating-card-surface;
   }
+
+  .oidc-login-section {
+    margin-top: 1rem;
+    
+    .oidc-login-button {
+      width: 100%;
+      justify-content: center;
+    }
+    
+    p-divider {
+      margin: 1rem 0;
+    }
+  }
 }
diff --git a/frontend/src/app/features/auth-page/auth-page.ts b/frontend/src/app/features/auth-page/auth-page.ts
index e039a55..d15295f 100644
--- a/frontend/src/app/features/auth-page/auth-page.ts
+++ b/frontend/src/app/features/auth-page/auth-page.ts
@@ -7,10 +7,13 @@ import { NewPasswordForm } from 'src/app/shared/components/new-password-form/new
 import { LoginForm } from './login-form/login-form';
 import { Logo } from 'src/app/shared/components/logo/logo';
 import { ToastService } from 'src/app/core/services/toast.service';
+import { ButtonModule } from 'primeng/button';
+import { DividerModule } from 'primeng/divider';
+import { TranslatePipe } from '@ngx-translate/core';
 
 @Component({
   selector: 'app-auth',
-  imports: [NewPasswordForm, LoginForm, Logo],
+  imports: [NewPasswordForm, LoginForm, Logo, ButtonModule, DividerModule, TranslatePipe],
   templateUrl: './auth-page.html',
   styleUrl: './auth-page.scss',
   changeDetection: ChangeDetectionStrategy.OnPush,
@@ -22,9 +25,11 @@ export class AuthPage implements OnInit {
 
   public readonly isLoading = signal<boolean>(false);
   public readonly isPasswordSet = signal<boolean>(null);
+  public readonly isOidcEnabled = signal<boolean>(false);
 
   ngOnInit(): void {
     this.updateIsPasswordSet();
+    this.updateIsOidcEnabled();
   }
 
   private updateIsPasswordSet(): void {
@@ -72,4 +77,22 @@ export class AuthPage implements OnInit {
         },
       });
   }
+
+  private updateIsOidcEnabled(): void {
+    this.authApiService
+      .isOidcEnabled()
+      .subscribe({
+        next: (res) => {
+          this.isOidcEnabled.set(res);
+        },
+        error: (error) => {
+          console.warn('Could not check OIDC status:', error);
+          this.isOidcEnabled.set(false);
+        },
+      });
+  }
+
+  onOidcLogin(): void {
+    this.authApiService.initiateOidcLogin().subscribe();
+  }
 }
diff --git a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.html b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.html
index 9a3e614..d0d9a83 100644
--- a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.html
+++ b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.html
@@ -32,6 +32,17 @@
             >
             </p-button>
           }
+          @case (ESettingKey.OIDC_WELL_KNOWN_URL) {
+            <p-button
+              icon="pi pi-link"
+              severity="contrast"
+              rounded="true"
+              [pTooltip]="'SETTINGS.BY_KEY.OIDC_WELL_KNOWN_URL.TEST' | translate"
+              tooltipPosition="left"
+              (onClick)="onTestOidc()"
+            >
+            </p-button>
+          }
         }
 
         @if (keyTranslates[key]?.HINT; as hint) {
diff --git a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts
index be0eaa5..6af91da 100644
--- a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts
+++ b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts
@@ -3,6 +3,7 @@ import {
   Component,
   computed,
   inject,
+  input,
   output,
   signal,
 } from '@angular/core';
@@ -61,6 +62,8 @@ export class SettingsPageForm {
   private readonly toastService = inject(ToastService);
 
   public readonly OnSubmit = output<ISettingUpdate[]>();
+  public readonly includeKeys = input<ESettingKey[]>();
+  public readonly excludeKeys = input<ESettingKey[]>();
 
   public readonly ESettingKey = ESettingKey;
   public readonly keyTranslates = this.translateService.instant('SETTINGS.BY_KEY');
@@ -100,6 +103,19 @@ export class SettingsPageForm {
     return null;
   };
 
+  private urlValidator: ValidatorFn = (control: AbstractControl<string>) => {
+    const value = control.value;
+    if (!!value) {
+      try {
+        new URL(value);
+        return null;
+      } catch {
+        return { urlValidator: true };
+      }
+    }
+    return null;
+  };
+
   constructor() {
     this.updateSettings();
   }
@@ -116,7 +132,19 @@ export class SettingsPageForm {
       .subscribe({
         next: (list) => {
           this.formArray.clear();
-          for (const item of list) {
+          let filteredList = list;
+          
+          // Filter based on includeKeys or excludeKeys
+          const includeKeys = this.includeKeys();
+          const excludeKeys = this.excludeKeys();
+          
+          if (includeKeys && includeKeys.length > 0) {
+            filteredList = list.filter(item => includeKeys.includes(item.key));
+          } else if (excludeKeys && excludeKeys.length > 0) {
+            filteredList = list.filter(item => !excludeKeys.includes(item.key));
+          }
+          
+          for (const item of filteredList) {
             const form = this.getFormGroup(item);
             this.formArray.push(form);
           }
@@ -148,6 +176,12 @@ export class SettingsPageForm {
         return [Validators.required, this.cronValidator];
       case ESettingKey.TIMEZONE:
         return [Validators.required, this.timezoneValidator];
+      case ESettingKey.OIDC_WELL_KNOWN_URL:
+        return [this.urlValidator];
+      case ESettingKey.OIDC_CLIENT_ID:
+        return [];
+      case ESettingKey.OIDC_REDIRECT_URI:
+        return [this.urlValidator];
       default:
         return [];
     }
@@ -176,6 +210,31 @@ export class SettingsPageForm {
       });
   }
 
+  public onTestOidc(): void {
+    this.isLoading.set(true);
+    const wellKnownUrl = this.formArray.value.find(
+      (item) => item.key === ESettingKey.OIDC_WELL_KNOWN_URL,
+    ).value as string;
+    
+    if (!wellKnownUrl) {
+      this.toastService.error('OIDC Well-Known URL is required for testing');
+      this.isLoading.set(false);
+      return;
+    }
+    
+    this.settingsApiService
+      .testOidcConnection(wellKnownUrl)
+      .pipe(finalize(() => this.isLoading.set(false)))
+      .subscribe({
+        next: (response) => {
+          this.toastService.success(`OIDC Connection Test Successful. Provider: ${response.endpoints?.issuer || 'Unknown'}`);
+        },
+        error: (error) => {
+          this.toastService.error(error);
+        },
+      });
+  }
+
   public submit(): void {
     if (this.formArray.invalid) {
       this.formArray.controls.forEach((c) => {
diff --git a/frontend/src/app/features/settings-page/settings-page.html b/frontend/src/app/features/settings-page/settings-page.html
index 3ceb292..12c6861 100644
--- a/frontend/src/app/features/settings-page/settings-page.html
+++ b/frontend/src/app/features/settings-page/settings-page.html
@@ -17,7 +17,22 @@
       {{ 'SETTINGS.SECTIONS.APP_SETTINGS' | translate }}
     </p-accordion-header>
     <p-accordion-content>
-      <app-settings-page-form (OnSubmit)="onSubmitSettings($event)"></app-settings-page-form>
+      <app-settings-page-form 
+        [excludeKeys]="oidcSettingKeys" 
+        (OnSubmit)="onSubmitSettings($event)"
+      ></app-settings-page-form>
+    </p-accordion-content>
+  </p-accordion-panel>
+
+  <p-accordion-panel value="2">
+    <p-accordion-header>
+      {{ 'SETTINGS.SECTIONS.OIDC_SETTINGS' | translate }}
+    </p-accordion-header>
+    <p-accordion-content>
+      <app-settings-page-form 
+        [includeKeys]="oidcSettingKeys" 
+        (OnSubmit)="onSubmitSettings($event)"
+      ></app-settings-page-form>
     </p-accordion-content>
   </p-accordion-panel>
 </p-accordion>
diff --git a/frontend/src/app/features/settings-page/settings-page.ts b/frontend/src/app/features/settings-page/settings-page.ts
index 7a08a50..fe39a33 100644
--- a/frontend/src/app/features/settings-page/settings-page.ts
+++ b/frontend/src/app/features/settings-page/settings-page.ts
@@ -6,7 +6,7 @@ import { TranslatePipe } from '@ngx-translate/core';
 import { AuthApiService } from 'src/app/entities/auth/auth-api.service';
 import { SettingsApiService } from 'src/app/entities/settings/settings-api.service';
 import { finalize } from 'rxjs';
-import { ISettingUpdate } from 'src/app/entities/settings/settings-interface';
+import { ISettingUpdate, ESettingKey } from 'src/app/entities/settings/settings-interface';
 import { DividerModule } from 'primeng/divider';
 import { AccordionModule } from 'primeng/accordion';
 import { ToastService } from 'src/app/core/services/toast.service';
@@ -24,6 +24,15 @@ export class SettingsPage {
   private readonly settingsApiService = inject(SettingsApiService);
 
   public readonly isLoading = signal<boolean>(false);
+  
+  public readonly oidcSettingKeys = [
+    ESettingKey.OIDC_ENABLED,
+    ESettingKey.OIDC_WELL_KNOWN_URL,
+    ESettingKey.OIDC_CLIENT_ID,
+    ESettingKey.OIDC_CLIENT_SECRET,
+    ESettingKey.OIDC_REDIRECT_URI,
+    ESettingKey.OIDC_SCOPES
+  ];
 
   public onSubmitNewPassword(body: ISetPasswordBody): void {
     this.isLoading.set(true);

From 97affedb3cb8d40c189f16ac440c77033190b9c3 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 11:59:21 +0000
Subject: [PATCH 16/40] Fix auth page issue

---
 frontend/src/app/features/auth-page/auth-page.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/src/app/features/auth-page/auth-page.html b/frontend/src/app/features/auth-page/auth-page.html
index 845fcd2..c2df616 100644
--- a/frontend/src/app/features/auth-page/auth-page.html
+++ b/frontend/src/app/features/auth-page/auth-page.html
@@ -9,7 +9,7 @@
     
     @if (isOidcEnabled()) {
       <div class="oidc-login-section">
-        <p-divider type="horizontal" align="center">
+        <p-divider align="center">
           <span>{{ 'AUTH.OR' | translate }}</span>
         </p-divider>
         

From dd037d340bd9f0a10560da5d8d80528eb927bccc Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 12:06:30 +0000
Subject: [PATCH 17/40] Attempt at fixing API settings

Bug in the settings API where it assumes CRONTAB_EXPR is always included when saving settings. When saving only OIDC settings, this fails.
---
 backend/api/settings_api.py | 44 +++++++++++++++++++++++++++----------
 1 file changed, 32 insertions(+), 12 deletions(-)

diff --git a/backend/api/settings_api.py b/backend/api/settings_api.py
index 5fcd404..fe255bd 100644
--- a/backend/api/settings_api.py
+++ b/backend/api/settings_api.py
@@ -78,20 +78,40 @@ async def change_system_settings(
 
     await session.commit()
 
-    cron_expr = [
+    # Only reschedule cron job if CRONTAB_EXPR or TIMEZONE were updated
+    cron_expr_items = [
         item for item in data if item.key == ESettingKey.CRONTAB_EXPR
-    ][0]
-    timezone = [
+    ]
+    timezone_items = [
         item for item in data if item.key == ESettingKey.TIMEZONE
-    ][0]
-
-    if cron_expr or timezone:
-        CronManager.schedule_job(
-            ECronJob.CHECK_CONTAINERS,
-            str(cron_expr.value),
-            str(timezone.value),
-            lambda: check_all(True),
-        )
+    ]
+
+    if cron_expr_items or timezone_items:
+        cron_expr = cron_expr_items[0] if cron_expr_items else None
+        timezone = timezone_items[0] if timezone_items else None
+        
+        # Get current values if not provided in the update
+        if not cron_expr:
+            stmt = select(SettingModel).where(SettingModel.key == ESettingKey.CRONTAB_EXPR).limit(1)
+            result = await session.execute(stmt)
+            cron_setting = result.scalar_one_or_none()
+            if cron_setting:
+                cron_expr = type('obj', (object,), {'value': cron_setting.value})()
+        
+        if not timezone:
+            stmt = select(SettingModel).where(SettingModel.key == ESettingKey.TIMEZONE).limit(1)
+            result = await session.execute(stmt)
+            timezone_setting = result.scalar_one_or_none()
+            if timezone_setting:
+                timezone = type('obj', (object,), {'value': timezone_setting.value})()
+        
+        if cron_expr and timezone:
+            CronManager.schedule_job(
+                ECronJob.CHECK_CONTAINERS,
+                str(cron_expr.value),
+                str(timezone.value),
+                lambda: check_all(True),
+            )
 
     return {"status": "updated", "count": len(data)}
 

From c1ab9c3e228d421d2fc4f57d6e4a9172847692ff Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 12:11:03 +0000
Subject: [PATCH 18/40] Fix boolean

Error checking if OIDC was enabled, stopped the auth method from showing.
---
 backend/core/auth_core.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/core/auth_core.py b/backend/core/auth_core.py
index 4612d9a..bf9e01d 100644
--- a/backend/core/auth_core.py
+++ b/backend/core/auth_core.py
@@ -92,7 +92,7 @@ def write_password_hash(password_hash: str) -> None:
 def is_oidc_enabled() -> bool:
     """Check if OIDC authentication is enabled"""
     try:
-        return SettingsStorage.get(ESettingKey.OIDC_ENABLED) == "true"
+        return SettingsStorage.get(ESettingKey.OIDC_ENABLED) is True
     except:
         return False
 

From cba69501c4c899ddc8f10e179886471d5c4eebea Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 12:16:35 +0000
Subject: [PATCH 19/40] Various fixes

- fix an issue in the token exchange where I'm using the session outside its context

- fix cookie domain logging and session context in the token exchange

- added debug logging
---
 backend/api/auth_api.py   | 14 +++++--
 backend/core/auth_core.py | 87 ++++++++++++++++++++++-----------------
 2 files changed, 60 insertions(+), 41 deletions(-)

diff --git a/backend/api/auth_api.py b/backend/api/auth_api.py
index 7f28177..4c692d9 100644
--- a/backend/api/auth_api.py
+++ b/backend/api/auth_api.py
@@ -263,9 +263,16 @@ async def oidc_callback(
     config = get_oidc_config()
     
     try:
+        print(f"OIDC Callback - Code: {code}, State: {state}")  # Debug print
         discovery_doc = await fetch_oidc_discovery(config['well_known_url'])
+        print(f"OIDC Discovery successful")  # Debug print
         user_data = await exchange_oidc_code(code, state, discovery_doc, config)
+        print(f"OIDC Token exchange successful: {user_data}")  # Debug print
         tokens = create_oidc_user_session(user_data)
+        print(f"OIDC Session created")  # Debug print
+        
+        # Create response for redirect
+        response = RedirectResponse(url="/containers", status_code=302)
         
         # Set authentication cookies
         response.set_cookie(
@@ -274,7 +281,7 @@ async def oidc_callback(
             httponly=True,
             samesite="strict",
             secure=Config.HTTPS,
-            domain=Config.DOMAIN,
+            domain=Config.DOMAIN if Config.DOMAIN else None,
             max_age=Config.ACCESS_TOKEN_LIFETIME_MIN * 60,
         )
         response.set_cookie(
@@ -283,15 +290,14 @@ async def oidc_callback(
             httponly=True,
             samesite="strict",
             secure=Config.HTTPS,
-            domain=Config.DOMAIN,
+            domain=Config.DOMAIN if Config.DOMAIN else None,
             max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
         )
         
         # Clear the state cookie
         response.delete_cookie("oidc_state")
         
-        # Redirect to main application
-        return RedirectResponse(url="/containers", status_code=302)
+        return response
         
     except Exception as e:
         raise HTTPException(
diff --git a/backend/core/auth_core.py b/backend/core/auth_core.py
index bf9e01d..90211e0 100644
--- a/backend/core/auth_core.py
+++ b/backend/core/auth_core.py
@@ -6,9 +6,7 @@
 import os
 import asyncio
 import aiohttp
-from authlib.integrations.requests_client import OAuth2Session
-from authlib.oidc.core import CodeIDToken
-from authlib.common.errors import AuthlibBaseError
+from urllib.parse import urlencode
 from app.config import Config
 from app.helpers.now import now
 from app.helpers.settings_storage import SettingsStorage
@@ -130,18 +128,24 @@ async def fetch_oidc_discovery(well_known_url: str) -> Dict[str, Any]:
 def create_oidc_authorization_url(discovery_doc: Dict[str, Any], config: Dict[str, str], state: str) -> str:
     """Create OIDC authorization URL"""
     try:
-        client = OAuth2Session(
-            client_id=config['client_id'],
-            redirect_uri=config['redirect_uri'],
-            scope=config['scopes']
-        )
+        # Manually build the authorization URL
+        auth_endpoint = discovery_doc['authorization_endpoint']
+        scopes = ' '.join(config['scopes'])
+        
+        params = {
+            'client_id': config['client_id'],
+            'redirect_uri': config['redirect_uri'],
+            'scope': scopes,
+            'response_type': 'code',
+            'state': state
+        }
+        
+        # Build query string
+        query_string = urlencode(params)
+        authorization_url = f"{auth_endpoint}?{query_string}"
         
-        authorization_url, _ = client.create_authorization_url(
-            discovery_doc['authorization_endpoint'],
-            state=state
-        )
         return authorization_url
-    except AuthlibBaseError as e:
+    except Exception as e:
         raise HTTPException(
             status_code=400,
             detail=f"Error creating authorization URL: {str(e)}"
@@ -156,31 +160,40 @@ async def exchange_oidc_code(
 ) -> Dict[str, Any]:
     """Exchange authorization code for tokens"""
     try:
-        client = OAuth2Session(
-            client_id=config['client_id'],
-            redirect_uri=config['redirect_uri']
-        )
-        
-        # Exchange code for token
-        token = client.fetch_token(
-            discovery_doc['token_endpoint'],
-            code=code,
-            client_secret=config['client_secret']
-        )
+        # Prepare token exchange request
+        token_endpoint = discovery_doc['token_endpoint']
         
-        # Verify and decode ID token if present
-        if 'id_token' in token:
-            # For production, you should verify the ID token signature
-            # For now, we'll decode without verification (not recommended for production)
-            id_token_claims = jwt.get_unverified_claims(token['id_token'])
-            return {
-                'access_token': token.get('access_token'),
-                'id_token_claims': id_token_claims
-            }
+        data = {
+            'grant_type': 'authorization_code',
+            'code': code,
+            'redirect_uri': config['redirect_uri'],
+            'client_id': config['client_id'],
+            'client_secret': config['client_secret']
+        }
         
-        # If no ID token, fetch user info from userinfo endpoint
-        if 'userinfo_endpoint' in discovery_doc:
-            async with aiohttp.ClientSession() as session:
+        # Exchange code for token
+        async with aiohttp.ClientSession() as session:
+            async with session.post(token_endpoint, data=data) as response:
+                if response.status != 200:
+                    error_text = await response.text()
+                    raise HTTPException(
+                        status_code=400,
+                        detail=f"Token exchange failed: {error_text}"
+                    )
+                
+                token = await response.json()
+            
+            # Verify and decode ID token if present
+            if 'id_token' in token:
+                # For now, we'll decode without verification (not recommended for production)
+                id_token_claims = jwt.get_unverified_claims(token['id_token'])
+                return {
+                    'access_token': token.get('access_token'),
+                    'id_token_claims': id_token_claims
+                }
+            
+            # If no ID token, fetch user info from userinfo endpoint
+            if 'userinfo_endpoint' in discovery_doc:
                 headers = {'Authorization': f"Bearer {token['access_token']}"}
                 async with session.get(discovery_doc['userinfo_endpoint'], headers=headers) as response:
                     if response.status == 200:
@@ -195,7 +208,7 @@ async def exchange_oidc_code(
             detail="Unable to retrieve user information from OIDC provider"
         )
         
-    except AuthlibBaseError as e:
+    except Exception as e:
         raise HTTPException(
             status_code=400,
             detail=f"Error exchanging authorization code: {str(e)}"

From f58c761cc833d7eabbf37330bd216d10bb2d676e Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 12:28:39 +0000
Subject: [PATCH 20/40] Relax OIDC cookie settings and add debug prints

Changed OIDC state cookie 'samesite' from 'strict' to 'lax' and 'secure' to False to facilitate HTTP testing and cross-origin redirects. Added debug print statements to log state and cookies during OIDC callback for easier troubleshooting.
---
 backend/api/auth_api.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/backend/api/auth_api.py b/backend/api/auth_api.py
index 4c692d9..92ee589 100644
--- a/backend/api/auth_api.py
+++ b/backend/api/auth_api.py
@@ -216,8 +216,8 @@ async def oidc_login(request: Request):
             key="oidc_state",
             value=state,
             httponly=True,
-            samesite="strict",
-            secure=Config.HTTPS,
+            samesite="lax",  # Changed from strict to lax for cross-origin redirects
+            secure=False,  # Set to False for HTTP testing
             max_age=300,  # 5 minutes
         )
         return response
@@ -254,10 +254,12 @@ async def oidc_callback(
     
     # Verify state parameter
     stored_state = request.cookies.get("oidc_state")
+    print(f"OIDC Callback Debug - Received state: {state}, Stored state: {stored_state}")  # Debug print
+    print(f"OIDC Callback Debug - All cookies: {dict(request.cookies)}")  # Debug print
     if not stored_state or stored_state != state:
         raise HTTPException(
             status_code=400,
-            detail="Invalid state parameter - possible CSRF attack"
+            detail=f"Invalid state parameter - received: {state}, stored: {stored_state}"
         )
     
     config = get_oidc_config()

From 4d4ffad00de8452fcf87053d4d135e7796b1e377 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 12:36:11 +0000
Subject: [PATCH 21/40] Add OIDC user info display to settings page

---
 backend/api/auth_api.py                       | 40 +++++++++++++++++++
 frontend/public/i18n/en.json                  |  6 +++
 .../src/app/entities/auth/auth-api.service.ts |  4 ++
 .../settings-page-form/settings-page-form.ts  | 27 +++++++++++++
 .../features/settings-page/settings-page.html | 26 ++++++++++++
 .../features/settings-page/settings-page.scss | 31 ++++++++++++++
 6 files changed, 134 insertions(+)

diff --git a/backend/api/auth_api.py b/backend/api/auth_api.py
index 92ee589..5822f09 100644
--- a/backend/api/auth_api.py
+++ b/backend/api/auth_api.py
@@ -175,6 +175,46 @@ def is_password_set():
     return password_hash not in [None, ""]
 
 
+def get_current_user(request: Request) -> dict[str, Any]:
+    """Dependency to get current user from access token"""
+    access_token: str | None = request.cookies.get("access_token")
+    if not access_token:
+        raise HTTPException(
+            status_code=401, detail="Missing access token"
+        )
+    
+    payload: dict[str, Any] = verify_token(access_token)
+    if payload.get("type") != "access":
+        raise HTTPException(
+            status_code=401, detail="Invalid access token"
+        )
+    
+    return payload
+
+
+@router.get(
+    path="/user/info",
+    description="Get current authenticated user information",
+)
+def get_user_info(current_user: dict[str, Any] = Depends(get_current_user)):
+    user_info = {
+        "is_oidc": current_user.get("oidc", False),
+        "user_id": current_user.get("user_id", ""),
+    }
+    
+    # If OIDC user, include additional user info
+    if current_user.get("oidc") and current_user.get("user_info"):
+        oidc_info = current_user.get("user_info", {})
+        user_info.update({
+            "email": oidc_info.get("email", ""),
+            "name": oidc_info.get("name", ""),
+            "preferred_username": oidc_info.get("preferred_username", ""),
+            "sub": oidc_info.get("sub", ""),
+        })
+    
+    return user_info
+
+
 @router.get(
     path="/oidc/enabled",
     description="Check if OIDC authentication is enabled",
diff --git a/frontend/public/i18n/en.json b/frontend/public/i18n/en.json
index 59680e6..815dbdd 100644
--- a/frontend/public/i18n/en.json
+++ b/frontend/public/i18n/en.json
@@ -188,6 +188,12 @@
         "LABEL": "OIDC Scopes",
         "HINT": "Space-separated list of OAuth2 scopes to request (openid is always included)"
       }
+    },
+    "OIDC": {
+      "CURRENT_USER": "Currently Authenticated User",
+      "EMAIL": "Email",
+      "NAME": "Name",
+      "USERNAME": "Username"
     }
   }
 }
diff --git a/frontend/src/app/entities/auth/auth-api.service.ts b/frontend/src/app/entities/auth/auth-api.service.ts
index 87232b8..c1708aa 100644
--- a/frontend/src/app/entities/auth/auth-api.service.ts
+++ b/frontend/src/app/entities/auth/auth-api.service.ts
@@ -51,4 +51,8 @@ export class AuthApiService extends BaseApiService<'/auth'> {
       subscriber.complete();
     });
   }
+
+  getUserInfo(): Observable<any> {
+    return this.httpClient.get(`${this.basePath}/user/info`, { withCredentials: true });
+  }
 }
diff --git a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts
index 6af91da..6f8786e 100644
--- a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts
+++ b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts
@@ -20,6 +20,7 @@ import {
 import { TranslatePipe, TranslateService } from '@ngx-translate/core';
 import { catchError, finalize, of } from 'rxjs';
 import { SettingsApiService } from 'src/app/entities/settings/settings-api.service';
+import { AuthApiService } from 'src/app/entities/auth/auth-api.service';
 import {
   ESettingKey,
   ESettingValueType,
@@ -58,6 +59,7 @@ import { ToastService } from 'src/app/core/services/toast.service';
 })
 export class SettingsPageForm {
   private readonly settingsApiService = inject(SettingsApiService);
+  private readonly authApiService = inject(AuthApiService);
   private readonly translateService = inject(TranslateService);
   private readonly toastService = inject(ToastService);
 
@@ -73,6 +75,10 @@ export class SettingsPageForm {
   private readonly timezones = toSignal(
     this.settingsApiService.getAvailableTimezones().pipe(catchError(() => of([]))),
   );
+
+  // User info signals
+  public readonly userInfo = signal<any>(null);
+  public readonly isLoadingUserInfo = signal<boolean>(false);
   public readonly timezonesSearch = signal<string>(null);
   public readonly displayedTimezones = computed<string[]>(() => {
     const timezones = this.timezones();
@@ -118,6 +124,7 @@ export class SettingsPageForm {
 
   constructor() {
     this.updateSettings();
+    this.loadUserInfo();
   }
 
   private updateSettings(): void {
@@ -155,6 +162,26 @@ export class SettingsPageForm {
       });
   }
 
+  private loadUserInfo(): void {
+    this.isLoadingUserInfo.set(true);
+    this.authApiService
+      .getUserInfo()
+      .pipe(
+        finalize(() => {
+          this.isLoadingUserInfo.set(false);
+        }),
+        catchError((error) => {
+          // Silently fail if user is not authenticated (e.g., using password auth)
+          return of(null);
+        }),
+      )
+      .subscribe({
+        next: (userInfo) => {
+          this.userInfo.set(userInfo);
+        },
+      });
+  }
+
   private getFormGroup(data: ISetting): FormGroup<TInterfaceToForm<ISetting>> {
     const form = new FormGroup<TInterfaceToForm<ISetting>>({
       key: new FormControl<ESettingKey>(data.key),
diff --git a/frontend/src/app/features/settings-page/settings-page.html b/frontend/src/app/features/settings-page/settings-page.html
index 12c6861..becdf90 100644
--- a/frontend/src/app/features/settings-page/settings-page.html
+++ b/frontend/src/app/features/settings-page/settings-page.html
@@ -32,7 +32,33 @@
       <app-settings-page-form 
         [includeKeys]="oidcSettingKeys" 
         (OnSubmit)="onSubmitSettings($event)"
+        #oidcSettingsForm
       ></app-settings-page-form>
+
+      <!-- OIDC User Info Display -->
+      @if (oidcSettingsForm.userInfo(); as userInfo) {
+        @if (userInfo.is_oidc) {
+          <div class="oidc-user-info">
+            <h4>{{ 'SETTINGS.OIDC.CURRENT_USER' | translate }}</h4>
+            <div class="user-info-field">
+              <strong>{{ 'SETTINGS.OIDC.EMAIL' | translate }}:</strong> 
+              <span>{{ userInfo.email || 'N/A' }}</span>
+            </div>
+            @if (userInfo.name) {
+              <div class="user-info-field">
+                <strong>{{ 'SETTINGS.OIDC.NAME' | translate }}:</strong> 
+                <span>{{ userInfo.name }}</span>
+              </div>
+            }
+            @if (userInfo.preferred_username) {
+              <div class="user-info-field">
+                <strong>{{ 'SETTINGS.OIDC.USERNAME' | translate }}:</strong> 
+                <span>{{ userInfo.preferred_username }}</span>
+              </div>
+            }
+          </div>
+        }
+      }
     </p-accordion-content>
   </p-accordion-panel>
 </p-accordion>
diff --git a/frontend/src/app/features/settings-page/settings-page.scss b/frontend/src/app/features/settings-page/settings-page.scss
index 636016d..eca908b 100644
--- a/frontend/src/app/features/settings-page/settings-page.scss
+++ b/frontend/src/app/features/settings-page/settings-page.scss
@@ -4,3 +4,34 @@
   overflow: hidden;
   overflow-y: auto;
 }
+
+.oidc-user-info {
+  margin-top: 1rem;
+  padding: 1rem;
+  background-color: var(--p-content-background);
+  border: 1px solid var(--p-content-border-color);
+  border-radius: var(--p-border-radius-md);
+
+  h4 {
+    margin-top: 0;
+    margin-bottom: 0.75rem;
+    color: var(--p-text-color);
+    font-size: 1rem;
+    font-weight: 600;
+  }
+
+  .user-info-field {
+    margin-bottom: 0.5rem;
+    display: flex;
+    gap: 0.5rem;
+    
+    strong {
+      color: var(--p-text-color);
+      min-width: 80px;
+    }
+    
+    span {
+      color: var(--p-text-muted-color);
+    }
+  }
+}

From 82f550232ef1b3cb14de503827ed7000e712a232 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 12:54:41 +0000
Subject: [PATCH 22/40] Add clear instructions in the UI

Some notes to assist the user in setting up their OIDC config
---
 frontend/public/i18n/en.json                       |  4 +++-
 .../app/features/settings-page/settings-page.html  | 14 ++++++++++++++
 .../app/features/settings-page/settings-page.ts    |  7 ++++++-
 3 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/frontend/public/i18n/en.json b/frontend/public/i18n/en.json
index 815dbdd..d7ca32a 100644
--- a/frontend/public/i18n/en.json
+++ b/frontend/public/i18n/en.json
@@ -193,7 +193,9 @@
       "CURRENT_USER": "Currently Authenticated User",
       "EMAIL": "Email",
       "NAME": "Name",
-      "USERNAME": "Username"
+      "USERNAME": "Username",
+      "REDIRECT_SETUP_TITLE": "Important: OIDC Provider Setup",
+      "REDIRECT_SETUP_MESSAGE": "In your OIDC provider, you must register this exact redirect URI as an allowed callback URL:"
     }
   }
 }
diff --git a/frontend/src/app/features/settings-page/settings-page.html b/frontend/src/app/features/settings-page/settings-page.html
index becdf90..d693caa 100644
--- a/frontend/src/app/features/settings-page/settings-page.html
+++ b/frontend/src/app/features/settings-page/settings-page.html
@@ -29,6 +29,20 @@
       {{ 'SETTINGS.SECTIONS.OIDC_SETTINGS' | translate }}
     </p-accordion-header>
     <p-accordion-content>
+      <!-- OIDC Setup Info -->
+      <p-message 
+        severity="info" 
+        [closable]="false"
+        class="oidc-redirect-info">
+        <ng-template pTemplate="content">
+          <div class="redirect-url-info">
+            <strong>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_TITLE' | translate }}</strong>
+            <p>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_MESSAGE' | translate }}</p>
+            <code class="redirect-example">{{ currentUrl }}/api/auth/oidc/callback</code>
+          </div>
+        </ng-template>
+      </p-message>
+
       <app-settings-page-form 
         [includeKeys]="oidcSettingKeys" 
         (OnSubmit)="onSubmitSettings($event)"
diff --git a/frontend/src/app/features/settings-page/settings-page.ts b/frontend/src/app/features/settings-page/settings-page.ts
index fe39a33..0f82a3a 100644
--- a/frontend/src/app/features/settings-page/settings-page.ts
+++ b/frontend/src/app/features/settings-page/settings-page.ts
@@ -9,11 +9,12 @@ import { finalize } from 'rxjs';
 import { ISettingUpdate, ESettingKey } from 'src/app/entities/settings/settings-interface';
 import { DividerModule } from 'primeng/divider';
 import { AccordionModule } from 'primeng/accordion';
+import { MessageModule } from 'primeng/message';
 import { ToastService } from 'src/app/core/services/toast.service';
 
 @Component({
   selector: 'app-settings-page',
-  imports: [NewPasswordForm, TranslatePipe, SettingsPageForm, DividerModule, AccordionModule],
+  imports: [NewPasswordForm, TranslatePipe, SettingsPageForm, DividerModule, AccordionModule, MessageModule],
   templateUrl: './settings-page.html',
   styleUrl: './settings-page.scss',
   changeDetection: ChangeDetectionStrategy.OnPush,
@@ -34,6 +35,10 @@ export class SettingsPage {
     ESettingKey.OIDC_SCOPES
   ];
 
+  public get currentUrl(): string {
+    return window.location.origin;
+  }
+
   public onSubmitNewPassword(body: ISetPasswordBody): void {
     this.isLoading.set(true);
     this.authApiService

From b6ac2098d5144adbb6c94b44dd041ddf631f89f8 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 12:54:56 +0000
Subject: [PATCH 23/40] Update the CSS

Fix the CSS
---
 .../features/settings-page/settings-page.scss | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/frontend/src/app/features/settings-page/settings-page.scss b/frontend/src/app/features/settings-page/settings-page.scss
index eca908b..2ca0206 100644
--- a/frontend/src/app/features/settings-page/settings-page.scss
+++ b/frontend/src/app/features/settings-page/settings-page.scss
@@ -5,6 +5,30 @@
   overflow-y: auto;
 }
 
+.oidc-redirect-info {
+  margin-bottom: 1.5rem;
+  
+  .redirect-url-info {
+    p {
+      margin: 0.5rem 0;
+      line-height: 1.5;
+    }
+    
+    .redirect-example {
+      display: block;
+      margin-top: 0.75rem;
+      padding: 0.5rem;
+      background-color: var(--p-surface-100);
+      border: 1px solid var(--p-surface-300);
+      border-radius: var(--p-border-radius-sm);
+      font-family: 'Courier New', monospace;
+      color: var(--p-primary-color);
+      word-break: break-all;
+      font-size: 0.9rem;
+    }
+  }
+}
+
 .oidc-user-info {
   margin-top: 1rem;
   padding: 1rem;

From 9071cae2b66c5d8e53f278b4e4151913adca3331 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 12:58:26 +0000
Subject: [PATCH 24/40] Better  instructions in settings page

Clarifies the OIDC provider setup instructions
---
 frontend/public/i18n/en.json                               | 5 +++--
 frontend/src/app/features/settings-page/settings-page.html | 2 +-
 frontend/src/app/features/settings-page/settings-page.ts   | 4 ----
 3 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/frontend/public/i18n/en.json b/frontend/public/i18n/en.json
index d7ca32a..c966f67 100644
--- a/frontend/public/i18n/en.json
+++ b/frontend/public/i18n/en.json
@@ -194,8 +194,9 @@
       "EMAIL": "Email",
       "NAME": "Name",
       "USERNAME": "Username",
-      "REDIRECT_SETUP_TITLE": "Important: OIDC Provider Setup",
-      "REDIRECT_SETUP_MESSAGE": "In your OIDC provider, you must register this exact redirect URI as an allowed callback URL:"
+      "REDIRECT_SETUP_TITLE": "Important: OIDC Provider Setup", 
+      "REDIRECT_SETUP_MESSAGE": "In your OIDC provider, you must register your Tugtainer URL followed by '/api/auth/oidc/callback' as an allowed callback URL.",
+      "REDIRECT_SETUP_EXAMPLE": "Example: https://your-tugtainer-domain.com/api/auth/oidc/callback"
     }
   }
 }
diff --git a/frontend/src/app/features/settings-page/settings-page.html b/frontend/src/app/features/settings-page/settings-page.html
index d693caa..fe2108c 100644
--- a/frontend/src/app/features/settings-page/settings-page.html
+++ b/frontend/src/app/features/settings-page/settings-page.html
@@ -38,7 +38,7 @@
           <div class="redirect-url-info">
             <strong>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_TITLE' | translate }}</strong>
             <p>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_MESSAGE' | translate }}</p>
-            <code class="redirect-example">{{ currentUrl }}/api/auth/oidc/callback</code>
+            <code class="redirect-example">{{ 'SETTINGS.OIDC.REDIRECT_SETUP_EXAMPLE' | translate }}</code>
           </div>
         </ng-template>
       </p-message>
diff --git a/frontend/src/app/features/settings-page/settings-page.ts b/frontend/src/app/features/settings-page/settings-page.ts
index 0f82a3a..6829b1a 100644
--- a/frontend/src/app/features/settings-page/settings-page.ts
+++ b/frontend/src/app/features/settings-page/settings-page.ts
@@ -35,10 +35,6 @@ export class SettingsPage {
     ESettingKey.OIDC_SCOPES
   ];
 
-  public get currentUrl(): string {
-    return window.location.origin;
-  }
-
   public onSubmitNewPassword(body: ISetPasswordBody): void {
     this.isLoading.set(true);
     this.authApiService

From 821c7e738788c3c54fdda629d0afa0c2878ee022 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 13:03:13 +0000
Subject: [PATCH 25/40] Make CSS look better

Fix css as it didn't appear very well.
---
 .../features/settings-page/settings-page.html | 19 +++++++------------
 .../features/settings-page/settings-page.scss | 13 +++++++++++++
 .../features/settings-page/settings-page.ts   |  3 +--
 3 files changed, 21 insertions(+), 14 deletions(-)

diff --git a/frontend/src/app/features/settings-page/settings-page.html b/frontend/src/app/features/settings-page/settings-page.html
index fe2108c..8f8dabb 100644
--- a/frontend/src/app/features/settings-page/settings-page.html
+++ b/frontend/src/app/features/settings-page/settings-page.html
@@ -30,18 +30,13 @@
     </p-accordion-header>
     <p-accordion-content>
       <!-- OIDC Setup Info -->
-      <p-message 
-        severity="info" 
-        [closable]="false"
-        class="oidc-redirect-info">
-        <ng-template pTemplate="content">
-          <div class="redirect-url-info">
-            <strong>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_TITLE' | translate }}</strong>
-            <p>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_MESSAGE' | translate }}</p>
-            <code class="redirect-example">{{ 'SETTINGS.OIDC.REDIRECT_SETUP_EXAMPLE' | translate }}</code>
-          </div>
-        </ng-template>
-      </p-message>
+      <div class="oidc-redirect-info">
+        <div class="redirect-url-info">
+          <strong>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_TITLE' | translate }}</strong>
+          <p>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_MESSAGE' | translate }}</p>
+          <code class="redirect-example">{{ 'SETTINGS.OIDC.REDIRECT_SETUP_EXAMPLE' | translate }}</code>
+        </div>
+      </div>
 
       <app-settings-page-form 
         [includeKeys]="oidcSettingKeys" 
diff --git a/frontend/src/app/features/settings-page/settings-page.scss b/frontend/src/app/features/settings-page/settings-page.scss
index 2ca0206..14cb5dc 100644
--- a/frontend/src/app/features/settings-page/settings-page.scss
+++ b/frontend/src/app/features/settings-page/settings-page.scss
@@ -7,11 +7,24 @@
 
 .oidc-redirect-info {
   margin-bottom: 1.5rem;
+  padding: 1rem;
+  background-color: var(--p-blue-50);
+  border: 1px solid var(--p-blue-200);
+  border-left: 4px solid var(--p-blue-500);
+  border-radius: var(--p-border-radius-md);
   
   .redirect-url-info {
+    strong {
+      color: var(--p-blue-700);
+      font-size: 1rem;
+      display: block;
+      margin-bottom: 0.5rem;
+    }
+    
     p {
       margin: 0.5rem 0;
       line-height: 1.5;
+      color: var(--p-text-color);
     }
     
     .redirect-example {
diff --git a/frontend/src/app/features/settings-page/settings-page.ts b/frontend/src/app/features/settings-page/settings-page.ts
index 6829b1a..fe39a33 100644
--- a/frontend/src/app/features/settings-page/settings-page.ts
+++ b/frontend/src/app/features/settings-page/settings-page.ts
@@ -9,12 +9,11 @@ import { finalize } from 'rxjs';
 import { ISettingUpdate, ESettingKey } from 'src/app/entities/settings/settings-interface';
 import { DividerModule } from 'primeng/divider';
 import { AccordionModule } from 'primeng/accordion';
-import { MessageModule } from 'primeng/message';
 import { ToastService } from 'src/app/core/services/toast.service';
 
 @Component({
   selector: 'app-settings-page',
-  imports: [NewPasswordForm, TranslatePipe, SettingsPageForm, DividerModule, AccordionModule, MessageModule],
+  imports: [NewPasswordForm, TranslatePipe, SettingsPageForm, DividerModule, AccordionModule],
   templateUrl: './settings-page.html',
   styleUrl: './settings-page.scss',
   changeDetection: ChangeDetectionStrategy.OnPush,

From b1154142003cb51ffc6d174033607d5db4291587 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 13:06:50 +0000
Subject: [PATCH 26/40] Fix CSS colours

---
 .../app/features/settings-page/settings-page.scss  | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/frontend/src/app/features/settings-page/settings-page.scss b/frontend/src/app/features/settings-page/settings-page.scss
index 14cb5dc..b40872d 100644
--- a/frontend/src/app/features/settings-page/settings-page.scss
+++ b/frontend/src/app/features/settings-page/settings-page.scss
@@ -8,14 +8,14 @@
 .oidc-redirect-info {
   margin-bottom: 1.5rem;
   padding: 1rem;
-  background-color: var(--p-blue-50);
-  border: 1px solid var(--p-blue-200);
-  border-left: 4px solid var(--p-blue-500);
+  background-color: var(--p-surface-ground);
+  border: 1px solid var(--p-surface-border);
+  border-left: 4px solid var(--p-primary-color);
   border-radius: var(--p-border-radius-md);
   
   .redirect-url-info {
     strong {
-      color: var(--p-blue-700);
+      color: var(--p-primary-color);
       font-size: 1rem;
       display: block;
       margin-bottom: 0.5rem;
@@ -31,11 +31,11 @@
       display: block;
       margin-top: 0.75rem;
       padding: 0.5rem;
-      background-color: var(--p-surface-100);
-      border: 1px solid var(--p-surface-300);
+      background-color: var(--p-surface-200);
+      border: 1px solid var(--p-surface-border);
       border-radius: var(--p-border-radius-sm);
       font-family: 'Courier New', monospace;
-      color: var(--p-primary-color);
+      color: var(--p-text-color);
       word-break: break-all;
       font-size: 0.9rem;
     }

From 51fb47067d0a0e3c4187098a289c50f412b7cac3 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 13:24:27 +0000
Subject: [PATCH 27/40] Update settings-page.scss

---
 frontend/src/app/features/settings-page/settings-page.scss | 2 --
 1 file changed, 2 deletions(-)

diff --git a/frontend/src/app/features/settings-page/settings-page.scss b/frontend/src/app/features/settings-page/settings-page.scss
index b40872d..438cebc 100644
--- a/frontend/src/app/features/settings-page/settings-page.scss
+++ b/frontend/src/app/features/settings-page/settings-page.scss
@@ -31,8 +31,6 @@
       display: block;
       margin-top: 0.75rem;
       padding: 0.5rem;
-      background-color: var(--p-surface-200);
-      border: 1px solid var(--p-surface-border);
       border-radius: var(--p-border-radius-sm);
       font-family: 'Courier New', monospace;
       color: var(--p-text-color);

From 5660bf91e9a8fde581c6de7a5b22b4bfc4a0bd46 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Tue, 28 Oct 2025 14:06:45 +0000
Subject: [PATCH 28/40] Update authlub py package to latest

---
 backend/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/requirements.txt b/backend/requirements.txt
index 7a01be3..0dd0402 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -49,7 +49,7 @@ python-dateutil==2.9.0.post0
 python-dotenv==1.1.1
 python-jose==3.5.0
 python-multipart==0.0.20
-authlib==1.3.2
+authlib==1.6.5
 python-on-whales==0.78.0
 PyYAML==6.0.2
 requests==2.32.5

From 4f3e5306ff3bf510641a430eed828b0165b5233f Mon Sep 17 00:00:00 2001
From: Bramble <github@camc.xyz>
Date: Sat, 1 Nov 2025 08:16:59 +0000
Subject: [PATCH 29/40] Create merge_heads_agent_oidc.py

---
 .../versions/merge_heads_agent_oidc.py        | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 backend/alembic/versions/merge_heads_agent_oidc.py

diff --git a/backend/alembic/versions/merge_heads_agent_oidc.py b/backend/alembic/versions/merge_heads_agent_oidc.py
new file mode 100644
index 0000000..a0438c8
--- /dev/null
+++ b/backend/alembic/versions/merge_heads_agent_oidc.py
@@ -0,0 +1,25 @@
+"""Merge agent and OIDC migrations
+
+Revision ID: d2e3f4a5b6c7
+Revises: 74c15c1c767e, c1d4e5f6a7b8
+Create Date: 2025-11-01 08:00:00.000000
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision = 'd2e3f4a5b6c7'
+down_revision = ('74c15c1c767e', 'c1d4e5f6a7b8')
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    """Merge migration - no changes needed as both previous migrations are independent."""
+    pass
+
+
+def downgrade() -> None:
+    """Merge migration - no changes needed as both previous migrations are independent."""
+    pass

From 2535709109632d6e23a3c4944cdc54a95de7b04f Mon Sep 17 00:00:00 2001
From: Bramble <github@camc.xyz>
Date: Sat, 1 Nov 2025 08:20:07 +0000
Subject: [PATCH 30/40] Uniform structure of backend

---
 backend/api/auth_api.py            | 10 +++++-----
 backend/api/settings_api.py        | 14 +++++++-------
 backend/core/auth_core.py          |  8 ++++----
 backend/schemas/settings_schema.py |  2 +-
 4 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/backend/api/auth_api.py b/backend/api/auth_api.py
index 5822f09..5b16eac 100644
--- a/backend/api/auth_api.py
+++ b/backend/api/auth_api.py
@@ -11,10 +11,10 @@
     status,
 )
 from fastapi.responses import PlainTextResponse, RedirectResponse
-from app.helpers.delay_to_minimum import delay_to_minimum
-from app.config import Config
-from app.helpers.now import now
-from app.core.auth_core import (
+from backend.helpers.delay_to_minimum import delay_to_minimum
+from backend.config import Config
+from backend.helpers.now import now
+from backend.core.auth_core import (
     get_password_hash,
     verify_token,
     verify_password,
@@ -29,7 +29,7 @@
     exchange_oidc_code,
     create_oidc_user_session,
 )
-from app.schemas.auth_schema import PasswordSetRequestBody
+from backend.schemas.auth_schema import PasswordSetRequestBody
 
 
 router: APIRouter = APIRouter(prefix="/auth", tags=["auth"])
diff --git a/backend/api/settings_api.py b/backend/api/settings_api.py
index fe255bd..5de676f 100644
--- a/backend/api/settings_api.py
+++ b/backend/api/settings_api.py
@@ -13,13 +13,13 @@
     SettingsPatchRequestItem,
     TestNotificationRequestBody,
 )
-from app.core.auth_core import fetch_oidc_discovery
-from app.core.notifications_core import send_notification
-from app.core.cron_manager import CronManager
-from app.enums.settings_enum import ESettingKey
-from app.enums.cron_jobs_enum import ECronJob
-from app.core.containers_core import check_all
-from app.exception import TugException
+from backend.core.auth_core import fetch_oidc_discovery
+from backend.core.notifications_core import send_notification
+from backend.core.cron_manager import CronManager
+from backend.enums.settings_enum import ESettingKey
+from backend.enums.cron_jobs_enum import ECronJob
+from backend.core.containers_core import check_all
+from backend.exception import TugException
 
 VALID_TIMEZONES = available_timezones()
 
diff --git a/backend/core/auth_core.py b/backend/core/auth_core.py
index 90211e0..0ce019b 100644
--- a/backend/core/auth_core.py
+++ b/backend/core/auth_core.py
@@ -7,10 +7,10 @@
 import asyncio
 import aiohttp
 from urllib.parse import urlencode
-from app.config import Config
-from app.helpers.now import now
-from app.helpers.settings_storage import SettingsStorage
-from app.enums.settings_enum import ESettingKey
+from backend.config import Config
+from backend.helpers.now import now
+from backend.helpers.settings_storage import SettingsStorage
+from backend.enums.settings_enum import ESettingKey
 
 
 def verify_password(plain: str, hashed: str) -> bool:
diff --git a/backend/schemas/settings_schema.py b/backend/schemas/settings_schema.py
index 95aec22..0381f80 100644
--- a/backend/schemas/settings_schema.py
+++ b/backend/schemas/settings_schema.py
@@ -1,7 +1,7 @@
 from pydantic import BaseModel, RootModel, model_validator
 from typing import Union, cast
 from datetime import datetime
-from app.enums.settings_enum import ESettingKey
+from backend.enums.settings_enum import ESettingKey
 from .validators import (
     validate_cron_expr, 
     validate_timezone,

From 292747d0a531f80d7fcbee5acf5c5a331672d49c Mon Sep 17 00:00:00 2001
From: Bramble <github@camc.xyz>
Date: Sat, 1 Nov 2025 08:39:57 +0000
Subject: [PATCH 31/40] Delete merge_heads_agent_oidc.py

---
 .../versions/merge_heads_agent_oidc.py        | 25 -------------------
 1 file changed, 25 deletions(-)
 delete mode 100644 backend/alembic/versions/merge_heads_agent_oidc.py

diff --git a/backend/alembic/versions/merge_heads_agent_oidc.py b/backend/alembic/versions/merge_heads_agent_oidc.py
deleted file mode 100644
index a0438c8..0000000
--- a/backend/alembic/versions/merge_heads_agent_oidc.py
+++ /dev/null
@@ -1,25 +0,0 @@
-"""Merge agent and OIDC migrations
-
-Revision ID: d2e3f4a5b6c7
-Revises: 74c15c1c767e, c1d4e5f6a7b8
-Create Date: 2025-11-01 08:00:00.000000
-
-"""
-from alembic import op
-import sqlalchemy as sa
-
-# revision identifiers, used by Alembic.
-revision = 'd2e3f4a5b6c7'
-down_revision = ('74c15c1c767e', 'c1d4e5f6a7b8')
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    """Merge migration - no changes needed as both previous migrations are independent."""
-    pass
-
-
-def downgrade() -> None:
-    """Merge migration - no changes needed as both previous migrations are independent."""
-    pass

From 4589413c0af0bdbca63ea4b1fce365732aeaf6bf Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Mon, 3 Nov 2025 13:26:10 +0000
Subject: [PATCH 32/40] Move OIDC config to env vars and remove UI settings

---
 .env.example                                  | 19 +++++-
 .../d2e3f4g5h6i7_remove_oidc_settings.py      | 35 ++++++++++
 backend/app/api/auth_api.py                   | 24 +++----
 backend/app/api/settings_api.py               | 41 +-----------
 backend/app/config.py                         | 16 +++++
 backend/app/core/auth_core.py                 | 17 ++---
 backend/app/enums/settings_enum.py            |  8 ---
 backend/app/schemas/settings_schema.py        | 14 +---
 backend/app/schemas/validators.py             | 52 ---------------
 docker-compose.dev.yml                        |  8 +++
 docker-compose.yml                            |  8 +++
 frontend/public/i18n/en.json                  | 37 +----------
 .../entities/settings/settings-api.service.ts |  4 --
 .../entities/settings/settings-interface.ts   |  8 ---
 .../src/app/features/auth-page/auth-page.html | 22 +++----
 .../src/app/features/auth-page/auth-page.scss | 31 +++++++++
 .../settings-page-form.html                   | 11 ----
 .../settings-page-form/settings-page-form.ts  | 57 -----------------
 .../features/settings-page/settings-page.html | 46 -------------
 .../features/settings-page/settings-page.scss | 64 -------------------
 .../features/settings-page/settings-page.ts   |  9 +--
 21 files changed, 149 insertions(+), 382 deletions(-)
 create mode 100644 backend/alembic/versions/d2e3f4g5h6i7_remove_oidc_settings.py

diff --git a/.env.example b/.env.example
index 7937d83..ab06a47 100644
--- a/.env.example
+++ b/.env.example
@@ -26,4 +26,21 @@ DB_URL="sqlite+aiosqlite:////tugtainer/tugtainer.db"
 HTTPS=FALSE
 # Authentication will only be possible on this domain.
 # Default is empty.
-DOMAIN=mydomain.org
\ No newline at end of file
+DOMAIN=mydomain.org
+
+#region OIDC Authentication
+# Enable OIDC authentication alongside password auth
+OIDC_ENABLED=false
+
+# OIDC provider's well-known configuration endpoint
+OIDC_WELL_KNOWN_URL=https://auth.example.com/.well-known/openid-configuration
+
+# OIDC client credentials
+OIDC_CLIENT_ID=your-client-id
+OIDC_CLIENT_SECRET=your-client-secret
+
+# Must match what's registered in your OIDC provider
+OIDC_REDIRECT_URI=https://your-tugtainer-domain.com/api/auth/oidc/callback
+
+# Space-separated scopes (openid is always included)
+OIDC_SCOPES=openid profile email
\ No newline at end of file
diff --git a/backend/alembic/versions/d2e3f4g5h6i7_remove_oidc_settings.py b/backend/alembic/versions/d2e3f4g5h6i7_remove_oidc_settings.py
new file mode 100644
index 0000000..9c82431
--- /dev/null
+++ b/backend/alembic/versions/d2e3f4g5h6i7_remove_oidc_settings.py
@@ -0,0 +1,35 @@
+"""remove_oidc_settings
+
+Revision ID: d2e3f4g5h6i7
+Revises: c1d4e5f6a7b8
+Create Date: 2025-11-03 13:00:00.000000
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision = 'd2e3f4g5h6i7'
+down_revision = 'c1d4e5f6a7b8'
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    """Remove OIDC settings as they are now configured via environment variables."""
+    # Remove OIDC settings from the database
+    op.execute("DELETE FROM settings WHERE key IN ('OIDC_ENABLED', 'OIDC_WELL_KNOWN_URL', 'OIDC_CLIENT_ID', 'OIDC_CLIENT_SECRET', 'OIDC_REDIRECT_URI', 'OIDC_SCOPES')")
+
+
+def downgrade() -> None:
+    """Re-add OIDC settings to database (not recommended as they should use env vars)."""
+    # Insert OIDC settings with default values
+    op.execute("""
+        INSERT OR IGNORE INTO settings (key, value, value_type, modified_at) VALUES
+        ('OIDC_ENABLED', 'FALSE', 'bool', datetime('now')),
+        ('OIDC_WELL_KNOWN_URL', '', 'str', datetime('now')),
+        ('OIDC_CLIENT_ID', '', 'str', datetime('now')),
+        ('OIDC_CLIENT_SECRET', '', 'str', datetime('now')),
+        ('OIDC_REDIRECT_URI', '', 'str', datetime('now')),
+        ('OIDC_SCOPES', 'openid profile email', 'str', datetime('now'))
+    """)
\ No newline at end of file
diff --git a/backend/app/api/auth_api.py b/backend/app/api/auth_api.py
index 5822f09..02c4677 100644
--- a/backend/app/api/auth_api.py
+++ b/backend/app/api/auth_api.py
@@ -66,18 +66,18 @@ async def login(response: Response, password: str):
         key="access_token",
         value=access_token,
         httponly=True,
-        samesite="strict",
-        secure=Config.HTTPS,
-        domain=Config.DOMAIN,
+        samesite="lax",  # Changed from "strict" to "lax" for better localhost compatibility
+        secure=False,    # Always False for localhost development
+        domain=None,     # No domain restriction for localhost
         max_age=Config.ACCESS_TOKEN_LIFETIME_MIN * 60,
     )
     response.set_cookie(
         key="refresh_token",
         value=refresh_token,
         httponly=True,
-        samesite="strict",
-        secure=Config.HTTPS,
-        domain=Config.DOMAIN,
+        samesite="lax",  # Changed from "strict" to "lax" for better localhost compatibility
+        secure=False,    # Always False for localhost development
+        domain=None,     # No domain restriction for localhost
         max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
     )
     response.status_code = status.HTTP_200_OK
@@ -321,18 +321,18 @@ async def oidc_callback(
             key="access_token",
             value=tokens["access_token"],
             httponly=True,
-            samesite="strict",
-            secure=Config.HTTPS,
-            domain=Config.DOMAIN if Config.DOMAIN else None,
+            samesite="lax",  # Changed from "strict" to "lax" for better localhost compatibility
+            secure=False,    # Always False for localhost development
+            domain=None,     # No domain restriction for localhost
             max_age=Config.ACCESS_TOKEN_LIFETIME_MIN * 60,
         )
         response.set_cookie(
             key="refresh_token",
             value=tokens["refresh_token"],
             httponly=True,
-            samesite="strict",
-            secure=Config.HTTPS,
-            domain=Config.DOMAIN if Config.DOMAIN else None,
+            samesite="lax",  # Changed from "strict" to "lax" for better localhost compatibility
+            secure=False,    # Always False for localhost development
+            domain=None,     # No domain restriction for localhost
             max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
         )
         
diff --git a/backend/app/api/settings_api.py b/backend/app/api/settings_api.py
index 76af8b9..ffba675 100644
--- a/backend/app/api/settings_api.py
+++ b/backend/app/api/settings_api.py
@@ -12,7 +12,6 @@
     SettingsPatchRequestItem,
     TestNotificationRequestBody,
 )
-from app.core.auth_core import fetch_oidc_discovery
 from app.core.notifications_core import send_notification
 from app.core.cron_manager import CronManager
 from app.enums.settings_enum import ESettingKey
@@ -140,42 +139,4 @@ def get_available_timezones() -> set[str]:
     return VALID_TIMEZONES
 
 
-@router.post(
-    "/test_oidc",
-    status_code=200,
-    description="Test OIDC well-known URL connectivity",
-)
-async def test_oidc_connection(data: dict):
-    """Test if the OIDC well-known URL is accessible and returns valid configuration"""
-    well_known_url = data.get("well_known_url")
-    if not well_known_url:
-        raise HTTPException(400, "well_known_url is required")
-    
-    try:
-        discovery_doc = await fetch_oidc_discovery(well_known_url)
-        
-        # Check if required endpoints exist
-        required_endpoints = ["authorization_endpoint", "token_endpoint"]
-        missing_endpoints = [ep for ep in required_endpoints if ep not in discovery_doc]
-        
-        if missing_endpoints:
-            raise HTTPException(
-                400, 
-                f"OIDC discovery document is missing required endpoints: {missing_endpoints}"
-            )
-        
-        return {
-            "status": "success",
-            "message": "OIDC configuration is valid",
-            "endpoints": {
-                "authorization_endpoint": discovery_doc.get("authorization_endpoint"),
-                "token_endpoint": discovery_doc.get("token_endpoint"),
-                "userinfo_endpoint": discovery_doc.get("userinfo_endpoint"),
-                "issuer": discovery_doc.get("issuer")
-            }
-        }
-        
-    except HTTPException:
-        raise
-    except Exception as e:
-        raise HTTPException(500, f"Error testing OIDC connection: {str(e)}")
+
diff --git a/backend/app/config.py b/backend/app/config.py
index 5f0e3b8..fdaff73 100644
--- a/backend/app/config.py
+++ b/backend/app/config.py
@@ -17,6 +17,14 @@ class Config:
     PASSWORD_FILE: ClassVar[str]
     HTTPS: ClassVar[bool]
     DOMAIN: ClassVar[str | None]
+    
+    # OIDC Configuration
+    OIDC_ENABLED: ClassVar[bool]
+    OIDC_WELL_KNOWN_URL: ClassVar[str]
+    OIDC_CLIENT_ID: ClassVar[str]
+    OIDC_CLIENT_SECRET: ClassVar[str]
+    OIDC_REDIRECT_URI: ClassVar[str]
+    OIDC_SCOPES: ClassVar[str]
 
     @classmethod
     def load(cls):
@@ -47,6 +55,14 @@ def load(cls):
             )
             cls.HTTPS = os.getenv("HTTPS", "false").lower() == "true"
             cls.DOMAIN = os.getenv("DOMAIN")
+            
+            # OIDC Configuration
+            cls.OIDC_ENABLED = os.getenv("OIDC_ENABLED", "false").lower() == "true"
+            cls.OIDC_WELL_KNOWN_URL = os.getenv("OIDC_WELL_KNOWN_URL", "")
+            cls.OIDC_CLIENT_ID = os.getenv("OIDC_CLIENT_ID", "")
+            cls.OIDC_CLIENT_SECRET = os.getenv("OIDC_CLIENT_SECRET", "")
+            cls.OIDC_REDIRECT_URI = os.getenv("OIDC_REDIRECT_URI", "")
+            cls.OIDC_SCOPES = os.getenv("OIDC_SCOPES", "openid profile email")
 
 
 Config.load()
diff --git a/backend/app/core/auth_core.py b/backend/app/core/auth_core.py
index 90211e0..f3b7c69 100644
--- a/backend/app/core/auth_core.py
+++ b/backend/app/core/auth_core.py
@@ -89,20 +89,17 @@ def write_password_hash(password_hash: str) -> None:
 
 def is_oidc_enabled() -> bool:
     """Check if OIDC authentication is enabled"""
-    try:
-        return SettingsStorage.get(ESettingKey.OIDC_ENABLED) is True
-    except:
-        return False
+    return Config.OIDC_ENABLED
 
 
 def get_oidc_config() -> Dict[str, str]:
-    """Get OIDC configuration from settings"""
+    """Get OIDC configuration from environment variables"""
     return {
-        'well_known_url': SettingsStorage.get(ESettingKey.OIDC_WELL_KNOWN_URL),
-        'client_id': SettingsStorage.get(ESettingKey.OIDC_CLIENT_ID),
-        'client_secret': SettingsStorage.get(ESettingKey.OIDC_CLIENT_SECRET),
-        'redirect_uri': SettingsStorage.get(ESettingKey.OIDC_REDIRECT_URI),
-        'scopes': SettingsStorage.get(ESettingKey.OIDC_SCOPES).split()
+        'well_known_url': Config.OIDC_WELL_KNOWN_URL,
+        'client_id': Config.OIDC_CLIENT_ID,
+        'client_secret': Config.OIDC_CLIENT_SECRET,
+        'redirect_uri': Config.OIDC_REDIRECT_URI,
+        'scopes': Config.OIDC_SCOPES.split() if Config.OIDC_SCOPES else []
     }
 
 
diff --git a/backend/app/enums/settings_enum.py b/backend/app/enums/settings_enum.py
index 183ac35..5b8682c 100644
--- a/backend/app/enums/settings_enum.py
+++ b/backend/app/enums/settings_enum.py
@@ -11,14 +11,6 @@ class ESettingKey(str, Enum):
     NOTIFICATION_URL = "NOTIFICATION_URL"
     TIMEZONE = "TIMEZONE"
     DOCKER_TIMEOUT = "DOCKER_TIMEOUT"
-    
-    # OIDC Settings
-    OIDC_ENABLED = "OIDC_ENABLED"
-    OIDC_WELL_KNOWN_URL = "OIDC_WELL_KNOWN_URL"
-    OIDC_CLIENT_ID = "OIDC_CLIENT_ID"
-    OIDC_CLIENT_SECRET = "OIDC_CLIENT_SECRET"
-    OIDC_REDIRECT_URI = "OIDC_REDIRECT_URI"
-    OIDC_SCOPES = "OIDC_SCOPES"
 
 
 class ESettingType(str, Enum):
diff --git a/backend/app/schemas/settings_schema.py b/backend/app/schemas/settings_schema.py
index 418f43c..28fde1b 100644
--- a/backend/app/schemas/settings_schema.py
+++ b/backend/app/schemas/settings_schema.py
@@ -4,10 +4,7 @@
 from app.enums.settings_enum import ESettingKey
 from .validators import (
     validate_cron_expr, 
-    validate_timezone,
-    validate_oidc_well_known_url,
-    validate_oidc_client_id,
-    validate_oidc_scopes
+    validate_timezone
 )
 
 
@@ -23,15 +20,6 @@ def validate_setting(self):
         elif self.key == ESettingKey.TIMEZONE:
             _ = validate_timezone(cast(str, self.value))
             return self
-        elif self.key == ESettingKey.OIDC_WELL_KNOWN_URL:
-            self.value = validate_oidc_well_known_url(cast(str, self.value))
-            return self
-        elif self.key == ESettingKey.OIDC_CLIENT_ID:
-            self.value = validate_oidc_client_id(cast(str, self.value))
-            return self
-        elif self.key == ESettingKey.OIDC_SCOPES:
-            self.value = validate_oidc_scopes(cast(str, self.value))
-            return self
         else:
             return self
 
diff --git a/backend/app/schemas/validators.py b/backend/app/schemas/validators.py
index 220adf9..825b187 100644
--- a/backend/app/schemas/validators.py
+++ b/backend/app/schemas/validators.py
@@ -43,55 +43,3 @@ def validate_timezone(tz: str) -> str:
     if tz in VALID_TIMEZONES:
         return tz
     raise ValueError(f"Invalid timezone: {tz}")
-
-
-def validate_oidc_well_known_url(url: str) -> str:
-    """Validate OIDC well-known URL format"""
-    if not url:
-        return url  # Allow empty for disabled OIDC
-    
-    parsed = urlparse(url)
-    if not parsed.scheme or parsed.scheme not in ['http', 'https']:
-        raise ValueError("OIDC well-known URL must start with http:// or https://")
-    
-    if not parsed.netloc:
-        raise ValueError("Invalid OIDC well-known URL format")
-    
-    # Ensure it ends with the well-known path or allow custom paths
-    if not url.endswith('/.well-known/openid_configuration') and '/.well-known/' not in url:
-        raise ValueError("OIDC URL should point to a well-known configuration endpoint")
-    
-    return url
-
-
-def validate_oidc_client_id(client_id: str) -> str:
-    """Validate OIDC Client ID"""
-    if not client_id:
-        return client_id  # Allow empty for disabled OIDC
-    
-    # Basic validation - client IDs are typically alphanumeric with some special chars
-    if not re.match(r'^[a-zA-Z0-9._-]+$', client_id):
-        raise ValueError("OIDC Client ID contains invalid characters")
-    
-    return client_id
-
-
-def validate_oidc_scopes(scopes: str) -> str:
-    """Validate OIDC scopes"""
-    if not scopes:
-        return "openid"  # Default to openid scope
-    
-    # Split scopes and validate each one
-    scope_list = scopes.split()
-    valid_scope_pattern = r'^[a-zA-Z0-9._:-]+$'
-    
-    for scope in scope_list:
-        if not re.match(valid_scope_pattern, scope):
-            raise ValueError(f"Invalid OIDC scope: {scope}")
-    
-    # Ensure 'openid' is always included
-    if 'openid' not in scope_list:
-        scope_list.insert(0, 'openid')
-        scopes = ' '.join(scope_list)
-    
-    return scopes
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index 6e66054..f3c12e0 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -16,5 +16,13 @@ services:
       - tugtainer
     ports:
       - '9412:80'
+    environment:
+      # OIDC Configuration
+      OIDC_ENABLED: "false"
+      OIDC_WELL_KNOWN_URL: ""
+      OIDC_CLIENT_ID: ""
+      OIDC_CLIENT_SECRET: ""
+      OIDC_REDIRECT_URI: ""
+      OIDC_SCOPES: "openid profile email"
 volumes:
   tugtainer_data:
diff --git a/docker-compose.yml b/docker-compose.yml
index 685912a..3fd7540 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -13,5 +13,13 @@ services:
       - tugtainer
     ports:
       - '9412:80'
+    environment:
+      # OIDC Configuration
+      OIDC_ENABLED: "false"
+      OIDC_WELL_KNOWN_URL: ""
+      OIDC_CLIENT_ID: ""
+      OIDC_CLIENT_SECRET: ""
+      OIDC_REDIRECT_URI: ""
+      OIDC_SCOPES: "openid profile email"
 volumes:
   tugtainer_data:
diff --git a/frontend/public/i18n/en.json b/frontend/public/i18n/en.json
index 76860ba..b9164da 100644
--- a/frontend/public/i18n/en.json
+++ b/frontend/public/i18n/en.json
@@ -158,8 +158,7 @@
     "VALUE": "Value",
     "SECTIONS": {
       "CHANGE_PASSWORD": "Change password",
-      "APP_SETTINGS": "App settings",
-      "OIDC_SETTINGS": "OIDC Authentication Settings"
+      "APP_SETTINGS": "App settings"
     },
     "BY_KEY": {
       "CRONTAB_EXPR": {
@@ -180,41 +179,7 @@
       "DOCKER_TIMEOUT": {
         "LABEL": "Docker timeout",
         "HINT": "Docker CLI call timeout. This applies primarily to API methods and does not apply to, for example, container re-creation or image pulling."
-      },
-      "OIDC_ENABLED": {
-        "LABEL": "Enable OIDC Authentication",
-        "HINT": "Enable OpenID Connect authentication alongside password authentication"
-      },
-      "OIDC_WELL_KNOWN_URL": {
-        "LABEL": "OIDC Well-Known URL",
-        "HINT": "The well-known configuration URL of your OIDC provider (e.g., https://auth.example.com/.well-known/openid_configuration)",
-        "TEST": "Test OIDC connection"
-      },
-      "OIDC_CLIENT_ID": {
-        "LABEL": "OIDC Client ID",
-        "HINT": "The client identifier registered with your OIDC provider"
-      },
-      "OIDC_CLIENT_SECRET": {
-        "LABEL": "OIDC Client Secret",
-        "HINT": "The client secret for your OIDC application (keep this secure)"
-      },
-      "OIDC_REDIRECT_URI": {
-        "LABEL": "OIDC Redirect URI",
-        "HINT": "The redirect URI configured in your OIDC provider (e.g., https://tugtainer.example.com/auth/oidc/callback)"
-      },
-      "OIDC_SCOPES": {
-        "LABEL": "OIDC Scopes",
-        "HINT": "Space-separated list of OAuth2 scopes to request (openid is always included)"
       }
-    },
-    "OIDC": {
-      "CURRENT_USER": "Currently Authenticated User",
-      "EMAIL": "Email",
-      "NAME": "Name",
-      "USERNAME": "Username",
-      "REDIRECT_SETUP_TITLE": "Important: OIDC Provider Setup", 
-      "REDIRECT_SETUP_MESSAGE": "In your OIDC provider, you must register your Tugtainer URL followed by '/api/auth/oidc/callback' as an allowed callback URL.",
-      "REDIRECT_SETUP_EXAMPLE": "Example: https://your-tugtainer-domain.com/api/auth/oidc/callback"
     }
   }
 }
diff --git a/frontend/src/app/entities/settings/settings-api.service.ts b/frontend/src/app/entities/settings/settings-api.service.ts
index ed084c1..cf3b253 100644
--- a/frontend/src/app/entities/settings/settings-api.service.ts
+++ b/frontend/src/app/entities/settings/settings-api.service.ts
@@ -24,8 +24,4 @@ export class SettingsApiService extends BaseApiService<'/settings'> {
   getAvailableTimezones(): Observable<string[]> {
     return this.httpClient.get<string[]>(`${this.basePath}/available_timezones`);
   }
-
-  testOidcConnection(well_known_url: string): Observable<any> {
-    return this.httpClient.post(`${this.basePath}/test_oidc`, { well_known_url });
-  }
 }
diff --git a/frontend/src/app/entities/settings/settings-interface.ts b/frontend/src/app/entities/settings/settings-interface.ts
index 12a788a..9ec28e7 100644
--- a/frontend/src/app/entities/settings/settings-interface.ts
+++ b/frontend/src/app/entities/settings/settings-interface.ts
@@ -19,12 +19,4 @@ export enum ESettingKey {
   NOTIFICATION_URL = 'NOTIFICATION_URL',
   TIMEZONE = 'TIMEZONE',
   DOCKER_TIMEOUT = 'DOCKER_TIMEOUT',
-  
-  // OIDC Settings
-  OIDC_ENABLED = 'OIDC_ENABLED',
-  OIDC_WELL_KNOWN_URL = 'OIDC_WELL_KNOWN_URL',
-  OIDC_CLIENT_ID = 'OIDC_CLIENT_ID',
-  OIDC_CLIENT_SECRET = 'OIDC_CLIENT_SECRET',
-  OIDC_REDIRECT_URI = 'OIDC_REDIRECT_URI',
-  OIDC_SCOPES = 'OIDC_SCOPES',
 }
diff --git a/frontend/src/app/features/auth-page/auth-page.html b/frontend/src/app/features/auth-page/auth-page.html
index c2df616..d047ba4 100644
--- a/frontend/src/app/features/auth-page/auth-page.html
+++ b/frontend/src/app/features/auth-page/auth-page.html
@@ -1,21 +1,13 @@
 <div class="auth">
   <app-logo class="logo"></app-logo>
   @if (isPasswordSet()) {
-    <app-login-form
-      [isLoading]="isLoading()"
-      (OnSubmit)="onSubmitLogin($event)"
-    >
-    </app-login-form>
-    
+    <!-- Show OIDC login if enabled, otherwise show password login -->
     @if (isOidcEnabled()) {
-      <div class="oidc-login-section">
-        <p-divider align="center">
-          <span>{{ 'AUTH.OR' | translate }}</span>
-        </p-divider>
-        
+      <div class="oidc-only-login">
         <p-button
           [loading]="isLoading()"
-          severity="secondary"
+          severity="primary"
+          size="large"
           class="oidc-login-button"
           (onClick)="onOidcLogin()"
         >
@@ -25,6 +17,12 @@
           </span>
         </p-button>
       </div>
+    } @else {
+      <app-login-form
+        [isLoading]="isLoading()"
+        (OnSubmit)="onSubmitLogin($event)"
+      >
+      </app-login-form>
     }
   } @else {
     <app-new-password-form
diff --git a/frontend/src/app/features/auth-page/auth-page.scss b/frontend/src/app/features/auth-page/auth-page.scss
index fdeb632..6daccd9 100644
--- a/frontend/src/app/features/auth-page/auth-page.scss
+++ b/frontend/src/app/features/auth-page/auth-page.scss
@@ -25,4 +25,35 @@
       margin: 1rem 0;
     }
   }
+
+  .oidc-only-login {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    text-align: center;
+    gap: 2rem;
+    padding-top: 1rem;
+    min-height: 200px; // Ensure adequate space for centering
+    
+    .oidc-login-button {
+      width: 80%;
+      max-width: 300px;
+      min-height: 52px;
+      justify-content: center;
+      gap: 0.75rem;
+      font-size: 1.1rem;
+      font-weight: 600;
+      letter-spacing: 0.02em;
+      
+      i {
+        font-size: 1.3rem;
+      }
+      
+      span {
+        font-size: 1.1rem;
+        font-weight: 600;
+      }
+    }
+  }
 }
diff --git a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.html b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.html
index d0d9a83..9a3e614 100644
--- a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.html
+++ b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.html
@@ -32,17 +32,6 @@
             >
             </p-button>
           }
-          @case (ESettingKey.OIDC_WELL_KNOWN_URL) {
-            <p-button
-              icon="pi pi-link"
-              severity="contrast"
-              rounded="true"
-              [pTooltip]="'SETTINGS.BY_KEY.OIDC_WELL_KNOWN_URL.TEST' | translate"
-              tooltipPosition="left"
-              (onClick)="onTestOidc()"
-            >
-            </p-button>
-          }
         }
 
         @if (keyTranslates[key]?.HINT; as hint) {
diff --git a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts
index 6f8786e..7456415 100644
--- a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts
+++ b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.ts
@@ -20,7 +20,6 @@ import {
 import { TranslatePipe, TranslateService } from '@ngx-translate/core';
 import { catchError, finalize, of } from 'rxjs';
 import { SettingsApiService } from 'src/app/entities/settings/settings-api.service';
-import { AuthApiService } from 'src/app/entities/auth/auth-api.service';
 import {
   ESettingKey,
   ESettingValueType,
@@ -59,7 +58,6 @@ import { ToastService } from 'src/app/core/services/toast.service';
 })
 export class SettingsPageForm {
   private readonly settingsApiService = inject(SettingsApiService);
-  private readonly authApiService = inject(AuthApiService);
   private readonly translateService = inject(TranslateService);
   private readonly toastService = inject(ToastService);
 
@@ -76,9 +74,6 @@ export class SettingsPageForm {
     this.settingsApiService.getAvailableTimezones().pipe(catchError(() => of([]))),
   );
 
-  // User info signals
-  public readonly userInfo = signal<any>(null);
-  public readonly isLoadingUserInfo = signal<boolean>(false);
   public readonly timezonesSearch = signal<string>(null);
   public readonly displayedTimezones = computed<string[]>(() => {
     const timezones = this.timezones();
@@ -124,7 +119,6 @@ export class SettingsPageForm {
 
   constructor() {
     this.updateSettings();
-    this.loadUserInfo();
   }
 
   private updateSettings(): void {
@@ -162,26 +156,6 @@ export class SettingsPageForm {
       });
   }
 
-  private loadUserInfo(): void {
-    this.isLoadingUserInfo.set(true);
-    this.authApiService
-      .getUserInfo()
-      .pipe(
-        finalize(() => {
-          this.isLoadingUserInfo.set(false);
-        }),
-        catchError((error) => {
-          // Silently fail if user is not authenticated (e.g., using password auth)
-          return of(null);
-        }),
-      )
-      .subscribe({
-        next: (userInfo) => {
-          this.userInfo.set(userInfo);
-        },
-      });
-  }
-
   private getFormGroup(data: ISetting): FormGroup<TInterfaceToForm<ISetting>> {
     const form = new FormGroup<TInterfaceToForm<ISetting>>({
       key: new FormControl<ESettingKey>(data.key),
@@ -203,12 +177,6 @@ export class SettingsPageForm {
         return [Validators.required, this.cronValidator];
       case ESettingKey.TIMEZONE:
         return [Validators.required, this.timezoneValidator];
-      case ESettingKey.OIDC_WELL_KNOWN_URL:
-        return [this.urlValidator];
-      case ESettingKey.OIDC_CLIENT_ID:
-        return [];
-      case ESettingKey.OIDC_REDIRECT_URI:
-        return [this.urlValidator];
       default:
         return [];
     }
@@ -237,31 +205,6 @@ export class SettingsPageForm {
       });
   }
 
-  public onTestOidc(): void {
-    this.isLoading.set(true);
-    const wellKnownUrl = this.formArray.value.find(
-      (item) => item.key === ESettingKey.OIDC_WELL_KNOWN_URL,
-    ).value as string;
-    
-    if (!wellKnownUrl) {
-      this.toastService.error('OIDC Well-Known URL is required for testing');
-      this.isLoading.set(false);
-      return;
-    }
-    
-    this.settingsApiService
-      .testOidcConnection(wellKnownUrl)
-      .pipe(finalize(() => this.isLoading.set(false)))
-      .subscribe({
-        next: (response) => {
-          this.toastService.success(`OIDC Connection Test Successful. Provider: ${response.endpoints?.issuer || 'Unknown'}`);
-        },
-        error: (error) => {
-          this.toastService.error(error);
-        },
-      });
-  }
-
   public submit(): void {
     if (this.formArray.invalid) {
       this.formArray.controls.forEach((c) => {
diff --git a/frontend/src/app/features/settings-page/settings-page.html b/frontend/src/app/features/settings-page/settings-page.html
index 8f8dabb..c903960 100644
--- a/frontend/src/app/features/settings-page/settings-page.html
+++ b/frontend/src/app/features/settings-page/settings-page.html
@@ -18,56 +18,10 @@
     </p-accordion-header>
     <p-accordion-content>
       <app-settings-page-form 
-        [excludeKeys]="oidcSettingKeys" 
         (OnSubmit)="onSubmitSettings($event)"
       ></app-settings-page-form>
     </p-accordion-content>
   </p-accordion-panel>
 
-  <p-accordion-panel value="2">
-    <p-accordion-header>
-      {{ 'SETTINGS.SECTIONS.OIDC_SETTINGS' | translate }}
-    </p-accordion-header>
-    <p-accordion-content>
-      <!-- OIDC Setup Info -->
-      <div class="oidc-redirect-info">
-        <div class="redirect-url-info">
-          <strong>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_TITLE' | translate }}</strong>
-          <p>{{ 'SETTINGS.OIDC.REDIRECT_SETUP_MESSAGE' | translate }}</p>
-          <code class="redirect-example">{{ 'SETTINGS.OIDC.REDIRECT_SETUP_EXAMPLE' | translate }}</code>
-        </div>
-      </div>
 
-      <app-settings-page-form 
-        [includeKeys]="oidcSettingKeys" 
-        (OnSubmit)="onSubmitSettings($event)"
-        #oidcSettingsForm
-      ></app-settings-page-form>
-
-      <!-- OIDC User Info Display -->
-      @if (oidcSettingsForm.userInfo(); as userInfo) {
-        @if (userInfo.is_oidc) {
-          <div class="oidc-user-info">
-            <h4>{{ 'SETTINGS.OIDC.CURRENT_USER' | translate }}</h4>
-            <div class="user-info-field">
-              <strong>{{ 'SETTINGS.OIDC.EMAIL' | translate }}:</strong> 
-              <span>{{ userInfo.email || 'N/A' }}</span>
-            </div>
-            @if (userInfo.name) {
-              <div class="user-info-field">
-                <strong>{{ 'SETTINGS.OIDC.NAME' | translate }}:</strong> 
-                <span>{{ userInfo.name }}</span>
-              </div>
-            }
-            @if (userInfo.preferred_username) {
-              <div class="user-info-field">
-                <strong>{{ 'SETTINGS.OIDC.USERNAME' | translate }}:</strong> 
-                <span>{{ userInfo.preferred_username }}</span>
-              </div>
-            }
-          </div>
-        }
-      }
-    </p-accordion-content>
-  </p-accordion-panel>
 </p-accordion>
diff --git a/frontend/src/app/features/settings-page/settings-page.scss b/frontend/src/app/features/settings-page/settings-page.scss
index 438cebc..a34f624 100644
--- a/frontend/src/app/features/settings-page/settings-page.scss
+++ b/frontend/src/app/features/settings-page/settings-page.scss
@@ -5,68 +5,4 @@
   overflow-y: auto;
 }
 
-.oidc-redirect-info {
-  margin-bottom: 1.5rem;
-  padding: 1rem;
-  background-color: var(--p-surface-ground);
-  border: 1px solid var(--p-surface-border);
-  border-left: 4px solid var(--p-primary-color);
-  border-radius: var(--p-border-radius-md);
-  
-  .redirect-url-info {
-    strong {
-      color: var(--p-primary-color);
-      font-size: 1rem;
-      display: block;
-      margin-bottom: 0.5rem;
-    }
-    
-    p {
-      margin: 0.5rem 0;
-      line-height: 1.5;
-      color: var(--p-text-color);
-    }
-    
-    .redirect-example {
-      display: block;
-      margin-top: 0.75rem;
-      padding: 0.5rem;
-      border-radius: var(--p-border-radius-sm);
-      font-family: 'Courier New', monospace;
-      color: var(--p-text-color);
-      word-break: break-all;
-      font-size: 0.9rem;
-    }
-  }
-}
-
-.oidc-user-info {
-  margin-top: 1rem;
-  padding: 1rem;
-  background-color: var(--p-content-background);
-  border: 1px solid var(--p-content-border-color);
-  border-radius: var(--p-border-radius-md);
 
-  h4 {
-    margin-top: 0;
-    margin-bottom: 0.75rem;
-    color: var(--p-text-color);
-    font-size: 1rem;
-    font-weight: 600;
-  }
-
-  .user-info-field {
-    margin-bottom: 0.5rem;
-    display: flex;
-    gap: 0.5rem;
-    
-    strong {
-      color: var(--p-text-color);
-      min-width: 80px;
-    }
-    
-    span {
-      color: var(--p-text-muted-color);
-    }
-  }
-}
diff --git a/frontend/src/app/features/settings-page/settings-page.ts b/frontend/src/app/features/settings-page/settings-page.ts
index fe39a33..a12285d 100644
--- a/frontend/src/app/features/settings-page/settings-page.ts
+++ b/frontend/src/app/features/settings-page/settings-page.ts
@@ -25,14 +25,7 @@ export class SettingsPage {
 
   public readonly isLoading = signal<boolean>(false);
   
-  public readonly oidcSettingKeys = [
-    ESettingKey.OIDC_ENABLED,
-    ESettingKey.OIDC_WELL_KNOWN_URL,
-    ESettingKey.OIDC_CLIENT_ID,
-    ESettingKey.OIDC_CLIENT_SECRET,
-    ESettingKey.OIDC_REDIRECT_URI,
-    ESettingKey.OIDC_SCOPES
-  ];
+
 
   public onSubmitNewPassword(body: ISetPasswordBody): void {
     this.isLoading.set(true);

From 3a98f526c446392b431ea528e1b86995ba4efbbb Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Mon, 3 Nov 2025 13:30:49 +0000
Subject: [PATCH 33/40] Update .env.example

---
 .env.example | 37 +++++++++++++++++++++++++++++++++++--
 1 file changed, 35 insertions(+), 2 deletions(-)

diff --git a/.env.example b/.env.example
index 1b11e25..717f350 100644
--- a/.env.example
+++ b/.env.example
@@ -36,5 +36,38 @@ PASSWORD_FILE=
 # Default is FALSE.
 HTTPS=
 # Authentication will only be possible on this domain.
-# Default is empty.
-DOMAIN=mydomain.org
\ No newline at end of file
+# Default is empty, so any domain is allowed.
+DOMAIN=
+#endregion
+
+#region Tugtainer Agent
+# Same as for the main image
+LOG_LEVEL=
+AGENT_SECRET=
+AGENT_SIGNATURE_TTL=
+# This value is used to run the agent without direct socket mount.
+# Address of the socket proxy, e.g. tcp://:socket-proxy:2375
+# Default is empty
+DOCKER_HOST=
+# Docker CLI timeout in seconds for typically fast operations e.g. inspect.
+# It does not affect potentially long operations such as container create or image pull.
+# Default is 15
+DOCKER_TIMEOUT=
+#endregion
+
+#region OIDC Authentication
+# Enable OIDC authentication alongside password auth
+OIDC_ENABLED=false
+
+# OIDC provider's well-known configuration endpoint
+OIDC_WELL_KNOWN_URL=https://auth.example.com/.well-known/openid-configuration
+
+# OIDC client credentials
+OIDC_CLIENT_ID=your-client-id
+OIDC_CLIENT_SECRET=your-client-secret
+
+# Must match what's registered in your OIDC provider
+OIDC_REDIRECT_URI=https://your-tugtainer-domain.com/api/auth/oidc/callback
+
+# Space-separated scopes (openid is always included)
+OIDC_SCOPES=openid profile email
\ No newline at end of file

From 8a5b084b9219b2514b3d89471dca0a7fad80e954 Mon Sep 17 00:00:00 2001
From: CamCharlton <github@camc.xyz>
Date: Mon, 3 Nov 2025 13:46:10 +0000
Subject: [PATCH 34/40] Restore auth api cookie settings

---
 backend/app/api/auth_api.py | 29 +++++++++++++++--------------
 1 file changed, 15 insertions(+), 14 deletions(-)

diff --git a/backend/app/api/auth_api.py b/backend/app/api/auth_api.py
index 02c4677..7fbc4f6 100644
--- a/backend/app/api/auth_api.py
+++ b/backend/app/api/auth_api.py
@@ -66,18 +66,18 @@ async def login(response: Response, password: str):
         key="access_token",
         value=access_token,
         httponly=True,
-        samesite="lax",  # Changed from "strict" to "lax" for better localhost compatibility
-        secure=False,    # Always False for localhost development
-        domain=None,     # No domain restriction for localhost
+        samesite="strict",
+        secure=Config.HTTPS,
+        domain=Config.DOMAIN if Config.DOMAIN else None,
         max_age=Config.ACCESS_TOKEN_LIFETIME_MIN * 60,
     )
     response.set_cookie(
         key="refresh_token",
         value=refresh_token,
         httponly=True,
-        samesite="lax",  # Changed from "strict" to "lax" for better localhost compatibility
-        secure=False,    # Always False for localhost development
-        domain=None,     # No domain restriction for localhost
+        samesite="strict",
+        secure=Config.HTTPS,
+        domain=Config.DOMAIN if Config.DOMAIN else None,
         max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
     )
     response.status_code = status.HTTP_200_OK
@@ -256,8 +256,9 @@ async def oidc_login(request: Request):
             key="oidc_state",
             value=state,
             httponly=True,
-            samesite="lax",  # Changed from strict to lax for cross-origin redirects
-            secure=False,  # Set to False for HTTP testing
+            samesite="strict",
+            secure=Config.HTTPS,
+            domain=Config.DOMAIN if Config.DOMAIN else None,
             max_age=300,  # 5 minutes
         )
         return response
@@ -321,18 +322,18 @@ async def oidc_callback(
             key="access_token",
             value=tokens["access_token"],
             httponly=True,
-            samesite="lax",  # Changed from "strict" to "lax" for better localhost compatibility
-            secure=False,    # Always False for localhost development
-            domain=None,     # No domain restriction for localhost
+            samesite="strict",
+            secure=Config.HTTPS,
+            domain=Config.DOMAIN if Config.DOMAIN else None,
             max_age=Config.ACCESS_TOKEN_LIFETIME_MIN * 60,
         )
         response.set_cookie(
             key="refresh_token",
             value=tokens["refresh_token"],
             httponly=True,
-            samesite="lax",  # Changed from "strict" to "lax" for better localhost compatibility
-            secure=False,    # Always False for localhost development
-            domain=None,     # No domain restriction for localhost
+            samesite="strict",
+            secure=Config.HTTPS,
+            domain=Config.DOMAIN if Config.DOMAIN else None,
             max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
         )
         

From 31d9e55d98c635ae0cb27715e5f28aaf72682331 Mon Sep 17 00:00:00 2001
From: Quenary <evgeny.savin.nord@gmail.com>
Date: Wed, 5 Nov 2025 16:59:29 +0300
Subject: [PATCH 35/40] refactor: removed unused oidc related code

+ removed migrations
+ remoted translations
+ removed fake observable result of initiateOidcLogin
+ removed values of oidc vars in .env.example, edited comments
+ fixed typing errors in auth_api
+ fixed errors in auth_core (settings now in config)
---
 .env.example                                  |  25 +--
 .../c1d4e5f6a7b8_add_oidc_settings.py         |  50 -----
 .../d2e3f4g5h6i7_remove_oidc_settings.py      |  35 ----
 backend/api/auth_api.py                       | 127 +++++++-----
 backend/core/auth_core.py                     | 183 ++++++++++--------
 frontend/public/i18n/en.json                  |  37 +---
 .../src/app/entities/auth/auth-api.service.ts |   6 +-
 .../src/app/features/auth-page/auth-page.ts   |  22 +--
 .../settings-page-form.html                   |  11 --
 .../features/settings-page/settings-page.html |   6 +-
 .../features/settings-page/settings-page.ts   |   4 +-
 11 files changed, 208 insertions(+), 298 deletions(-)
 delete mode 100644 backend/alembic/versions/c1d4e5f6a7b8_add_oidc_settings.py
 delete mode 100644 backend/alembic/versions/d2e3f4g5h6i7_remove_oidc_settings.py

diff --git a/.env.example b/.env.example
index 717f350..2f02616 100644
--- a/.env.example
+++ b/.env.example
@@ -56,18 +56,19 @@ DOCKER_TIMEOUT=
 #endregion
 
 #region OIDC Authentication
-# Enable OIDC authentication alongside password auth
-OIDC_ENABLED=false
-
+# Enable OIDC authentication instead of password auth
+# Default is empty which become False
+OIDC_ENABLED=
 # OIDC provider's well-known configuration endpoint
-OIDC_WELL_KNOWN_URL=https://auth.example.com/.well-known/openid-configuration
-
+# e.g. https://auth.example.com/.well-known/openid-configuration
+OIDC_WELL_KNOWN_URL=
 # OIDC client credentials
-OIDC_CLIENT_ID=your-client-id
-OIDC_CLIENT_SECRET=your-client-secret
-
+OIDC_CLIENT_ID=
+OIDC_CLIENT_SECRET=
 # Must match what's registered in your OIDC provider
-OIDC_REDIRECT_URI=https://your-tugtainer-domain.com/api/auth/oidc/callback
-
-# Space-separated scopes (openid is always included)
-OIDC_SCOPES=openid profile email
\ No newline at end of file
+# e.g. https://your-tugtainer-domain.com/api/auth/oidc/callback
+OIDC_REDIRECT_URI=
+# Space-separated scopes
+# Default is "openid profile email"
+OIDC_SCOPES=
+#endregion
\ No newline at end of file
diff --git a/backend/alembic/versions/c1d4e5f6a7b8_add_oidc_settings.py b/backend/alembic/versions/c1d4e5f6a7b8_add_oidc_settings.py
deleted file mode 100644
index 913f095..0000000
--- a/backend/alembic/versions/c1d4e5f6a7b8_add_oidc_settings.py
+++ /dev/null
@@ -1,50 +0,0 @@
-"""add_oidc_settings
-
-Revision ID: c1d4e5f6a7b8
-Revises: b8dc3f40419f
-Create Date: 2025-10-28 12:00:00.000000
-
-"""
-from alembic import op
-import sqlalchemy as sa
-
-# revision identifiers, used by Alembic.
-revision = 'c1d4e5f6a7b8'
-down_revision = 'b8dc3f40419f'
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    """Add OIDC settings to the settings table."""
-    op.execute(
-        sa.text(
-            """
-        INSERT INTO settings (key, value, value_type) VALUES
-        ('OIDC_ENABLED', 'FALSE', 'bool'),
-        ('OIDC_WELL_KNOWN_URL', '', 'str'),
-        ('OIDC_CLIENT_ID', '', 'str'),
-        ('OIDC_CLIENT_SECRET', '', 'str'),
-        ('OIDC_REDIRECT_URI', '', 'str'),
-        ('OIDC_SCOPES', 'openid profile email', 'str')
-        """
-        )
-    )
-
-
-def downgrade() -> None:
-    """Remove OIDC settings from the settings table."""
-    op.execute(
-        sa.text(
-            """
-        DELETE FROM settings WHERE key IN (
-            'OIDC_ENABLED',
-            'OIDC_WELL_KNOWN_URL', 
-            'OIDC_CLIENT_ID',
-            'OIDC_CLIENT_SECRET',
-            'OIDC_REDIRECT_URI',
-            'OIDC_SCOPES'
-        )
-        """
-        )
-    )
\ No newline at end of file
diff --git a/backend/alembic/versions/d2e3f4g5h6i7_remove_oidc_settings.py b/backend/alembic/versions/d2e3f4g5h6i7_remove_oidc_settings.py
deleted file mode 100644
index 9c82431..0000000
--- a/backend/alembic/versions/d2e3f4g5h6i7_remove_oidc_settings.py
+++ /dev/null
@@ -1,35 +0,0 @@
-"""remove_oidc_settings
-
-Revision ID: d2e3f4g5h6i7
-Revises: c1d4e5f6a7b8
-Create Date: 2025-11-03 13:00:00.000000
-
-"""
-from alembic import op
-import sqlalchemy as sa
-
-# revision identifiers, used by Alembic.
-revision = 'd2e3f4g5h6i7'
-down_revision = 'c1d4e5f6a7b8'
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    """Remove OIDC settings as they are now configured via environment variables."""
-    # Remove OIDC settings from the database
-    op.execute("DELETE FROM settings WHERE key IN ('OIDC_ENABLED', 'OIDC_WELL_KNOWN_URL', 'OIDC_CLIENT_ID', 'OIDC_CLIENT_SECRET', 'OIDC_REDIRECT_URI', 'OIDC_SCOPES')")
-
-
-def downgrade() -> None:
-    """Re-add OIDC settings to database (not recommended as they should use env vars)."""
-    # Insert OIDC settings with default values
-    op.execute("""
-        INSERT OR IGNORE INTO settings (key, value, value_type, modified_at) VALUES
-        ('OIDC_ENABLED', 'FALSE', 'bool', datetime('now')),
-        ('OIDC_WELL_KNOWN_URL', '', 'str', datetime('now')),
-        ('OIDC_CLIENT_ID', '', 'str', datetime('now')),
-        ('OIDC_CLIENT_SECRET', '', 'str', datetime('now')),
-        ('OIDC_REDIRECT_URI', '', 'str', datetime('now')),
-        ('OIDC_SCOPES', 'openid profile email', 'str', datetime('now'))
-    """)
\ No newline at end of file
diff --git a/backend/api/auth_api.py b/backend/api/auth_api.py
index 5b16eac..3c2db21 100644
--- a/backend/api/auth_api.py
+++ b/backend/api/auth_api.py
@@ -182,13 +182,13 @@ def get_current_user(request: Request) -> dict[str, Any]:
         raise HTTPException(
             status_code=401, detail="Missing access token"
         )
-    
+
     payload: dict[str, Any] = verify_token(access_token)
     if payload.get("type") != "access":
         raise HTTPException(
             status_code=401, detail="Invalid access token"
         )
-    
+
     return payload
 
 
@@ -196,22 +196,28 @@ def get_current_user(request: Request) -> dict[str, Any]:
     path="/user/info",
     description="Get current authenticated user information",
 )
-def get_user_info(current_user: dict[str, Any] = Depends(get_current_user)):
+def get_user_info(
+    current_user: dict[str, Any] = Depends(get_current_user),
+):
     user_info = {
         "is_oidc": current_user.get("oidc", False),
         "user_id": current_user.get("user_id", ""),
     }
-    
+
     # If OIDC user, include additional user info
     if current_user.get("oidc") and current_user.get("user_info"):
         oidc_info = current_user.get("user_info", {})
-        user_info.update({
-            "email": oidc_info.get("email", ""),
-            "name": oidc_info.get("name", ""),
-            "preferred_username": oidc_info.get("preferred_username", ""),
-            "sub": oidc_info.get("sub", ""),
-        })
-    
+        user_info.update(
+            {
+                "email": oidc_info.get("email", ""),
+                "name": oidc_info.get("name", ""),
+                "preferred_username": oidc_info.get(
+                    "preferred_username", ""
+                ),
+                "sub": oidc_info.get("sub", ""),
+            }
+        )
+
     return user_info
 
 
@@ -231,27 +237,40 @@ def oidc_enabled():
 async def oidc_login(request: Request):
     if not is_oidc_enabled():
         raise HTTPException(
-            status_code=400, detail="OIDC authentication is not enabled"
+            status_code=400,
+            detail="OIDC authentication is not enabled",
         )
-    
+
     config = get_oidc_config()
-    
-    if not all([config['well_known_url'], config['client_id'], config['redirect_uri']]):
+
+    if not all(
+        [
+            config["well_known_url"],
+            config["client_id"],
+            config["redirect_uri"],
+        ]
+    ):
         raise HTTPException(
             status_code=400, detail="OIDC configuration is incomplete"
         )
-    
+
     # Generate state parameter for CSRF protection
     state = secrets.token_urlsafe(32)
-    
+
     # Store state in session/cookie for verification later
     # For simplicity, we'll use a cookie (in production, consider using a database)
-    
+
     try:
-        discovery_doc = await fetch_oidc_discovery(config['well_known_url'])
-        authorization_url = create_oidc_authorization_url(discovery_doc, config, state)
-        
-        response = RedirectResponse(url=authorization_url, status_code=302)
+        discovery_doc = await fetch_oidc_discovery(
+            config["well_known_url"]
+        )
+        authorization_url = create_oidc_authorization_url(
+            discovery_doc, config, state
+        )
+
+        response = RedirectResponse(
+            url=authorization_url, status_code=302
+        )
         response.set_cookie(
             key="oidc_state",
             value=state,
@@ -261,11 +280,11 @@ async def oidc_login(request: Request):
             max_age=300,  # 5 minutes
         )
         return response
-        
+
     except Exception as e:
         raise HTTPException(
             status_code=400,
-            detail=f"Error initiating OIDC login: {str(e)}"
+            detail=f"Error initiating OIDC login: {str(e)}",
         )
 
 
@@ -276,46 +295,60 @@ async def oidc_login(request: Request):
 async def oidc_callback(
     request: Request,
     response: Response,
-    code: str = None,
-    state: str = None,
-    error: str = None,
+    code: str | None = None,
+    state: str | None = None,
+    error: str | None = None,
 ):
     if error:
         raise HTTPException(
             status_code=400,
-            detail=f"OIDC authentication error: {error}"
+            detail=f"OIDC authentication error: {error}",
         )
-    
+
     if not code or not state:
         raise HTTPException(
             status_code=400,
-            detail="Missing authorization code or state parameter"
+            detail="Missing authorization code or state parameter",
         )
-    
+
     # Verify state parameter
     stored_state = request.cookies.get("oidc_state")
-    print(f"OIDC Callback Debug - Received state: {state}, Stored state: {stored_state}")  # Debug print
-    print(f"OIDC Callback Debug - All cookies: {dict(request.cookies)}")  # Debug print
+    print(
+        f"OIDC Callback Debug - Received state: {state}, Stored state: {stored_state}"
+    )  # Debug print
+    print(
+        f"OIDC Callback Debug - All cookies: {dict(request.cookies)}"
+    )  # Debug print
     if not stored_state or stored_state != state:
         raise HTTPException(
             status_code=400,
-            detail=f"Invalid state parameter - received: {state}, stored: {stored_state}"
+            detail=f"Invalid state parameter - received: {state}, stored: {stored_state}",
         )
-    
+
     config = get_oidc_config()
-    
+
     try:
-        print(f"OIDC Callback - Code: {code}, State: {state}")  # Debug print
-        discovery_doc = await fetch_oidc_discovery(config['well_known_url'])
+        print(
+            f"OIDC Callback - Code: {code}, State: {state}"
+        )  # Debug print
+        discovery_doc = await fetch_oidc_discovery(
+            config["well_known_url"]
+        )
         print(f"OIDC Discovery successful")  # Debug print
-        user_data = await exchange_oidc_code(code, state, discovery_doc, config)
-        print(f"OIDC Token exchange successful: {user_data}")  # Debug print
+        user_data = await exchange_oidc_code(
+            code, state, discovery_doc, config
+        )
+        print(
+            f"OIDC Token exchange successful: {user_data}"
+        )  # Debug print
         tokens = create_oidc_user_session(user_data)
         print(f"OIDC Session created")  # Debug print
-        
+
         # Create response for redirect
-        response = RedirectResponse(url="/containers", status_code=302)
-        
+        response = RedirectResponse(
+            url="/containers", status_code=302
+        )
+
         # Set authentication cookies
         response.set_cookie(
             key="access_token",
@@ -335,14 +368,14 @@ async def oidc_callback(
             domain=Config.DOMAIN if Config.DOMAIN else None,
             max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
         )
-        
+
         # Clear the state cookie
         response.delete_cookie("oidc_state")
-        
+
         return response
-        
+
     except Exception as e:
         raise HTTPException(
             status_code=400,
-            detail=f"Error processing OIDC callback: {str(e)}"
+            detail=f"Error processing OIDC callback: {str(e)}",
         )
diff --git a/backend/core/auth_core.py b/backend/core/auth_core.py
index 0ce019b..950972a 100644
--- a/backend/core/auth_core.py
+++ b/backend/core/auth_core.py
@@ -1,16 +1,13 @@
-from typing import Any, Dict, Optional
+from typing import Any, Dict
 from datetime import datetime, timedelta
 from fastapi import HTTPException, Request
 from jose import jwt, JWTError
 import bcrypt
 import os
-import asyncio
 import aiohttp
 from urllib.parse import urlencode
 from backend.config import Config
 from backend.helpers.now import now
-from backend.helpers.settings_storage import SettingsStorage
-from backend.enums.settings_enum import ESettingKey
 
 
 def verify_password(plain: str, hashed: str) -> bool:
@@ -26,7 +23,9 @@ def get_password_hash(password: str) -> str:
     """Hash password"""
     pwd_bytes: bytes = password.encode("utf-8")
     salt: bytes = bcrypt.gensalt()
-    hashed_password: bytes = bcrypt.hashpw(password=pwd_bytes, salt=salt)
+    hashed_password: bytes = bcrypt.hashpw(
+        password=pwd_bytes, salt=salt
+    )
     return hashed_password.decode("utf-8")
 
 
@@ -37,14 +36,20 @@ def verify_token(token: str) -> dict:
     """
     try:
         payload: dict[str, Any] = jwt.decode(
-            token, key=Config.JWT_SECRET_KEY, algorithms=[Config.JWT_ALGORITHM]
+            token,
+            key=Config.JWT_SECRET_KEY,
+            algorithms=[Config.JWT_ALGORITHM],
         )
         return payload
     except JWTError:
-        raise HTTPException(status_code=401, detail="Token is invalid or expired")
+        raise HTTPException(
+            status_code=401, detail="Token is invalid or expired"
+        )
 
 
-def create_token(data: dict[str, Any], expires_delta: timedelta) -> str:
+def create_token(
+    data: dict[str, Any], expires_delta: timedelta
+) -> str:
     """
     Create access or refresh token
     """
@@ -52,7 +57,9 @@ def create_token(data: dict[str, Any], expires_delta: timedelta) -> str:
     expire: datetime = now() + expires_delta
     to_encode.update({"exp": expire})
     return jwt.encode(
-        claims=to_encode, key=Config.JWT_SECRET_KEY, algorithm=Config.JWT_ALGORITHM
+        claims=to_encode,
+        key=Config.JWT_SECRET_KEY,
+        algorithm=Config.JWT_ALGORITHM,
     )
 
 
@@ -89,20 +96,17 @@ def write_password_hash(password_hash: str) -> None:
 
 def is_oidc_enabled() -> bool:
     """Check if OIDC authentication is enabled"""
-    try:
-        return SettingsStorage.get(ESettingKey.OIDC_ENABLED) is True
-    except:
-        return False
+    return Config.OIDC_ENABLED
 
 
 def get_oidc_config() -> Dict[str, str]:
     """Get OIDC configuration from settings"""
     return {
-        'well_known_url': SettingsStorage.get(ESettingKey.OIDC_WELL_KNOWN_URL),
-        'client_id': SettingsStorage.get(ESettingKey.OIDC_CLIENT_ID),
-        'client_secret': SettingsStorage.get(ESettingKey.OIDC_CLIENT_SECRET),
-        'redirect_uri': SettingsStorage.get(ESettingKey.OIDC_REDIRECT_URI),
-        'scopes': SettingsStorage.get(ESettingKey.OIDC_SCOPES).split()
+        "well_known_url": Config.OIDC_WELL_KNOWN_URL,
+        "client_id": Config.OIDC_CLIENT_ID,
+        "client_secret": Config.OIDC_CLIENT_SECRET,
+        "redirect_uri": Config.OIDC_REDIRECT_URI,
+        "scopes": Config.OIDC_SCOPES,
     }
 
 
@@ -115,139 +119,154 @@ async def fetch_oidc_discovery(well_known_url: str) -> Dict[str, Any]:
                     return await response.json()
                 else:
                     raise HTTPException(
-                        status_code=400, 
-                        detail=f"Failed to fetch OIDC discovery document: {response.status}"
+                        status_code=400,
+                        detail=f"Failed to fetch OIDC discovery document: {response.status}",
                     )
     except aiohttp.ClientError as e:
         raise HTTPException(
             status_code=400,
-            detail=f"Error fetching OIDC discovery document: {str(e)}"
+            detail=f"Error fetching OIDC discovery document: {str(e)}",
         )
 
 
-def create_oidc_authorization_url(discovery_doc: Dict[str, Any], config: Dict[str, str], state: str) -> str:
+def create_oidc_authorization_url(
+    discovery_doc: Dict[str, Any], config: Dict[str, str], state: str
+) -> str:
     """Create OIDC authorization URL"""
     try:
         # Manually build the authorization URL
-        auth_endpoint = discovery_doc['authorization_endpoint']
-        scopes = ' '.join(config['scopes'])
-        
+        auth_endpoint = discovery_doc["authorization_endpoint"]
+        scopes = " ".join(config["scopes"])
+
         params = {
-            'client_id': config['client_id'],
-            'redirect_uri': config['redirect_uri'],
-            'scope': scopes,
-            'response_type': 'code',
-            'state': state
+            "client_id": config["client_id"],
+            "redirect_uri": config["redirect_uri"],
+            "scope": scopes,
+            "response_type": "code",
+            "state": state,
         }
-        
+
         # Build query string
         query_string = urlencode(params)
         authorization_url = f"{auth_endpoint}?{query_string}"
-        
+
         return authorization_url
     except Exception as e:
         raise HTTPException(
             status_code=400,
-            detail=f"Error creating authorization URL: {str(e)}"
+            detail=f"Error creating authorization URL: {str(e)}",
         )
 
 
 async def exchange_oidc_code(
-    code: str, 
-    state: str, 
-    discovery_doc: Dict[str, Any], 
-    config: Dict[str, str]
+    code: str,
+    state: str,
+    discovery_doc: Dict[str, Any],
+    config: Dict[str, str],
 ) -> Dict[str, Any]:
     """Exchange authorization code for tokens"""
     try:
         # Prepare token exchange request
-        token_endpoint = discovery_doc['token_endpoint']
-        
+        token_endpoint = discovery_doc["token_endpoint"]
+
         data = {
-            'grant_type': 'authorization_code',
-            'code': code,
-            'redirect_uri': config['redirect_uri'],
-            'client_id': config['client_id'],
-            'client_secret': config['client_secret']
+            "grant_type": "authorization_code",
+            "code": code,
+            "redirect_uri": config["redirect_uri"],
+            "client_id": config["client_id"],
+            "client_secret": config["client_secret"],
         }
-        
+
         # Exchange code for token
         async with aiohttp.ClientSession() as session:
-            async with session.post(token_endpoint, data=data) as response:
+            async with session.post(
+                token_endpoint, data=data
+            ) as response:
                 if response.status != 200:
                     error_text = await response.text()
                     raise HTTPException(
                         status_code=400,
-                        detail=f"Token exchange failed: {error_text}"
+                        detail=f"Token exchange failed: {error_text}",
                     )
-                
+
                 token = await response.json()
-            
+
             # Verify and decode ID token if present
-            if 'id_token' in token:
+            if "id_token" in token:
                 # For now, we'll decode without verification (not recommended for production)
-                id_token_claims = jwt.get_unverified_claims(token['id_token'])
+                id_token_claims = jwt.get_unverified_claims(
+                    token["id_token"]
+                )
                 return {
-                    'access_token': token.get('access_token'),
-                    'id_token_claims': id_token_claims
+                    "access_token": token.get("access_token"),
+                    "id_token_claims": id_token_claims,
                 }
-            
+
             # If no ID token, fetch user info from userinfo endpoint
-            if 'userinfo_endpoint' in discovery_doc:
-                headers = {'Authorization': f"Bearer {token['access_token']}"}
-                async with session.get(discovery_doc['userinfo_endpoint'], headers=headers) as response:
+            if "userinfo_endpoint" in discovery_doc:
+                headers = {
+                    "Authorization": f"Bearer {token['access_token']}"
+                }
+                async with session.get(
+                    discovery_doc["userinfo_endpoint"],
+                    headers=headers,
+                ) as response:
                     if response.status == 200:
                         user_info = await response.json()
                         return {
-                            'access_token': token.get('access_token'),
-                            'user_info': user_info
+                            "access_token": token.get("access_token"),
+                            "user_info": user_info,
                         }
-        
+
         raise HTTPException(
             status_code=400,
-            detail="Unable to retrieve user information from OIDC provider"
+            detail="Unable to retrieve user information from OIDC provider",
         )
-        
+
     except Exception as e:
         raise HTTPException(
             status_code=400,
-            detail=f"Error exchanging authorization code: {str(e)}"
+            detail=f"Error exchanging authorization code: {str(e)}",
         )
 
 
-def create_oidc_user_session(user_data: Dict[str, Any]) -> Dict[str, str]:
+def create_oidc_user_session(
+    user_data: Dict[str, Any],
+) -> Dict[str, str]:
     """Create user session tokens after OIDC authentication"""
     # Extract user identifier (email, sub, or preferred_username)
-    user_claims = user_data.get('id_token_claims', user_data.get('user_info', {}))
-    
+    user_claims = user_data.get(
+        "id_token_claims", user_data.get("user_info", {})
+    )
+
     user_id = (
-        user_claims.get('email') or 
-        user_claims.get('sub') or 
-        user_claims.get('preferred_username') or
-        'unknown_user'
+        user_claims.get("email")
+        or user_claims.get("sub")
+        or user_claims.get("preferred_username")
+        or "unknown_user"
     )
-    
+
     # Create JWT tokens with OIDC user info
     access_token = create_token(
         data={
             "type": "access",
             "oidc": True,
             "user_id": user_id,
-            "user_info": user_claims
+            "user_info": user_claims,
         },
-        expires_delta=timedelta(minutes=Config.ACCESS_TOKEN_LIFETIME_MIN)
+        expires_delta=timedelta(
+            minutes=Config.ACCESS_TOKEN_LIFETIME_MIN
+        ),
     )
-    
+
     refresh_token = create_token(
-        data={
-            "type": "refresh", 
-            "oidc": True,
-            "user_id": user_id
-        },
-        expires_delta=timedelta(minutes=Config.REFRESH_TOKEN_LIFETIME_MIN)
+        data={"type": "refresh", "oidc": True, "user_id": user_id},
+        expires_delta=timedelta(
+            minutes=Config.REFRESH_TOKEN_LIFETIME_MIN
+        ),
     )
-    
+
     return {
         "access_token": access_token,
-        "refresh_token": refresh_token
+        "refresh_token": refresh_token,
     }
diff --git a/frontend/public/i18n/en.json b/frontend/public/i18n/en.json
index c966f67..ca9f18f 100644
--- a/frontend/public/i18n/en.json
+++ b/frontend/public/i18n/en.json
@@ -140,8 +140,7 @@
     "VALUE": "Value",
     "SECTIONS": {
       "CHANGE_PASSWORD": "Change password",
-      "APP_SETTINGS": "App settings",
-      "OIDC_SETTINGS": "OIDC Authentication Settings"
+      "APP_SETTINGS": "App settings"
     },
     "BY_KEY": {
       "CRONTAB_EXPR": {
@@ -162,41 +161,7 @@
       "DOCKER_TIMEOUT": {
         "LABEL": "Docker timeout",
         "HINT": "Docker CLI call timeout. This applies primarily to API methods and does not apply to, for example, container re-creation or image pulling."
-      },
-      "OIDC_ENABLED": {
-        "LABEL": "Enable OIDC Authentication",
-        "HINT": "Enable OpenID Connect authentication alongside password authentication"
-      },
-      "OIDC_WELL_KNOWN_URL": {
-        "LABEL": "OIDC Well-Known URL",
-        "HINT": "The well-known configuration URL of your OIDC provider (e.g., https://auth.example.com/.well-known/openid_configuration)",
-        "TEST": "Test OIDC connection"
-      },
-      "OIDC_CLIENT_ID": {
-        "LABEL": "OIDC Client ID",
-        "HINT": "The client identifier registered with your OIDC provider"
-      },
-      "OIDC_CLIENT_SECRET": {
-        "LABEL": "OIDC Client Secret",
-        "HINT": "The client secret for your OIDC application (keep this secure)"
-      },
-      "OIDC_REDIRECT_URI": {
-        "LABEL": "OIDC Redirect URI",
-        "HINT": "The redirect URI configured in your OIDC provider (e.g., https://tugtainer.example.com/auth/oidc/callback)"
-      },
-      "OIDC_SCOPES": {
-        "LABEL": "OIDC Scopes",
-        "HINT": "Space-separated list of OAuth2 scopes to request (openid is always included)"
       }
-    },
-    "OIDC": {
-      "CURRENT_USER": "Currently Authenticated User",
-      "EMAIL": "Email",
-      "NAME": "Name",
-      "USERNAME": "Username",
-      "REDIRECT_SETUP_TITLE": "Important: OIDC Provider Setup", 
-      "REDIRECT_SETUP_MESSAGE": "In your OIDC provider, you must register your Tugtainer URL followed by '/api/auth/oidc/callback' as an allowed callback URL.",
-      "REDIRECT_SETUP_EXAMPLE": "Example: https://your-tugtainer-domain.com/api/auth/oidc/callback"
     }
   }
 }
diff --git a/frontend/src/app/entities/auth/auth-api.service.ts b/frontend/src/app/entities/auth/auth-api.service.ts
index c1708aa..472d8df 100644
--- a/frontend/src/app/entities/auth/auth-api.service.ts
+++ b/frontend/src/app/entities/auth/auth-api.service.ts
@@ -43,13 +43,9 @@ export class AuthApiService extends BaseApiService<'/auth'> {
     return this.httpClient.get<boolean>(`${this.basePath}/oidc/enabled`);
   }
 
-  initiateOidcLogin(): Observable<any> {
+  initiateOidcLogin(): void {
     // This will redirect to the OIDC provider, so we don't expect a JSON response
     window.location.href = `${this.basePath}/oidc/login`;
-    return new Observable(subscriber => {
-      // This observable won't emit since we're redirecting
-      subscriber.complete();
-    });
   }
 
   getUserInfo(): Observable<any> {
diff --git a/frontend/src/app/features/auth-page/auth-page.ts b/frontend/src/app/features/auth-page/auth-page.ts
index d15295f..daaf57c 100644
--- a/frontend/src/app/features/auth-page/auth-page.ts
+++ b/frontend/src/app/features/auth-page/auth-page.ts
@@ -79,20 +79,18 @@ export class AuthPage implements OnInit {
   }
 
   private updateIsOidcEnabled(): void {
-    this.authApiService
-      .isOidcEnabled()
-      .subscribe({
-        next: (res) => {
-          this.isOidcEnabled.set(res);
-        },
-        error: (error) => {
-          console.warn('Could not check OIDC status:', error);
-          this.isOidcEnabled.set(false);
-        },
-      });
+    this.authApiService.isOidcEnabled().subscribe({
+      next: (res) => {
+        this.isOidcEnabled.set(res);
+      },
+      error: (error) => {
+        console.warn('Could not check OIDC status:', error);
+        this.isOidcEnabled.set(false);
+      },
+    });
   }
 
   onOidcLogin(): void {
-    this.authApiService.initiateOidcLogin().subscribe();
+    this.authApiService.initiateOidcLogin();
   }
 }
diff --git a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.html b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.html
index d0d9a83..9a3e614 100644
--- a/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.html
+++ b/frontend/src/app/features/settings-page/settings-page-form/settings-page-form.html
@@ -32,17 +32,6 @@
             >
             </p-button>
           }
-          @case (ESettingKey.OIDC_WELL_KNOWN_URL) {
-            <p-button
-              icon="pi pi-link"
-              severity="contrast"
-              rounded="true"
-              [pTooltip]="'SETTINGS.BY_KEY.OIDC_WELL_KNOWN_URL.TEST' | translate"
-              tooltipPosition="left"
-              (onClick)="onTestOidc()"
-            >
-            </p-button>
-          }
         }
 
         @if (keyTranslates[key]?.HINT; as hint) {
diff --git a/frontend/src/app/features/settings-page/settings-page.html b/frontend/src/app/features/settings-page/settings-page.html
index c903960..3ceb292 100644
--- a/frontend/src/app/features/settings-page/settings-page.html
+++ b/frontend/src/app/features/settings-page/settings-page.html
@@ -17,11 +17,7 @@
       {{ 'SETTINGS.SECTIONS.APP_SETTINGS' | translate }}
     </p-accordion-header>
     <p-accordion-content>
-      <app-settings-page-form 
-        (OnSubmit)="onSubmitSettings($event)"
-      ></app-settings-page-form>
+      <app-settings-page-form (OnSubmit)="onSubmitSettings($event)"></app-settings-page-form>
     </p-accordion-content>
   </p-accordion-panel>
-
-
 </p-accordion>
diff --git a/frontend/src/app/features/settings-page/settings-page.ts b/frontend/src/app/features/settings-page/settings-page.ts
index a12285d..7a08a50 100644
--- a/frontend/src/app/features/settings-page/settings-page.ts
+++ b/frontend/src/app/features/settings-page/settings-page.ts
@@ -6,7 +6,7 @@ import { TranslatePipe } from '@ngx-translate/core';
 import { AuthApiService } from 'src/app/entities/auth/auth-api.service';
 import { SettingsApiService } from 'src/app/entities/settings/settings-api.service';
 import { finalize } from 'rxjs';
-import { ISettingUpdate, ESettingKey } from 'src/app/entities/settings/settings-interface';
+import { ISettingUpdate } from 'src/app/entities/settings/settings-interface';
 import { DividerModule } from 'primeng/divider';
 import { AccordionModule } from 'primeng/accordion';
 import { ToastService } from 'src/app/core/services/toast.service';
@@ -24,8 +24,6 @@ export class SettingsPage {
   private readonly settingsApiService = inject(SettingsApiService);
 
   public readonly isLoading = signal<boolean>(false);
-  
-
 
   public onSubmitNewPassword(body: ISetPasswordBody): void {
     this.isLoading.set(true);

From 3cb101dcfeba74ea95472a9471945f00ca8e9daa Mon Sep 17 00:00:00 2001
From: Quenary <evgeny.savin.nord@gmail.com>
Date: Wed, 5 Nov 2025 20:35:14 +0300
Subject: [PATCH 36/40] refactor: auth providers

+ added auth providers classes
+ removed /backend/app folder
+ removed /backend/core/auth_core.py
---
 backend/api/auth_api.py                       | 332 ++--------------
 backend/api/containers_api.py                 |   2 +-
 backend/api/hosts_api.py                      |   3 +-
 backend/api/images_api.py                     |   2 +-
 backend/api/settings_api.py                   |  71 ++--
 backend/app/api/auth_api.py                   | 349 -----------------
 backend/app/api/settings_api.py               | 142 -------
 backend/app/core/auth_core.py                 | 250 ------------
 backend/app/schemas/auth_schema.py            |  25 --
 backend/app/schemas/settings_schema.py        |  33 --
 backend/app/schemas/validators.py             |  45 ---
 backend/core/__init__.py                      |   1 -
 backend/core/auth/__init__.py                 |   0
 backend/core/auth/auth_oidc_provider.py       | 367 ++++++++++++++++++
 backend/core/auth/auth_password_provider.py   | 188 +++++++++
 backend/core/auth/auth_provider.py            |  73 ++++
 backend/core/auth/auth_provider_chore.py      |  32 ++
 backend/core/auth_core.py                     | 272 -------------
 .../src/app/entities/auth/auth-api.service.ts |   4 -
 19 files changed, 723 insertions(+), 1468 deletions(-)
 delete mode 100644 backend/app/api/auth_api.py
 delete mode 100644 backend/app/api/settings_api.py
 delete mode 100644 backend/app/core/auth_core.py
 delete mode 100644 backend/app/schemas/auth_schema.py
 delete mode 100644 backend/app/schemas/settings_schema.py
 delete mode 100644 backend/app/schemas/validators.py
 create mode 100644 backend/core/auth/__init__.py
 create mode 100644 backend/core/auth/auth_oidc_provider.py
 create mode 100644 backend/core/auth/auth_password_provider.py
 create mode 100644 backend/core/auth/auth_provider.py
 create mode 100644 backend/core/auth/auth_provider_chore.py
 delete mode 100644 backend/core/auth_core.py

diff --git a/backend/api/auth_api.py b/backend/api/auth_api.py
index 3c2db21..6c6e530 100644
--- a/backend/api/auth_api.py
+++ b/backend/api/auth_api.py
@@ -1,143 +1,41 @@
-from typing import Any
-from datetime import timedelta
-import secrets
-import urllib.parse
 from fastapi import (
     APIRouter,
     Depends,
-    HTTPException,
     Response,
     Request,
     status,
 )
-from fastapi.responses import PlainTextResponse, RedirectResponse
-from backend.helpers.delay_to_minimum import delay_to_minimum
-from backend.config import Config
-from backend.helpers.now import now
-from backend.core.auth_core import (
-    get_password_hash,
-    verify_token,
-    verify_password,
-    create_token,
+from fastapi.responses import PlainTextResponse
+from backend.core.auth.auth_provider_chore import (
+    AUTH_OIDC_PROVIDER,
+    AUTH_PASSWORD_PROVIDER,
     is_authorized,
-    read_password_hash,
-    write_password_hash,
-    is_oidc_enabled,
-    get_oidc_config,
-    fetch_oidc_discovery,
-    create_oidc_authorization_url,
-    exchange_oidc_code,
-    create_oidc_user_session,
 )
+from backend.helpers.delay_to_minimum import delay_to_minimum
 from backend.schemas.auth_schema import PasswordSetRequestBody
 
 
 router: APIRouter = APIRouter(prefix="/auth", tags=["auth"])
 
 
-@router.post(path="/login")
-@delay_to_minimum(1)
-async def login(response: Response, password: str):
-    STORED_PASSWORD_HASH: str | None = read_password_hash()
-
-    if not STORED_PASSWORD_HASH:
-        raise HTTPException(
-            status_code=401, detail="Password not set"
-        )
+# For now endpoints are tied to a specific provider
+# Maybe they should be more universal
 
-    if not verify_password(password, STORED_PASSWORD_HASH):
-        raise HTTPException(
-            status_code=401, detail="Invalid password"
-        )
 
-    access_token: str = create_token(
-        data={"type": "access"},
-        expires_delta=timedelta(
-            minutes=Config.ACCESS_TOKEN_LIFETIME_MIN
-        ),
-    )
-    refresh_token: str = create_token(
-        data={"type": "refresh"},
-        expires_delta=timedelta(
-            minutes=Config.REFRESH_TOKEN_LIFETIME_MIN
-        ),
-    )
-    response.set_cookie(
-        key="access_token",
-        value=access_token,
-        httponly=True,
-        samesite="strict",
-        secure=Config.HTTPS,
-        domain=Config.DOMAIN,
-        max_age=Config.ACCESS_TOKEN_LIFETIME_MIN * 60,
-    )
-    response.set_cookie(
-        key="refresh_token",
-        value=refresh_token,
-        httponly=True,
-        samesite="strict",
-        secure=Config.HTTPS,
-        domain=Config.DOMAIN,
-        max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
-    )
-    response.status_code = status.HTTP_200_OK
-    return response
+@router.post(path="/login")
+@delay_to_minimum(1)
+async def login(request: Request, response: Response):
+    return await AUTH_PASSWORD_PROVIDER.login(request, response)
 
 
 @router.post(path="/refresh")
 async def refresh(request: Request, response: Response):
-    refresh_token: str | None = request.cookies.get("refresh_token")
-    if not refresh_token:
-        raise HTTPException(
-            status_code=401, detail="Missing refresh token"
-        )
-
-    payload: dict[str, Any] = verify_token(refresh_token)
-    if payload.get("type") != "refresh":
-        raise HTTPException(
-            status_code=401, detail="Invalid refresh token"
-        )
-
-    new_access_token: str = create_token(
-        data={"type": "access"},
-        expires_delta=timedelta(
-            minutes=Config.ACCESS_TOKEN_LIFETIME_MIN
-        ),
-    )
-    new_refresh_token: str = create_token(
-        data={"type": "refresh"},
-        expires_delta=timedelta(
-            minutes=Config.REFRESH_TOKEN_LIFETIME_MIN
-        ),
-    )
-    response.set_cookie(
-        key="access_token",
-        value=new_access_token,
-        httponly=True,
-        samesite="strict",
-        secure=Config.HTTPS,
-        domain=Config.DOMAIN,
-        max_age=Config.ACCESS_TOKEN_LIFETIME_MIN * 60,
-    )
-    response.set_cookie(
-        key="refresh_token",
-        value=new_refresh_token,
-        httponly=True,
-        samesite="strict",
-        secure=Config.HTTPS,
-        domain=Config.DOMAIN,
-        max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
-    )
-    response.status_code = status.HTTP_200_OK
-    return response
+    return await AUTH_PASSWORD_PROVIDER.refresh(request, response)
 
 
 @router.post(path="/logout")
-def logout(response: Response):
-    response.delete_cookie("access_token")
-    response.delete_cookie("refresh_token")
-    response.status_code = status.HTTP_200_OK
-    return response
+async def logout(request: Request, response: Response):
+    return await AUTH_PASSWORD_PROVIDER.logout(request, response)
 
 
 @router.get(
@@ -154,15 +52,7 @@ def is_authorized_req(_=Depends(is_authorized)):
     description="Set password for web UI. Password can be set only if password is not set yet or if user is authorized.",
 )
 def set_password(request: Request, payload: PasswordSetRequestBody):
-    password_hash: str = get_password_hash(payload.password)
-
-    if not read_password_hash():
-        write_password_hash(password_hash)
-        return PlainTextResponse(status_code=status.HTTP_201_CREATED)
-
-    _ = is_authorized(request)
-    write_password_hash(password_hash)
-    return PlainTextResponse(status_code=status.HTTP_200_OK)
+    return AUTH_PASSWORD_PROVIDER.set_password(request, payload)
 
 
 @router.get(
@@ -170,55 +60,8 @@ def set_password(request: Request, payload: PasswordSetRequestBody):
     description="Check if password is set",
     response_model=bool,
 )
-def is_password_set():
-    password_hash: str | None = read_password_hash()
-    return password_hash not in [None, ""]
-
-
-def get_current_user(request: Request) -> dict[str, Any]:
-    """Dependency to get current user from access token"""
-    access_token: str | None = request.cookies.get("access_token")
-    if not access_token:
-        raise HTTPException(
-            status_code=401, detail="Missing access token"
-        )
-
-    payload: dict[str, Any] = verify_token(access_token)
-    if payload.get("type") != "access":
-        raise HTTPException(
-            status_code=401, detail="Invalid access token"
-        )
-
-    return payload
-
-
-@router.get(
-    path="/user/info",
-    description="Get current authenticated user information",
-)
-def get_user_info(
-    current_user: dict[str, Any] = Depends(get_current_user),
-):
-    user_info = {
-        "is_oidc": current_user.get("oidc", False),
-        "user_id": current_user.get("user_id", ""),
-    }
-
-    # If OIDC user, include additional user info
-    if current_user.get("oidc") and current_user.get("user_info"):
-        oidc_info = current_user.get("user_info", {})
-        user_info.update(
-            {
-                "email": oidc_info.get("email", ""),
-                "name": oidc_info.get("name", ""),
-                "preferred_username": oidc_info.get(
-                    "preferred_username", ""
-                ),
-                "sub": oidc_info.get("sub", ""),
-            }
-        )
-
-    return user_info
+def is_password_set() -> bool:
+    return AUTH_PASSWORD_PROVIDER.is_password_set()
 
 
 @router.get(
@@ -226,66 +69,16 @@ def get_user_info(
     description="Check if OIDC authentication is enabled",
     response_model=bool,
 )
-def oidc_enabled():
-    return is_oidc_enabled()
+async def oidc_enabled() -> bool:
+    return await AUTH_OIDC_PROVIDER.is_enabled()
 
 
 @router.get(
     path="/oidc/login",
     description="Initiate OIDC login flow",
 )
-async def oidc_login(request: Request):
-    if not is_oidc_enabled():
-        raise HTTPException(
-            status_code=400,
-            detail="OIDC authentication is not enabled",
-        )
-
-    config = get_oidc_config()
-
-    if not all(
-        [
-            config["well_known_url"],
-            config["client_id"],
-            config["redirect_uri"],
-        ]
-    ):
-        raise HTTPException(
-            status_code=400, detail="OIDC configuration is incomplete"
-        )
-
-    # Generate state parameter for CSRF protection
-    state = secrets.token_urlsafe(32)
-
-    # Store state in session/cookie for verification later
-    # For simplicity, we'll use a cookie (in production, consider using a database)
-
-    try:
-        discovery_doc = await fetch_oidc_discovery(
-            config["well_known_url"]
-        )
-        authorization_url = create_oidc_authorization_url(
-            discovery_doc, config, state
-        )
-
-        response = RedirectResponse(
-            url=authorization_url, status_code=302
-        )
-        response.set_cookie(
-            key="oidc_state",
-            value=state,
-            httponly=True,
-            samesite="lax",  # Changed from strict to lax for cross-origin redirects
-            secure=False,  # Set to False for HTTP testing
-            max_age=300,  # 5 minutes
-        )
-        return response
-
-    except Exception as e:
-        raise HTTPException(
-            status_code=400,
-            detail=f"Error initiating OIDC login: {str(e)}",
-        )
+async def oidc_login(request: Request, response: Response):
+    return await AUTH_OIDC_PROVIDER.login(request, response)
 
 
 @router.get(
@@ -299,83 +92,6 @@ async def oidc_callback(
     state: str | None = None,
     error: str | None = None,
 ):
-    if error:
-        raise HTTPException(
-            status_code=400,
-            detail=f"OIDC authentication error: {error}",
-        )
-
-    if not code or not state:
-        raise HTTPException(
-            status_code=400,
-            detail="Missing authorization code or state parameter",
-        )
-
-    # Verify state parameter
-    stored_state = request.cookies.get("oidc_state")
-    print(
-        f"OIDC Callback Debug - Received state: {state}, Stored state: {stored_state}"
-    )  # Debug print
-    print(
-        f"OIDC Callback Debug - All cookies: {dict(request.cookies)}"
-    )  # Debug print
-    if not stored_state or stored_state != state:
-        raise HTTPException(
-            status_code=400,
-            detail=f"Invalid state parameter - received: {state}, stored: {stored_state}",
-        )
-
-    config = get_oidc_config()
-
-    try:
-        print(
-            f"OIDC Callback - Code: {code}, State: {state}"
-        )  # Debug print
-        discovery_doc = await fetch_oidc_discovery(
-            config["well_known_url"]
-        )
-        print(f"OIDC Discovery successful")  # Debug print
-        user_data = await exchange_oidc_code(
-            code, state, discovery_doc, config
-        )
-        print(
-            f"OIDC Token exchange successful: {user_data}"
-        )  # Debug print
-        tokens = create_oidc_user_session(user_data)
-        print(f"OIDC Session created")  # Debug print
-
-        # Create response for redirect
-        response = RedirectResponse(
-            url="/containers", status_code=302
-        )
-
-        # Set authentication cookies
-        response.set_cookie(
-            key="access_token",
-            value=tokens["access_token"],
-            httponly=True,
-            samesite="strict",
-            secure=Config.HTTPS,
-            domain=Config.DOMAIN if Config.DOMAIN else None,
-            max_age=Config.ACCESS_TOKEN_LIFETIME_MIN * 60,
-        )
-        response.set_cookie(
-            key="refresh_token",
-            value=tokens["refresh_token"],
-            httponly=True,
-            samesite="strict",
-            secure=Config.HTTPS,
-            domain=Config.DOMAIN if Config.DOMAIN else None,
-            max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
-        )
-
-        # Clear the state cookie
-        response.delete_cookie("oidc_state")
-
-        return response
-
-    except Exception as e:
-        raise HTTPException(
-            status_code=400,
-            detail=f"Error processing OIDC callback: {str(e)}",
-        )
+    return await AUTH_OIDC_PROVIDER.oidc_callback(
+        request, response, code, state, error
+    )
diff --git a/backend/api/containers_api.py b/backend/api/containers_api.py
index f83f187..3c5aa78 100644
--- a/backend/api/containers_api.py
+++ b/backend/api/containers_api.py
@@ -2,7 +2,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
-from backend.core.auth_core import is_authorized
+from backend.core.auth.auth_provider_chore import is_authorized
 from backend.schemas.containers_schema import (
     ContainerPatchRequestBody,
     ContainerGetResponseBody,
diff --git a/backend/api/hosts_api.py b/backend/api/hosts_api.py
index 5bf64bf..52bb3cb 100644
--- a/backend/api/hosts_api.py
+++ b/backend/api/hosts_api.py
@@ -1,7 +1,8 @@
 from fastapi import APIRouter, Depends, HTTPException, Response
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
-from backend.core import is_authorized, HostsManager
+from backend.core import HostsManager
+from backend.core.auth.auth_provider_chore import is_authorized
 from backend.schemas import (
     HostInfo,
     HostBase,
diff --git a/backend/api/images_api.py b/backend/api/images_api.py
index 6fcc7fc..cde214a 100644
--- a/backend/api/images_api.py
+++ b/backend/api/images_api.py
@@ -3,7 +3,7 @@
     ContainerInspectResult,
 )
 from sqlalchemy.ext.asyncio import AsyncSession
-from backend.core.auth_core import is_authorized
+from backend.core.auth.auth_provider_chore import is_authorized
 from backend.schemas import ImageGetResponseBody
 from backend.api.util import map_image_schema, get_host
 from backend.core import HostsManager
diff --git a/backend/api/settings_api.py b/backend/api/settings_api.py
index 5de676f..fa5428d 100644
--- a/backend/api/settings_api.py
+++ b/backend/api/settings_api.py
@@ -4,7 +4,7 @@
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 from backend.config import Config
-from backend.core.auth_core import is_authorized
+from backend.core.auth.auth_provider_chore import is_authorized
 from backend.db.session import get_async_session
 from backend.db.models import SettingModel
 from backend.db.util import get_setting_typed_value
@@ -13,7 +13,6 @@
     SettingsPatchRequestItem,
     TestNotificationRequestBody,
 )
-from backend.core.auth_core import fetch_oidc_discovery
 from backend.core.notifications_core import send_notification
 from backend.core.cron_manager import CronManager
 from backend.enums.settings_enum import ESettingKey
@@ -146,42 +145,42 @@ def get_available_timezones() -> set[str]:
     return VALID_TIMEZONES
 
 
-@router.post(
-    "/test_oidc",
-    status_code=200,
-    description="Test OIDC well-known URL connectivity",
-)
-async def test_oidc_connection(data: dict):
-    """Test if the OIDC well-known URL is accessible and returns valid configuration"""
-    well_known_url = data.get("well_known_url")
-    if not well_known_url:
-        raise HTTPException(400, "well_known_url is required")
+# @router.post(
+#     "/test_oidc",
+#     status_code=200,
+#     description="Test OIDC well-known URL connectivity",
+# )
+# async def test_oidc_connection(data: dict):
+#     """Test if the OIDC well-known URL is accessible and returns valid configuration"""
+#     well_known_url = data.get("well_known_url")
+#     if not well_known_url:
+#         raise HTTPException(400, "well_known_url is required")
     
-    try:
-        discovery_doc = await fetch_oidc_discovery(well_known_url)
+#     try:
+#         discovery_doc = await fetch_oidc_discovery(well_known_url)
         
-        # Check if required endpoints exist
-        required_endpoints = ["authorization_endpoint", "token_endpoint"]
-        missing_endpoints = [ep for ep in required_endpoints if ep not in discovery_doc]
+#         # Check if required endpoints exist
+#         required_endpoints = ["authorization_endpoint", "token_endpoint"]
+#         missing_endpoints = [ep for ep in required_endpoints if ep not in discovery_doc]
         
-        if missing_endpoints:
-            raise HTTPException(
-                400, 
-                f"OIDC discovery document is missing required endpoints: {missing_endpoints}"
-            )
+#         if missing_endpoints:
+#             raise HTTPException(
+#                 400, 
+#                 f"OIDC discovery document is missing required endpoints: {missing_endpoints}"
+#             )
         
-        return {
-            "status": "success",
-            "message": "OIDC configuration is valid",
-            "endpoints": {
-                "authorization_endpoint": discovery_doc.get("authorization_endpoint"),
-                "token_endpoint": discovery_doc.get("token_endpoint"),
-                "userinfo_endpoint": discovery_doc.get("userinfo_endpoint"),
-                "issuer": discovery_doc.get("issuer")
-            }
-        }
+#         return {
+#             "status": "success",
+#             "message": "OIDC configuration is valid",
+#             "endpoints": {
+#                 "authorization_endpoint": discovery_doc.get("authorization_endpoint"),
+#                 "token_endpoint": discovery_doc.get("token_endpoint"),
+#                 "userinfo_endpoint": discovery_doc.get("userinfo_endpoint"),
+#                 "issuer": discovery_doc.get("issuer")
+#             }
+#         }
         
-    except HTTPException:
-        raise
-    except Exception as e:
-        raise HTTPException(500, f"Error testing OIDC connection: {str(e)}")
+#     except HTTPException:
+#         raise
+#     except Exception as e:
+#         raise HTTPException(500, f"Error testing OIDC connection: {str(e)}")
diff --git a/backend/app/api/auth_api.py b/backend/app/api/auth_api.py
deleted file mode 100644
index 7fbc4f6..0000000
--- a/backend/app/api/auth_api.py
+++ /dev/null
@@ -1,349 +0,0 @@
-from typing import Any
-from datetime import timedelta
-import secrets
-import urllib.parse
-from fastapi import (
-    APIRouter,
-    Depends,
-    HTTPException,
-    Response,
-    Request,
-    status,
-)
-from fastapi.responses import PlainTextResponse, RedirectResponse
-from app.helpers.delay_to_minimum import delay_to_minimum
-from app.config import Config
-from app.helpers.now import now
-from app.core.auth_core import (
-    get_password_hash,
-    verify_token,
-    verify_password,
-    create_token,
-    is_authorized,
-    read_password_hash,
-    write_password_hash,
-    is_oidc_enabled,
-    get_oidc_config,
-    fetch_oidc_discovery,
-    create_oidc_authorization_url,
-    exchange_oidc_code,
-    create_oidc_user_session,
-)
-from app.schemas.auth_schema import PasswordSetRequestBody
-
-
-router: APIRouter = APIRouter(prefix="/auth", tags=["auth"])
-
-
-@router.post(path="/login")
-@delay_to_minimum(1)
-async def login(response: Response, password: str):
-    STORED_PASSWORD_HASH: str | None = read_password_hash()
-
-    if not STORED_PASSWORD_HASH:
-        raise HTTPException(
-            status_code=401, detail="Password not set"
-        )
-
-    if not verify_password(password, STORED_PASSWORD_HASH):
-        raise HTTPException(
-            status_code=401, detail="Invalid password"
-        )
-
-    access_token: str = create_token(
-        data={"type": "access"},
-        expires_delta=timedelta(
-            minutes=Config.ACCESS_TOKEN_LIFETIME_MIN
-        ),
-    )
-    refresh_token: str = create_token(
-        data={"type": "refresh"},
-        expires_delta=timedelta(
-            minutes=Config.REFRESH_TOKEN_LIFETIME_MIN
-        ),
-    )
-    response.set_cookie(
-        key="access_token",
-        value=access_token,
-        httponly=True,
-        samesite="strict",
-        secure=Config.HTTPS,
-        domain=Config.DOMAIN if Config.DOMAIN else None,
-        max_age=Config.ACCESS_TOKEN_LIFETIME_MIN * 60,
-    )
-    response.set_cookie(
-        key="refresh_token",
-        value=refresh_token,
-        httponly=True,
-        samesite="strict",
-        secure=Config.HTTPS,
-        domain=Config.DOMAIN if Config.DOMAIN else None,
-        max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
-    )
-    response.status_code = status.HTTP_200_OK
-    return response
-
-
-@router.post(path="/refresh")
-async def refresh(request: Request, response: Response):
-    refresh_token: str | None = request.cookies.get("refresh_token")
-    if not refresh_token:
-        raise HTTPException(
-            status_code=401, detail="Missing refresh token"
-        )
-
-    payload: dict[str, Any] = verify_token(refresh_token)
-    if payload.get("type") != "refresh":
-        raise HTTPException(
-            status_code=401, detail="Invalid refresh token"
-        )
-
-    new_access_token: str = create_token(
-        data={"type": "access"},
-        expires_delta=timedelta(
-            minutes=Config.ACCESS_TOKEN_LIFETIME_MIN
-        ),
-    )
-    new_refresh_token: str = create_token(
-        data={"type": "refresh"},
-        expires_delta=timedelta(
-            minutes=Config.REFRESH_TOKEN_LIFETIME_MIN
-        ),
-    )
-    response.set_cookie(
-        key="access_token",
-        value=new_access_token,
-        httponly=True,
-        samesite="strict",
-        secure=Config.HTTPS,
-        domain=Config.DOMAIN,
-        max_age=Config.ACCESS_TOKEN_LIFETIME_MIN * 60,
-    )
-    response.set_cookie(
-        key="refresh_token",
-        value=new_refresh_token,
-        httponly=True,
-        samesite="strict",
-        secure=Config.HTTPS,
-        domain=Config.DOMAIN,
-        max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
-    )
-    response.status_code = status.HTTP_200_OK
-    return response
-
-
-@router.post(path="/logout")
-def logout(response: Response):
-    response.delete_cookie("access_token")
-    response.delete_cookie("refresh_token")
-    response.status_code = status.HTTP_200_OK
-    return response
-
-
-@router.get(
-    path="/is_authorized",
-    description="Check if session is authorized",
-    response_model=bool,
-)
-def is_authorized_req(_=Depends(is_authorized)):
-    return PlainTextResponse(status_code=status.HTTP_200_OK)
-
-
-@router.post(
-    path="/set_password",
-    description="Set password for web UI. Password can be set only if password is not set yet or if user is authorized.",
-)
-def set_password(request: Request, payload: PasswordSetRequestBody):
-    password_hash: str = get_password_hash(payload.password)
-
-    if not read_password_hash():
-        write_password_hash(password_hash)
-        return PlainTextResponse(status_code=status.HTTP_201_CREATED)
-
-    _ = is_authorized(request)
-    write_password_hash(password_hash)
-    return PlainTextResponse(status_code=status.HTTP_200_OK)
-
-
-@router.get(
-    path="/is_password_set",
-    description="Check if password is set",
-    response_model=bool,
-)
-def is_password_set():
-    password_hash: str | None = read_password_hash()
-    return password_hash not in [None, ""]
-
-
-def get_current_user(request: Request) -> dict[str, Any]:
-    """Dependency to get current user from access token"""
-    access_token: str | None = request.cookies.get("access_token")
-    if not access_token:
-        raise HTTPException(
-            status_code=401, detail="Missing access token"
-        )
-    
-    payload: dict[str, Any] = verify_token(access_token)
-    if payload.get("type") != "access":
-        raise HTTPException(
-            status_code=401, detail="Invalid access token"
-        )
-    
-    return payload
-
-
-@router.get(
-    path="/user/info",
-    description="Get current authenticated user information",
-)
-def get_user_info(current_user: dict[str, Any] = Depends(get_current_user)):
-    user_info = {
-        "is_oidc": current_user.get("oidc", False),
-        "user_id": current_user.get("user_id", ""),
-    }
-    
-    # If OIDC user, include additional user info
-    if current_user.get("oidc") and current_user.get("user_info"):
-        oidc_info = current_user.get("user_info", {})
-        user_info.update({
-            "email": oidc_info.get("email", ""),
-            "name": oidc_info.get("name", ""),
-            "preferred_username": oidc_info.get("preferred_username", ""),
-            "sub": oidc_info.get("sub", ""),
-        })
-    
-    return user_info
-
-
-@router.get(
-    path="/oidc/enabled",
-    description="Check if OIDC authentication is enabled",
-    response_model=bool,
-)
-def oidc_enabled():
-    return is_oidc_enabled()
-
-
-@router.get(
-    path="/oidc/login",
-    description="Initiate OIDC login flow",
-)
-async def oidc_login(request: Request):
-    if not is_oidc_enabled():
-        raise HTTPException(
-            status_code=400, detail="OIDC authentication is not enabled"
-        )
-    
-    config = get_oidc_config()
-    
-    if not all([config['well_known_url'], config['client_id'], config['redirect_uri']]):
-        raise HTTPException(
-            status_code=400, detail="OIDC configuration is incomplete"
-        )
-    
-    # Generate state parameter for CSRF protection
-    state = secrets.token_urlsafe(32)
-    
-    # Store state in session/cookie for verification later
-    # For simplicity, we'll use a cookie (in production, consider using a database)
-    
-    try:
-        discovery_doc = await fetch_oidc_discovery(config['well_known_url'])
-        authorization_url = create_oidc_authorization_url(discovery_doc, config, state)
-        
-        response = RedirectResponse(url=authorization_url, status_code=302)
-        response.set_cookie(
-            key="oidc_state",
-            value=state,
-            httponly=True,
-            samesite="strict",
-            secure=Config.HTTPS,
-            domain=Config.DOMAIN if Config.DOMAIN else None,
-            max_age=300,  # 5 minutes
-        )
-        return response
-        
-    except Exception as e:
-        raise HTTPException(
-            status_code=400,
-            detail=f"Error initiating OIDC login: {str(e)}"
-        )
-
-
-@router.get(
-    path="/oidc/callback",
-    description="Handle OIDC callback",
-)
-async def oidc_callback(
-    request: Request,
-    response: Response,
-    code: str = None,
-    state: str = None,
-    error: str = None,
-):
-    if error:
-        raise HTTPException(
-            status_code=400,
-            detail=f"OIDC authentication error: {error}"
-        )
-    
-    if not code or not state:
-        raise HTTPException(
-            status_code=400,
-            detail="Missing authorization code or state parameter"
-        )
-    
-    # Verify state parameter
-    stored_state = request.cookies.get("oidc_state")
-    print(f"OIDC Callback Debug - Received state: {state}, Stored state: {stored_state}")  # Debug print
-    print(f"OIDC Callback Debug - All cookies: {dict(request.cookies)}")  # Debug print
-    if not stored_state or stored_state != state:
-        raise HTTPException(
-            status_code=400,
-            detail=f"Invalid state parameter - received: {state}, stored: {stored_state}"
-        )
-    
-    config = get_oidc_config()
-    
-    try:
-        print(f"OIDC Callback - Code: {code}, State: {state}")  # Debug print
-        discovery_doc = await fetch_oidc_discovery(config['well_known_url'])
-        print(f"OIDC Discovery successful")  # Debug print
-        user_data = await exchange_oidc_code(code, state, discovery_doc, config)
-        print(f"OIDC Token exchange successful: {user_data}")  # Debug print
-        tokens = create_oidc_user_session(user_data)
-        print(f"OIDC Session created")  # Debug print
-        
-        # Create response for redirect
-        response = RedirectResponse(url="/containers", status_code=302)
-        
-        # Set authentication cookies
-        response.set_cookie(
-            key="access_token",
-            value=tokens["access_token"],
-            httponly=True,
-            samesite="strict",
-            secure=Config.HTTPS,
-            domain=Config.DOMAIN if Config.DOMAIN else None,
-            max_age=Config.ACCESS_TOKEN_LIFETIME_MIN * 60,
-        )
-        response.set_cookie(
-            key="refresh_token",
-            value=tokens["refresh_token"],
-            httponly=True,
-            samesite="strict",
-            secure=Config.HTTPS,
-            domain=Config.DOMAIN if Config.DOMAIN else None,
-            max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
-        )
-        
-        # Clear the state cookie
-        response.delete_cookie("oidc_state")
-        
-        return response
-        
-    except Exception as e:
-        raise HTTPException(
-            status_code=400,
-            detail=f"Error processing OIDC callback: {str(e)}"
-        )
diff --git a/backend/app/api/settings_api.py b/backend/app/api/settings_api.py
deleted file mode 100644
index ffba675..0000000
--- a/backend/app/api/settings_api.py
+++ /dev/null
@@ -1,142 +0,0 @@
-from zoneinfo import available_timezones
-from apprise.exception import AppriseException
-from fastapi import APIRouter, Depends, HTTPException
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-from app.core.auth_core import is_authorized
-from app.db.session import get_async_session
-from app.db.models import SettingModel
-from app.db.util import get_setting_typed_value
-from app.schemas.settings_schema import (
-    SettingsGetResponseItem,
-    SettingsPatchRequestItem,
-    TestNotificationRequestBody,
-)
-from app.core.notifications_core import send_notification
-from app.core.cron_manager import CronManager
-from app.enums.settings_enum import ESettingKey
-from app.enums.cron_jobs_enum import ECronJob
-from app.core.containers_core import check_all
-from app.exception import TugException
-
-VALID_TIMEZONES = available_timezones()
-
-router = APIRouter(
-    prefix="/settings",
-    tags=["settings"],
-    dependencies=[Depends(is_authorized)],
-)
-
-
-@router.get("/list", response_model=list[SettingsGetResponseItem])
-async def get_settings(
-    session: AsyncSession = Depends(get_async_session),
-):
-    stmt = select(SettingModel)
-    result = await session.execute(stmt)
-    settings = result.scalars()
-    res: list[SettingsGetResponseItem] = []
-    for s in settings:
-        val = get_setting_typed_value(s.value, s.value_type)
-        item = SettingsGetResponseItem(
-            key=s.key,
-            value=val,
-            value_type=s.value_type,
-            modified_at=s.modified_at,
-        )
-        res.append(item)
-
-    return res
-
-
-@router.patch("/change")
-async def change_system_settings(
-    data: list[SettingsPatchRequestItem],
-    session: AsyncSession = Depends(get_async_session),
-):
-    for s in data:
-        stmt = (
-            select(SettingModel)
-            .where(SettingModel.key == s.key)
-            .limit(1)
-        )
-        result = await session.execute(stmt)
-        setting = result.scalar_one_or_none()
-        if not setting:
-            raise HTTPException(
-                status_code=404, detail=f"Setting '{s.key}' not found"
-            )
-        if setting.value_type != type(s.value).__name__:
-            raise HTTPException(
-                400,
-                f"Invalid type of '{s.key}', expected '{setting.value_type}'",
-            )
-
-        setting.value = str(s.value)
-
-    await session.commit()
-
-    # Only reschedule cron job if CRONTAB_EXPR or TIMEZONE were updated
-    cron_expr_items = [
-        item for item in data if item.key == ESettingKey.CRONTAB_EXPR
-    ]
-    timezone_items = [
-        item for item in data if item.key == ESettingKey.TIMEZONE
-    ]
-
-    if cron_expr_items or timezone_items:
-        cron_expr = cron_expr_items[0] if cron_expr_items else None
-        timezone = timezone_items[0] if timezone_items else None
-        
-        # Get current values if not provided in the update
-        if not cron_expr:
-            stmt = select(SettingModel).where(SettingModel.key == ESettingKey.CRONTAB_EXPR).limit(1)
-            result = await session.execute(stmt)
-            cron_setting = result.scalar_one_or_none()
-            if cron_setting:
-                cron_expr = type('obj', (object,), {'value': cron_setting.value})()
-        
-        if not timezone:
-            stmt = select(SettingModel).where(SettingModel.key == ESettingKey.TIMEZONE).limit(1)
-            result = await session.execute(stmt)
-            timezone_setting = result.scalar_one_or_none()
-            if timezone_setting:
-                timezone = type('obj', (object,), {'value': timezone_setting.value})()
-        
-        if cron_expr and timezone:
-            CronManager.schedule_job(
-                ECronJob.CHECK_CONTAINERS,
-                str(cron_expr.value),
-                str(timezone.value),
-                lambda: check_all(True),
-            )
-
-    return {"status": "updated", "count": len(data)}
-
-
-@router.post(
-    "/test_notification",
-    status_code=200,
-    description="Send test notification to specified url",
-)
-async def test_notification(data: TestNotificationRequestBody):
-    try:
-        await send_notification(
-            "Tugtainer", "This is test notification", data.url
-        )
-        return {}
-    except (TugException, AppriseException) as e:
-        raise HTTPException(500, str(e))
-
-
-@router.get(
-    "/available_timezones",
-    status_code=200,
-    description="Get available timezones list",
-    response_model=set[str],
-)
-def get_available_timezones() -> set[str]:
-    return VALID_TIMEZONES
-
-
-
diff --git a/backend/app/core/auth_core.py b/backend/app/core/auth_core.py
deleted file mode 100644
index f3b7c69..0000000
--- a/backend/app/core/auth_core.py
+++ /dev/null
@@ -1,250 +0,0 @@
-from typing import Any, Dict, Optional
-from datetime import datetime, timedelta
-from fastapi import HTTPException, Request
-from jose import jwt, JWTError
-import bcrypt
-import os
-import asyncio
-import aiohttp
-from urllib.parse import urlencode
-from app.config import Config
-from app.helpers.now import now
-from app.helpers.settings_storage import SettingsStorage
-from app.enums.settings_enum import ESettingKey
-
-
-def verify_password(plain: str, hashed: str) -> bool:
-    """
-    Compare plain text password with hashed password
-    """
-    plain_bytes: bytes = plain.encode("utf-8")
-    hashed_bytes: bytes = hashed.encode("utf-8")
-    return bcrypt.checkpw(plain_bytes, hashed_bytes)
-
-
-def get_password_hash(password: str) -> str:
-    """Hash password"""
-    pwd_bytes: bytes = password.encode("utf-8")
-    salt: bytes = bcrypt.gensalt()
-    hashed_password: bytes = bcrypt.hashpw(password=pwd_bytes, salt=salt)
-    return hashed_password.decode("utf-8")
-
-
-def verify_token(token: str) -> dict:
-    """
-    Verify token validity and return its payload.
-    Raise 401 error if not valid.
-    """
-    try:
-        payload: dict[str, Any] = jwt.decode(
-            token, key=Config.JWT_SECRET_KEY, algorithms=[Config.JWT_ALGORITHM]
-        )
-        return payload
-    except JWTError:
-        raise HTTPException(status_code=401, detail="Token is invalid or expired")
-
-
-def create_token(data: dict[str, Any], expires_delta: timedelta) -> str:
-    """
-    Create access or refresh token
-    """
-    to_encode: dict[str, Any] = data.copy()
-    expire: datetime = now() + expires_delta
-    to_encode.update({"exp": expire})
-    return jwt.encode(
-        claims=to_encode, key=Config.JWT_SECRET_KEY, algorithm=Config.JWT_ALGORITHM
-    )
-
-
-def is_authorized(request: Request) -> dict[str, Any]:
-    """
-    Check for valid token in cookies.
-    Raise 401 if there is no token or token is invalid.
-    """
-    token = request.cookies.get("access_token")
-    if not token:
-        raise HTTPException(status_code=401, detail="Unauthorized")
-    return verify_token(token)
-
-
-def read_password_hash() -> str | None:
-    """
-    Read password hash from file
-    """
-    if not os.path.isfile(Config.PASSWORD_FILE):
-        return None
-    with open(Config.PASSWORD_FILE, "r") as f:
-        return f.read()
-
-
-def write_password_hash(password_hash: str) -> None:
-    """
-    Write password hash to file
-    """
-    with open(Config.PASSWORD_FILE, "w") as f:
-        _ = f.write(password_hash)
-        f.flush()
-        f.close()
-
-
-def is_oidc_enabled() -> bool:
-    """Check if OIDC authentication is enabled"""
-    return Config.OIDC_ENABLED
-
-
-def get_oidc_config() -> Dict[str, str]:
-    """Get OIDC configuration from environment variables"""
-    return {
-        'well_known_url': Config.OIDC_WELL_KNOWN_URL,
-        'client_id': Config.OIDC_CLIENT_ID,
-        'client_secret': Config.OIDC_CLIENT_SECRET,
-        'redirect_uri': Config.OIDC_REDIRECT_URI,
-        'scopes': Config.OIDC_SCOPES.split() if Config.OIDC_SCOPES else []
-    }
-
-
-async def fetch_oidc_discovery(well_known_url: str) -> Dict[str, Any]:
-    """Fetch OIDC discovery document from well-known URL"""
-    try:
-        async with aiohttp.ClientSession() as session:
-            async with session.get(well_known_url) as response:
-                if response.status == 200:
-                    return await response.json()
-                else:
-                    raise HTTPException(
-                        status_code=400, 
-                        detail=f"Failed to fetch OIDC discovery document: {response.status}"
-                    )
-    except aiohttp.ClientError as e:
-        raise HTTPException(
-            status_code=400,
-            detail=f"Error fetching OIDC discovery document: {str(e)}"
-        )
-
-
-def create_oidc_authorization_url(discovery_doc: Dict[str, Any], config: Dict[str, str], state: str) -> str:
-    """Create OIDC authorization URL"""
-    try:
-        # Manually build the authorization URL
-        auth_endpoint = discovery_doc['authorization_endpoint']
-        scopes = ' '.join(config['scopes'])
-        
-        params = {
-            'client_id': config['client_id'],
-            'redirect_uri': config['redirect_uri'],
-            'scope': scopes,
-            'response_type': 'code',
-            'state': state
-        }
-        
-        # Build query string
-        query_string = urlencode(params)
-        authorization_url = f"{auth_endpoint}?{query_string}"
-        
-        return authorization_url
-    except Exception as e:
-        raise HTTPException(
-            status_code=400,
-            detail=f"Error creating authorization URL: {str(e)}"
-        )
-
-
-async def exchange_oidc_code(
-    code: str, 
-    state: str, 
-    discovery_doc: Dict[str, Any], 
-    config: Dict[str, str]
-) -> Dict[str, Any]:
-    """Exchange authorization code for tokens"""
-    try:
-        # Prepare token exchange request
-        token_endpoint = discovery_doc['token_endpoint']
-        
-        data = {
-            'grant_type': 'authorization_code',
-            'code': code,
-            'redirect_uri': config['redirect_uri'],
-            'client_id': config['client_id'],
-            'client_secret': config['client_secret']
-        }
-        
-        # Exchange code for token
-        async with aiohttp.ClientSession() as session:
-            async with session.post(token_endpoint, data=data) as response:
-                if response.status != 200:
-                    error_text = await response.text()
-                    raise HTTPException(
-                        status_code=400,
-                        detail=f"Token exchange failed: {error_text}"
-                    )
-                
-                token = await response.json()
-            
-            # Verify and decode ID token if present
-            if 'id_token' in token:
-                # For now, we'll decode without verification (not recommended for production)
-                id_token_claims = jwt.get_unverified_claims(token['id_token'])
-                return {
-                    'access_token': token.get('access_token'),
-                    'id_token_claims': id_token_claims
-                }
-            
-            # If no ID token, fetch user info from userinfo endpoint
-            if 'userinfo_endpoint' in discovery_doc:
-                headers = {'Authorization': f"Bearer {token['access_token']}"}
-                async with session.get(discovery_doc['userinfo_endpoint'], headers=headers) as response:
-                    if response.status == 200:
-                        user_info = await response.json()
-                        return {
-                            'access_token': token.get('access_token'),
-                            'user_info': user_info
-                        }
-        
-        raise HTTPException(
-            status_code=400,
-            detail="Unable to retrieve user information from OIDC provider"
-        )
-        
-    except Exception as e:
-        raise HTTPException(
-            status_code=400,
-            detail=f"Error exchanging authorization code: {str(e)}"
-        )
-
-
-def create_oidc_user_session(user_data: Dict[str, Any]) -> Dict[str, str]:
-    """Create user session tokens after OIDC authentication"""
-    # Extract user identifier (email, sub, or preferred_username)
-    user_claims = user_data.get('id_token_claims', user_data.get('user_info', {}))
-    
-    user_id = (
-        user_claims.get('email') or 
-        user_claims.get('sub') or 
-        user_claims.get('preferred_username') or
-        'unknown_user'
-    )
-    
-    # Create JWT tokens with OIDC user info
-    access_token = create_token(
-        data={
-            "type": "access",
-            "oidc": True,
-            "user_id": user_id,
-            "user_info": user_claims
-        },
-        expires_delta=timedelta(minutes=Config.ACCESS_TOKEN_LIFETIME_MIN)
-    )
-    
-    refresh_token = create_token(
-        data={
-            "type": "refresh", 
-            "oidc": True,
-            "user_id": user_id
-        },
-        expires_delta=timedelta(minutes=Config.REFRESH_TOKEN_LIFETIME_MIN)
-    )
-    
-    return {
-        "access_token": access_token,
-        "refresh_token": refresh_token
-    }
diff --git a/backend/app/schemas/auth_schema.py b/backend/app/schemas/auth_schema.py
deleted file mode 100644
index 40c92e7..0000000
--- a/backend/app/schemas/auth_schema.py
+++ /dev/null
@@ -1,25 +0,0 @@
-from pydantic import BaseModel, field_validator
-from typing import Dict, Any, Optional
-from .validators import password_validator
-
-
-class PasswordSetRequestBody(BaseModel):
-    password: str
-    confirm_password: str
-
-    @field_validator("password", "confirm_password")
-    @classmethod
-    def validate_password(cls, v: str) -> str:
-        return password_validator(v)
-
-
-class OIDCConfigResponse(BaseModel):
-    enabled: bool
-    client_id: Optional[str] = None
-    redirect_uri: Optional[str] = None
-    scopes: Optional[str] = None
-
-
-class OIDCLoginResponse(BaseModel):
-    authorization_url: str
-    state: str
\ No newline at end of file
diff --git a/backend/app/schemas/settings_schema.py b/backend/app/schemas/settings_schema.py
deleted file mode 100644
index 28fde1b..0000000
--- a/backend/app/schemas/settings_schema.py
+++ /dev/null
@@ -1,33 +0,0 @@
-from pydantic import BaseModel, RootModel, model_validator
-from typing import Union, cast
-from datetime import datetime
-from app.enums.settings_enum import ESettingKey
-from .validators import (
-    validate_cron_expr, 
-    validate_timezone
-)
-
-
-class SettingsPatchRequestItem(BaseModel):
-    key: str
-    value: Union[bool, int, float, str]
-
-    @model_validator(mode="after")
-    def validate_setting(self):
-        if self.key == ESettingKey.CRONTAB_EXPR:
-            _ = validate_cron_expr(cast(str, self.value))
-            return self
-        elif self.key == ESettingKey.TIMEZONE:
-            _ = validate_timezone(cast(str, self.value))
-            return self
-        else:
-            return self
-
-
-class SettingsGetResponseItem(SettingsPatchRequestItem):
-    value_type: str
-    modified_at: datetime
-
-
-class TestNotificationRequestBody(BaseModel):
-    url: str
diff --git a/backend/app/schemas/validators.py b/backend/app/schemas/validators.py
deleted file mode 100644
index 825b187..0000000
--- a/backend/app/schemas/validators.py
+++ /dev/null
@@ -1,45 +0,0 @@
-import re
-from datetime import datetime
-from cronsim import CronSim, CronSimError
-from zoneinfo import available_timezones
-from urllib.parse import urlparse
-
-
-VALID_TIMEZONES = available_timezones()
-
-
-def password_validator(value: str) -> str:
-    """Validate password string"""
-    if not re.search(r"[A-Z]", value):
-        raise ValueError(
-            "The password must contain at least one uppercase letter."
-        )
-    if not re.search(r"[a-z]", value):
-        raise ValueError(
-            "The password must contain at least one lowercase letter."
-        )
-    if not re.search(r"\d", value):
-        raise ValueError(
-            "The password must contain at least one number."
-        )
-    return value
-
-
-def validate_cron_expr(expr: str) -> str:
-    """
-    Validate crontab expr.
-    Return valid or raises value error
-    """
-    try:
-        CronSim(expr, datetime.now())
-    except CronSimError as e:
-        raise ValueError(
-            f"Invalid cron expression: {expr}. Details: {e}"
-        )
-    return expr
-
-
-def validate_timezone(tz: str) -> str:
-    if tz in VALID_TIMEZONES:
-        return tz
-    raise ValueError(f"Invalid timezone: {tz}")
diff --git a/backend/core/__init__.py b/backend/core/__init__.py
index 84a4110..3e8666f 100644
--- a/backend/core/__init__.py
+++ b/backend/core/__init__.py
@@ -1,4 +1,3 @@
-from .auth_core import is_authorized
 from .hosts_manager import HostsManager, load_hosts_on_init
 from .cron_manager import CronManager, schedule_check_on_init
 from .container import *
diff --git a/backend/core/auth/__init__.py b/backend/core/auth/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/backend/core/auth/auth_oidc_provider.py b/backend/core/auth/auth_oidc_provider.py
new file mode 100644
index 0000000..1c6cefc
--- /dev/null
+++ b/backend/core/auth/auth_oidc_provider.py
@@ -0,0 +1,367 @@
+from datetime import timedelta
+import logging
+from jose import jwt
+from starlette.responses import RedirectResponse
+import secrets
+from typing import Any, Literal, cast
+from urllib.parse import urlencode
+import aiohttp
+from fastapi import HTTPException, Request, Response, status
+from fastapi.responses import RedirectResponse
+from backend.config import Config
+from backend.core.auth.auth_provider import AuthProvider
+
+
+class AuthOidcProvider(AuthProvider):
+    async def is_enabled(self) -> bool:
+        return Config.OIDC_ENABLED
+
+    async def login(
+        self, request: Request, response: Response
+    ) -> RedirectResponse:
+        if not self.is_enabled():
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="OIDC authentication is not enabled",
+            )
+
+        config = self._get_oidc_config()
+
+        if not all(
+            [
+                config["well_known_url"],
+                config["client_id"],
+                config["redirect_uri"],
+            ]
+        ):
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="OIDC configuration is incomplete",
+            )
+
+        # Generate state parameter for CSRF protection
+        state = secrets.token_urlsafe(32)
+
+        # Store state in session/cookie for verification later
+        # For simplicity, we'll use a cookie (in production, consider using a database)
+
+        try:
+            discovery_doc = await self._fetch_oidc_discovery(
+                config["well_known_url"]
+            )
+            authorization_url = self._create_oidc_authorization_url(
+                discovery_doc, config, state
+            )
+
+            response = RedirectResponse(
+                url=authorization_url,
+                status_code=status.HTTP_302_FOUND,
+            )
+            response.set_cookie(
+                key="oidc_state",
+                value=state,
+                httponly=True,
+                samesite="lax",  # Changed from strict to lax for cross-origin redirects
+                secure=Config.HTTPS,
+                max_age=300,  # 5 minutes
+            )
+            return response
+
+        except Exception as e:
+            raise HTTPException(
+                status_code=400,
+                detail=f"Error initiating OIDC login: {str(e)}",
+            )
+
+    async def logout(self, request: Request, response: Response):
+        # TODO add oidc logout call
+        response.delete_cookie("access_token")
+        response.delete_cookie("refresh_token")
+        response.status_code = status.HTTP_200_OK
+        return response
+
+    async def refresh(
+        self, request: Request, response: Response
+    ) -> Any:
+        raise NotImplementedError()
+
+    async def is_authorized(self, request: Request):
+        # TODO add oidc check call
+        token = request.cookies.get("access_token")
+        if not token:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Unauthorized",
+            )
+        res = self._verify_token(token)
+        return cast(Literal[True], bool(res))
+
+    async def oidc_callback(
+        self,
+        request: Request,
+        response: Response,
+        code: str | None = None,
+        state: str | None = None,
+        error: str | None = None,
+    ):
+        if error:
+            raise HTTPException(
+                status_code=400,
+                detail=f"OIDC authentication error: {error}",
+            )
+
+        if not code or not state:
+            raise HTTPException(
+                status_code=400,
+                detail="Missing authorization code or state parameter",
+            )
+
+        # Verify state parameter
+        stored_state = request.cookies.get("oidc_state")
+        logging.debug(
+            f"OIDC Callback - Received state: {state}, Stored state: {stored_state}"
+        )
+        logging.debug(
+            f"OIDC Callback - All cookies: {dict(request.cookies)}"
+        )
+        if not stored_state or stored_state != state:
+            raise HTTPException(
+                status_code=400,
+                detail=f"Invalid state parameter - received: {state}, stored: {stored_state}",
+            )
+
+        config = self._get_oidc_config()
+
+        try:
+            logging.debug(
+                f"OIDC Callback - Code: {code}, State: {state}"
+            )
+            discovery_doc = await self._fetch_oidc_discovery(
+                config["well_known_url"]
+            )
+            logging.debug(f"OIDC Discovery successful")
+            user_data = await self._exchange_oidc_code(
+                code, state, discovery_doc, config
+            )
+            logging.debug(
+                f"OIDC Token exchange successful: {user_data}"
+            )  # Debug print
+            tokens = self._create_oidc_user_session(user_data)
+            logging.debug(f"OIDC Session created")
+
+            # Create response for redirect
+            response = RedirectResponse(
+                url="/containers", status_code=status.HTTP_302_FOUND
+            )
+
+            # Set authentication cookies
+            response.set_cookie(
+                key="access_token",
+                value=tokens["access_token"],
+                httponly=True,
+                samesite="strict",
+                secure=Config.HTTPS,
+                domain=Config.DOMAIN if Config.DOMAIN else None,
+                max_age=Config.ACCESS_TOKEN_LIFETIME_MIN * 60,
+            )
+            response.set_cookie(
+                key="refresh_token",
+                value=tokens["refresh_token"],
+                httponly=True,
+                samesite="strict",
+                secure=Config.HTTPS,
+                domain=Config.DOMAIN if Config.DOMAIN else None,
+                max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
+            )
+
+            # Clear the state cookie
+            response.delete_cookie("oidc_state")
+
+            return response
+
+        except Exception as e:
+            raise HTTPException(
+                status_code=400,
+                detail=f"Error processing OIDC callback: {str(e)}",
+            )
+
+    def _get_oidc_config(self) -> dict[str, str]:
+        """Get OIDC configuration from settings"""
+        return {
+            "well_known_url": Config.OIDC_WELL_KNOWN_URL,
+            "client_id": Config.OIDC_CLIENT_ID,
+            "client_secret": Config.OIDC_CLIENT_SECRET,
+            "redirect_uri": Config.OIDC_REDIRECT_URI,
+            "scopes": Config.OIDC_SCOPES,
+        }
+
+    async def _fetch_oidc_discovery(
+        self, well_known_url: str
+    ) -> dict[str, Any]:
+        """Fetch OIDC discovery document from well-known URL"""
+        try:
+            async with aiohttp.ClientSession() as session:
+                async with session.get(well_known_url) as response:
+                    if response.status == 200:
+                        return await response.json()
+                    else:
+                        raise HTTPException(
+                            status_code=status.HTTP_400_BAD_REQUEST,
+                            detail=f"Failed to fetch OIDC discovery document: {response.status}",
+                        )
+        except aiohttp.ClientError as e:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=f"Error fetching OIDC discovery document: {str(e)}",
+            )
+
+    def _create_oidc_authorization_url(
+        self,
+        discovery_doc: dict[str, Any],
+        config: dict[str, str],
+        state: str,
+    ) -> str:
+        """Create OIDC authorization URL"""
+        try:
+            # Manually build the authorization URL
+            auth_endpoint = discovery_doc["authorization_endpoint"]
+            scopes = " ".join(config["scopes"])
+
+            params = {
+                "client_id": config["client_id"],
+                "redirect_uri": config["redirect_uri"],
+                "scope": scopes,
+                "response_type": "code",
+                "state": state,
+            }
+
+            # Build query string
+            query_string = urlencode(params)
+            authorization_url = f"{auth_endpoint}?{query_string}"
+
+            return authorization_url
+        except Exception as e:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=f"Error creating authorization URL: {str(e)}",
+            )
+
+    async def _exchange_oidc_code(
+        self,
+        code: str,
+        state: str,
+        discovery_doc: dict[str, Any],
+        config: dict[str, str],
+    ) -> dict[str, Any]:
+        """Exchange authorization code for tokens"""
+        try:
+            # Prepare token exchange request
+            token_endpoint = discovery_doc["token_endpoint"]
+
+            data = {
+                "grant_type": "authorization_code",
+                "code": code,
+                "redirect_uri": config["redirect_uri"],
+                "client_id": config["client_id"],
+                "client_secret": config["client_secret"],
+            }
+
+            # Exchange code for token
+            async with aiohttp.ClientSession() as session:
+                async with session.post(
+                    token_endpoint, data=data
+                ) as response:
+                    if response.status != 200:
+                        error_text = await response.text()
+                        raise HTTPException(
+                            status_code=400,
+                            detail=f"Token exchange failed: {error_text}",
+                        )
+
+                    token = await response.json()
+
+                # Verify and decode ID token if present
+                if "id_token" in token:
+                    # For now, we'll decode without verification (not recommended for production)
+                    id_token_claims = jwt.get_unverified_claims(
+                        token["id_token"]
+                    )
+                    return {
+                        "access_token": token.get("access_token"),
+                        "id_token_claims": id_token_claims,
+                    }
+
+                # If no ID token, fetch user info from userinfo endpoint
+                if "userinfo_endpoint" in discovery_doc:
+                    headers = {
+                        "Authorization": f"Bearer {token['access_token']}"
+                    }
+                    async with session.get(
+                        discovery_doc["userinfo_endpoint"],
+                        headers=headers,
+                    ) as response:
+                        if response.status == 200:
+                            user_info = await response.json()
+                            return {
+                                "access_token": token.get(
+                                    "access_token"
+                                ),
+                                "user_info": user_info,
+                            }
+
+            raise HTTPException(
+                status_code=400,
+                detail="Unable to retrieve user information from OIDC provider",
+            )
+
+        except Exception as e:
+            raise HTTPException(
+                status_code=400,
+                detail=f"Error exchanging authorization code: {str(e)}",
+            )
+
+    def _create_oidc_user_session(
+        self,
+        user_data: dict[str, Any],
+    ) -> dict[str, str]:
+        """Create user session tokens after OIDC authentication"""
+        # Extract user identifier (email, sub, or preferred_username)
+        user_claims = user_data.get(
+            "id_token_claims", user_data.get("user_info", {})
+        )
+
+        user_id = (
+            user_claims.get("email")
+            or user_claims.get("sub")
+            or user_claims.get("preferred_username")
+            or "unknown_user"
+        )
+
+        # Create JWT tokens with OIDC user info
+        access_token = self._create_token(
+            data={
+                "type": "access",
+                "oidc": True,
+                "user_id": user_id,
+                "user_info": user_claims,
+            },
+            expires_delta=timedelta(
+                minutes=Config.ACCESS_TOKEN_LIFETIME_MIN
+            ),
+        )
+
+        refresh_token = self._create_token(
+            data={
+                "type": "refresh",
+                "oidc": True,
+                "user_id": user_id,
+            },
+            expires_delta=timedelta(
+                minutes=Config.REFRESH_TOKEN_LIFETIME_MIN
+            ),
+        )
+
+        return {
+            "access_token": access_token,
+            "refresh_token": refresh_token,
+        }
diff --git a/backend/core/auth/auth_password_provider.py b/backend/core/auth/auth_password_provider.py
new file mode 100644
index 0000000..c3ec057
--- /dev/null
+++ b/backend/core/auth/auth_password_provider.py
@@ -0,0 +1,188 @@
+from datetime import timedelta, datetime
+from typing import Any, Literal, cast
+from fastapi import HTTPException, Request, Response, status
+from fastapi.responses import PlainTextResponse
+
+from backend.schemas.auth_schema import PasswordSetRequestBody
+from .auth_provider import AuthProvider
+from backend.config import Config
+import bcrypt
+import os
+from jose import jwt, JWTError
+from backend.helpers.now import now
+
+
+class AuthPasswordProvider(AuthProvider):
+    async def is_enabled(self):
+        return not Config.OIDC_ENABLED
+
+    async def login(self, request: Request, response: Response):
+        password = request.query_params.get("password", "")
+
+        STORED_PASSWORD_HASH: str | None = self._read_password_hash()
+
+        if not STORED_PASSWORD_HASH:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Password not set",
+            )
+
+        if not self._verify_password(password, STORED_PASSWORD_HASH):
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Invalid password",
+            )
+
+        access_token: str = self._create_token(
+            data={"type": "access"},
+            expires_delta=timedelta(
+                minutes=Config.ACCESS_TOKEN_LIFETIME_MIN
+            ),
+        )
+        refresh_token: str = self._create_token(
+            data={"type": "refresh"},
+            expires_delta=timedelta(
+                minutes=Config.REFRESH_TOKEN_LIFETIME_MIN
+            ),
+        )
+        response.set_cookie(
+            key="access_token",
+            value=access_token,
+            httponly=True,
+            samesite="strict",
+            secure=Config.HTTPS,
+            domain=Config.DOMAIN,
+            max_age=Config.ACCESS_TOKEN_LIFETIME_MIN * 60,
+        )
+        response.set_cookie(
+            key="refresh_token",
+            value=refresh_token,
+            httponly=True,
+            samesite="strict",
+            secure=Config.HTTPS,
+            domain=Config.DOMAIN,
+            max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
+        )
+        response.status_code = status.HTTP_200_OK
+        return response
+
+    async def logout(self, request: Request, response: Response):
+        response.delete_cookie("access_token")
+        response.delete_cookie("refresh_token")
+        response.status_code = status.HTTP_200_OK
+        return response
+
+    async def refresh(self, request: Request, response: Response):
+        refresh_token: str | None = request.cookies.get(
+            "refresh_token"
+        )
+        if not refresh_token:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Missing refresh token",
+            )
+
+        payload: dict[str, Any] = self._verify_token(refresh_token)
+        if payload.get("type") != "refresh":
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Invalid refresh token",
+            )
+
+        new_access_token: str = self._create_token(
+            data={"type": "access"},
+            expires_delta=timedelta(
+                minutes=Config.ACCESS_TOKEN_LIFETIME_MIN
+            ),
+        )
+        new_refresh_token: str = self._create_token(
+            data={"type": "refresh"},
+            expires_delta=timedelta(
+                minutes=Config.REFRESH_TOKEN_LIFETIME_MIN
+            ),
+        )
+        response.set_cookie(
+            key="access_token",
+            value=new_access_token,
+            httponly=True,
+            samesite="strict",
+            secure=Config.HTTPS,
+            domain=Config.DOMAIN,
+            max_age=Config.ACCESS_TOKEN_LIFETIME_MIN * 60,
+        )
+        response.set_cookie(
+            key="refresh_token",
+            value=new_refresh_token,
+            httponly=True,
+            samesite="strict",
+            secure=Config.HTTPS,
+            domain=Config.DOMAIN,
+            max_age=Config.REFRESH_TOKEN_LIFETIME_MIN * 60,
+        )
+        response.status_code = status.HTTP_200_OK
+        return response
+
+    async def is_authorized(self, request: Request):
+        token = request.cookies.get("access_token")
+        if not token:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Unauthorized",
+            )
+        res = self._verify_token(token)
+        return cast(Literal[True], bool(res))
+
+    def set_password(self, request: Request, payload: PasswordSetRequestBody):
+        """
+        Set new password if there is no password yet or if user authorized.
+        """
+        def write_and_return():
+            password_hash: str = self._get_password_hash(payload.password)
+            self._write_password_hash(password_hash)
+            return PlainTextResponse(status_code=status.HTTP_201_CREATED)
+
+        if not self._read_password_hash():
+            return write_and_return()
+
+        _ = self.is_authorized(request)
+        write_and_return()
+
+    def is_password_set(self)->bool:
+        """Check if a password is set"""
+        password_hash: str | None = self._read_password_hash()
+        return password_hash not in [None, ""]
+
+    def _verify_password(self, plain: str, hashed: str) -> bool:
+        """
+        Compare plain text password with hashed password
+        """
+        plain_bytes: bytes = plain.encode("utf-8")
+        hashed_bytes: bytes = hashed.encode("utf-8")
+        return bcrypt.checkpw(plain_bytes, hashed_bytes)
+
+    def _get_password_hash(self, password: str) -> str:
+        """Hash password"""
+        pwd_bytes: bytes = password.encode("utf-8")
+        salt: bytes = bcrypt.gensalt()
+        hashed_password: bytes = bcrypt.hashpw(
+            password=pwd_bytes, salt=salt
+        )
+        return hashed_password.decode("utf-8")
+
+    def _read_password_hash(self) -> str | None:
+        """
+        Read password hash from file
+        """
+        if not os.path.isfile(Config.PASSWORD_FILE):
+            return None
+        with open(Config.PASSWORD_FILE, "r") as f:
+            return f.read()
+
+    def _write_password_hash(self, password_hash: str) -> None:
+        """
+        Write password hash to file
+        """
+        with open(Config.PASSWORD_FILE, "w") as f:
+            _ = f.write(password_hash)
+            f.flush()
+            f.close()
diff --git a/backend/core/auth/auth_provider.py b/backend/core/auth/auth_provider.py
new file mode 100644
index 0000000..5f23e9f
--- /dev/null
+++ b/backend/core/auth/auth_provider.py
@@ -0,0 +1,73 @@
+from abc import ABC, abstractmethod
+from datetime import timedelta, datetime
+from typing import Any, Literal
+from fastapi import HTTPException, Request, Response, status
+from jose import JWTError, jwt
+from backend.config import Config
+from backend.helpers.now import now
+
+
+class AuthProvider(ABC):
+    @abstractmethod
+    async def is_enabled(self) -> bool:
+        """Whether provider enabled"""
+        pass
+
+    @abstractmethod
+    async def login(
+        self, request: Request, response: Response
+    ) -> Any:
+        """Login with provider"""
+        pass
+
+    @abstractmethod
+    async def logout(
+        self, request: Request, response: Response
+    ) -> Any:
+        """Logout with provider"""
+        pass
+
+    @abstractmethod
+    async def refresh(
+        self, request: Request, response: Response
+    ) -> Any:
+        """Refresh tokens with provider"""
+        pass
+
+    @abstractmethod
+    async def is_authorized(self, request: Request) -> Literal[True]:
+        """Whether user is authorized. Should raise 401 if not."""
+        pass
+
+    def _create_token(
+        self, data: dict[str, Any], expires_delta: timedelta
+    ) -> str:
+        """
+        Create access or refresh token
+        """
+        to_encode: dict[str, Any] = data.copy()
+        expire: datetime = now() + expires_delta
+        to_encode.update({"exp": expire})
+        return jwt.encode(
+            claims=to_encode,
+            key=Config.JWT_SECRET_KEY,
+            algorithm=Config.JWT_ALGORITHM,
+        )
+
+    def _verify_token(self, token: str) -> dict:
+        """
+        Verify token validity and return its payload.
+        Raise 401 error if not valid.
+        """
+        try:
+            payload: dict[str, Any] = jwt.decode(
+                token,
+                key=Config.JWT_SECRET_KEY,
+                algorithms=[Config.JWT_ALGORITHM],
+            )
+            return payload
+        except JWTError:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Token is invalid or expired",
+            )
diff --git a/backend/core/auth/auth_provider_chore.py b/backend/core/auth/auth_provider_chore.py
new file mode 100644
index 0000000..a5c6df7
--- /dev/null
+++ b/backend/core/auth/auth_provider_chore.py
@@ -0,0 +1,32 @@
+from fastapi import HTTPException, Request, status
+from backend.core.auth.auth_oidc_provider import AuthOidcProvider
+from backend.core.auth.auth_password_provider import (
+    AuthPasswordProvider,
+)
+from backend.core.auth.auth_provider import AuthProvider
+
+
+AUTH_PASSWORD_PROVIDER = AuthPasswordProvider()
+AUTH_OIDC_PROVIDER = AuthOidcProvider()
+AUTH_PROVIDERS: list[AuthProvider] = [
+    AUTH_PASSWORD_PROVIDER,
+    AUTH_OIDC_PROVIDER,
+]
+
+
+async def is_authorized(request: Request):
+    """
+    Dependency func that checks all enabled auth providers state.
+    Raises 401 if none is authorized.
+    """
+    for p in AUTH_PROVIDERS:
+        try:
+            if await p.is_enabled():
+                _ = await p.is_authorized(request)
+                return True
+        except:
+            pass
+    raise HTTPException(
+        status_code=status.HTTP_401_UNAUTHORIZED,
+        detail="Unauthorized",
+    )
diff --git a/backend/core/auth_core.py b/backend/core/auth_core.py
deleted file mode 100644
index 950972a..0000000
--- a/backend/core/auth_core.py
+++ /dev/null
@@ -1,272 +0,0 @@
-from typing import Any, Dict
-from datetime import datetime, timedelta
-from fastapi import HTTPException, Request
-from jose import jwt, JWTError
-import bcrypt
-import os
-import aiohttp
-from urllib.parse import urlencode
-from backend.config import Config
-from backend.helpers.now import now
-
-
-def verify_password(plain: str, hashed: str) -> bool:
-    """
-    Compare plain text password with hashed password
-    """
-    plain_bytes: bytes = plain.encode("utf-8")
-    hashed_bytes: bytes = hashed.encode("utf-8")
-    return bcrypt.checkpw(plain_bytes, hashed_bytes)
-
-
-def get_password_hash(password: str) -> str:
-    """Hash password"""
-    pwd_bytes: bytes = password.encode("utf-8")
-    salt: bytes = bcrypt.gensalt()
-    hashed_password: bytes = bcrypt.hashpw(
-        password=pwd_bytes, salt=salt
-    )
-    return hashed_password.decode("utf-8")
-
-
-def verify_token(token: str) -> dict:
-    """
-    Verify token validity and return its payload.
-    Raise 401 error if not valid.
-    """
-    try:
-        payload: dict[str, Any] = jwt.decode(
-            token,
-            key=Config.JWT_SECRET_KEY,
-            algorithms=[Config.JWT_ALGORITHM],
-        )
-        return payload
-    except JWTError:
-        raise HTTPException(
-            status_code=401, detail="Token is invalid or expired"
-        )
-
-
-def create_token(
-    data: dict[str, Any], expires_delta: timedelta
-) -> str:
-    """
-    Create access or refresh token
-    """
-    to_encode: dict[str, Any] = data.copy()
-    expire: datetime = now() + expires_delta
-    to_encode.update({"exp": expire})
-    return jwt.encode(
-        claims=to_encode,
-        key=Config.JWT_SECRET_KEY,
-        algorithm=Config.JWT_ALGORITHM,
-    )
-
-
-def is_authorized(request: Request) -> dict[str, Any]:
-    """
-    Check for valid token in cookies.
-    Raise 401 if there is no token or token is invalid.
-    """
-    token = request.cookies.get("access_token")
-    if not token:
-        raise HTTPException(status_code=401, detail="Unauthorized")
-    return verify_token(token)
-
-
-def read_password_hash() -> str | None:
-    """
-    Read password hash from file
-    """
-    if not os.path.isfile(Config.PASSWORD_FILE):
-        return None
-    with open(Config.PASSWORD_FILE, "r") as f:
-        return f.read()
-
-
-def write_password_hash(password_hash: str) -> None:
-    """
-    Write password hash to file
-    """
-    with open(Config.PASSWORD_FILE, "w") as f:
-        _ = f.write(password_hash)
-        f.flush()
-        f.close()
-
-
-def is_oidc_enabled() -> bool:
-    """Check if OIDC authentication is enabled"""
-    return Config.OIDC_ENABLED
-
-
-def get_oidc_config() -> Dict[str, str]:
-    """Get OIDC configuration from settings"""
-    return {
-        "well_known_url": Config.OIDC_WELL_KNOWN_URL,
-        "client_id": Config.OIDC_CLIENT_ID,
-        "client_secret": Config.OIDC_CLIENT_SECRET,
-        "redirect_uri": Config.OIDC_REDIRECT_URI,
-        "scopes": Config.OIDC_SCOPES,
-    }
-
-
-async def fetch_oidc_discovery(well_known_url: str) -> Dict[str, Any]:
-    """Fetch OIDC discovery document from well-known URL"""
-    try:
-        async with aiohttp.ClientSession() as session:
-            async with session.get(well_known_url) as response:
-                if response.status == 200:
-                    return await response.json()
-                else:
-                    raise HTTPException(
-                        status_code=400,
-                        detail=f"Failed to fetch OIDC discovery document: {response.status}",
-                    )
-    except aiohttp.ClientError as e:
-        raise HTTPException(
-            status_code=400,
-            detail=f"Error fetching OIDC discovery document: {str(e)}",
-        )
-
-
-def create_oidc_authorization_url(
-    discovery_doc: Dict[str, Any], config: Dict[str, str], state: str
-) -> str:
-    """Create OIDC authorization URL"""
-    try:
-        # Manually build the authorization URL
-        auth_endpoint = discovery_doc["authorization_endpoint"]
-        scopes = " ".join(config["scopes"])
-
-        params = {
-            "client_id": config["client_id"],
-            "redirect_uri": config["redirect_uri"],
-            "scope": scopes,
-            "response_type": "code",
-            "state": state,
-        }
-
-        # Build query string
-        query_string = urlencode(params)
-        authorization_url = f"{auth_endpoint}?{query_string}"
-
-        return authorization_url
-    except Exception as e:
-        raise HTTPException(
-            status_code=400,
-            detail=f"Error creating authorization URL: {str(e)}",
-        )
-
-
-async def exchange_oidc_code(
-    code: str,
-    state: str,
-    discovery_doc: Dict[str, Any],
-    config: Dict[str, str],
-) -> Dict[str, Any]:
-    """Exchange authorization code for tokens"""
-    try:
-        # Prepare token exchange request
-        token_endpoint = discovery_doc["token_endpoint"]
-
-        data = {
-            "grant_type": "authorization_code",
-            "code": code,
-            "redirect_uri": config["redirect_uri"],
-            "client_id": config["client_id"],
-            "client_secret": config["client_secret"],
-        }
-
-        # Exchange code for token
-        async with aiohttp.ClientSession() as session:
-            async with session.post(
-                token_endpoint, data=data
-            ) as response:
-                if response.status != 200:
-                    error_text = await response.text()
-                    raise HTTPException(
-                        status_code=400,
-                        detail=f"Token exchange failed: {error_text}",
-                    )
-
-                token = await response.json()
-
-            # Verify and decode ID token if present
-            if "id_token" in token:
-                # For now, we'll decode without verification (not recommended for production)
-                id_token_claims = jwt.get_unverified_claims(
-                    token["id_token"]
-                )
-                return {
-                    "access_token": token.get("access_token"),
-                    "id_token_claims": id_token_claims,
-                }
-
-            # If no ID token, fetch user info from userinfo endpoint
-            if "userinfo_endpoint" in discovery_doc:
-                headers = {
-                    "Authorization": f"Bearer {token['access_token']}"
-                }
-                async with session.get(
-                    discovery_doc["userinfo_endpoint"],
-                    headers=headers,
-                ) as response:
-                    if response.status == 200:
-                        user_info = await response.json()
-                        return {
-                            "access_token": token.get("access_token"),
-                            "user_info": user_info,
-                        }
-
-        raise HTTPException(
-            status_code=400,
-            detail="Unable to retrieve user information from OIDC provider",
-        )
-
-    except Exception as e:
-        raise HTTPException(
-            status_code=400,
-            detail=f"Error exchanging authorization code: {str(e)}",
-        )
-
-
-def create_oidc_user_session(
-    user_data: Dict[str, Any],
-) -> Dict[str, str]:
-    """Create user session tokens after OIDC authentication"""
-    # Extract user identifier (email, sub, or preferred_username)
-    user_claims = user_data.get(
-        "id_token_claims", user_data.get("user_info", {})
-    )
-
-    user_id = (
-        user_claims.get("email")
-        or user_claims.get("sub")
-        or user_claims.get("preferred_username")
-        or "unknown_user"
-    )
-
-    # Create JWT tokens with OIDC user info
-    access_token = create_token(
-        data={
-            "type": "access",
-            "oidc": True,
-            "user_id": user_id,
-            "user_info": user_claims,
-        },
-        expires_delta=timedelta(
-            minutes=Config.ACCESS_TOKEN_LIFETIME_MIN
-        ),
-    )
-
-    refresh_token = create_token(
-        data={"type": "refresh", "oidc": True, "user_id": user_id},
-        expires_delta=timedelta(
-            minutes=Config.REFRESH_TOKEN_LIFETIME_MIN
-        ),
-    )
-
-    return {
-        "access_token": access_token,
-        "refresh_token": refresh_token,
-    }
diff --git a/frontend/src/app/entities/auth/auth-api.service.ts b/frontend/src/app/entities/auth/auth-api.service.ts
index 472d8df..0ab527b 100644
--- a/frontend/src/app/entities/auth/auth-api.service.ts
+++ b/frontend/src/app/entities/auth/auth-api.service.ts
@@ -47,8 +47,4 @@ export class AuthApiService extends BaseApiService<'/auth'> {
     // This will redirect to the OIDC provider, so we don't expect a JSON response
     window.location.href = `${this.basePath}/oidc/login`;
   }
-
-  getUserInfo(): Observable<any> {
-    return this.httpClient.get(`${this.basePath}/user/info`, { withCredentials: true });
-  }
 }

From 63f27c90abeffb5ee9921ac62589d276a3f515df Mon Sep 17 00:00:00 2001
From: Quenary <evgeny.savin.nord@gmail.com>
Date: Thu, 6 Nov 2025 01:32:14 +0300
Subject: [PATCH 37/40] refactor: auth api

+ added more universal endpoints
+ added exception for no auth provider enabled
---
 backend/api/auth_api.py                       | 83 ++++++++++--------
 backend/core/auth/auth_oidc_provider.py       | 22 +++--
 backend/core/auth/auth_password_provider.py   | 28 +++++--
 backend/core/auth/auth_provider.py            |  7 ++
 backend/core/auth/auth_provider_chore.py      | 35 ++++----
 backend/exception.py                          | 12 ++-
 .../src/app/entities/auth/auth-api.service.ts | 42 ++++++----
 .../src/app/entities/auth/auth-interface.ts   |  8 +-
 .../src/app/features/auth-page/auth-page.html | 43 +++++-----
 .../src/app/features/auth-page/auth-page.scss | 41 +--------
 .../src/app/features/auth-page/auth-page.ts   | 84 ++++++++++---------
 11 files changed, 217 insertions(+), 188 deletions(-)

diff --git a/backend/api/auth_api.py b/backend/api/auth_api.py
index 6c6e530..8dab64a 100644
--- a/backend/api/auth_api.py
+++ b/backend/api/auth_api.py
@@ -5,12 +5,15 @@
     Request,
     status,
 )
-from fastapi.responses import PlainTextResponse
+from fastapi.responses import PlainTextResponse, RedirectResponse
+from backend.core.auth.auth_provider import AuthProvider
 from backend.core.auth.auth_provider_chore import (
     AUTH_OIDC_PROVIDER,
     AUTH_PASSWORD_PROVIDER,
-    is_authorized,
+    AUTH_PROVIDERS,
+    active_auth_provider,
 )
+from backend.exception import TugNoAuthProviderException
 from backend.helpers.delay_to_minimum import delay_to_minimum
 from backend.schemas.auth_schema import PasswordSetRequestBody
 
@@ -18,24 +21,44 @@
 router: APIRouter = APIRouter(prefix="/auth", tags=["auth"])
 
 
-# For now endpoints are tied to a specific provider
-# Maybe they should be more universal
+@router.get(
+    path="/{provider}/enabled",
+    description="Check if auth provider is enabled",
+    response_model=bool,
+)
+async def is_provider_enabled(provider: str) -> bool:
+    _provider = AUTH_PROVIDERS.get(provider, None)
+    if not _provider:
+        raise TugNoAuthProviderException()
+    return await _provider.is_enabled()
 
 
 @router.post(path="/login")
 @delay_to_minimum(1)
-async def login(request: Request, response: Response):
-    return await AUTH_PASSWORD_PROVIDER.login(request, response)
+async def login(
+    request: Request,
+    response: Response,
+    provider: AuthProvider = Depends(active_auth_provider),
+):
+    return await provider.login(request, response)
 
 
 @router.post(path="/refresh")
-async def refresh(request: Request, response: Response):
-    return await AUTH_PASSWORD_PROVIDER.refresh(request, response)
+async def refresh(
+    request: Request,
+    response: Response,
+    provider: AuthProvider = Depends(active_auth_provider),
+):
+    return await provider.refresh(request, response)
 
 
 @router.post(path="/logout")
-async def logout(request: Request, response: Response):
-    return await AUTH_PASSWORD_PROVIDER.logout(request, response)
+async def logout(
+    request: Request,
+    response: Response,
+    provider: AuthProvider = Depends(active_auth_provider),
+):
+    return await provider.logout(request, response)
 
 
 @router.get(
@@ -43,7 +66,11 @@ async def logout(request: Request, response: Response):
     description="Check if session is authorized",
     response_model=bool,
 )
-def is_authorized_req(_=Depends(is_authorized)):
+def is_authorized_req(
+    request: Request,
+    provider: AuthProvider = Depends(active_auth_provider),
+):
+    _ = provider.is_authorized(request)
     return PlainTextResponse(status_code=status.HTTP_200_OK)
 
 
@@ -65,33 +92,23 @@ def is_password_set() -> bool:
 
 
 @router.get(
-    path="/oidc/enabled",
-    description="Check if OIDC authentication is enabled",
-    response_model=bool,
-)
-async def oidc_enabled() -> bool:
-    return await AUTH_OIDC_PROVIDER.is_enabled()
-
-
-@router.get(
-    path="/oidc/login",
-    description="Initiate OIDC login flow",
+    path="/{provider}/login", description="Login with provider"
 )
-async def oidc_login(request: Request, response: Response):
-    return await AUTH_OIDC_PROVIDER.login(request, response)
+async def provider_login(
+    request: Request,
+    response: Response,
+    provider: AuthProvider = Depends(active_auth_provider),
+) -> RedirectResponse:
+    return await provider.login(request, response)
 
 
 @router.get(
-    path="/oidc/callback",
-    description="Handle OIDC callback",
+    path="/{provider}/callback",
+    description="Auth provider callback endpoint",
 )
-async def oidc_callback(
+async def provider_callback(
     request: Request,
     response: Response,
-    code: str | None = None,
-    state: str | None = None,
-    error: str | None = None,
+    provider: AuthProvider = Depends(active_auth_provider),
 ):
-    return await AUTH_OIDC_PROVIDER.oidc_callback(
-        request, response, code, state, error
-    )
+    return await provider.callback(request, response)
diff --git a/backend/core/auth/auth_oidc_provider.py b/backend/core/auth/auth_oidc_provider.py
index 1c6cefc..7bbf7d3 100644
--- a/backend/core/auth/auth_oidc_provider.py
+++ b/backend/core/auth/auth_oidc_provider.py
@@ -1,7 +1,7 @@
 from datetime import timedelta
 import logging
 from jose import jwt
-from starlette.responses import RedirectResponse
+from starlette.responses import RedirectResponse, Response
 import secrets
 from typing import Any, Literal, cast
 from urllib.parse import urlencode
@@ -73,8 +73,10 @@ async def login(
                 detail=f"Error initiating OIDC login: {str(e)}",
             )
 
-    async def logout(self, request: Request, response: Response):
-        # TODO add oidc logout call
+    async def logout(
+        self, request: Request, response: Response
+    ) -> Response:
+        # TODO add logout call
         response.delete_cookie("access_token")
         response.delete_cookie("refresh_token")
         response.status_code = status.HTTP_200_OK
@@ -83,10 +85,11 @@ async def logout(self, request: Request, response: Response):
     async def refresh(
         self, request: Request, response: Response
     ) -> Any:
+        # TODO add refresh call
         raise NotImplementedError()
 
     async def is_authorized(self, request: Request):
-        # TODO add oidc check call
+        # TODO add check call
         token = request.cookies.get("access_token")
         if not token:
             raise HTTPException(
@@ -96,14 +99,15 @@ async def is_authorized(self, request: Request):
         res = self._verify_token(token)
         return cast(Literal[True], bool(res))
 
-    async def oidc_callback(
+    async def callback(
         self,
         request: Request,
         response: Response,
-        code: str | None = None,
-        state: str | None = None,
-        error: str | None = None,
-    ):
+    ) -> RedirectResponse:
+        code = request.query_params.get("code", "")
+        state = request.query_params.get("state", "")
+        error = request.query_params.get("error", "")
+
         if error:
             raise HTTPException(
                 status_code=400,
diff --git a/backend/core/auth/auth_password_provider.py b/backend/core/auth/auth_password_provider.py
index c3ec057..521a1b5 100644
--- a/backend/core/auth/auth_password_provider.py
+++ b/backend/core/auth/auth_password_provider.py
@@ -1,19 +1,19 @@
-from datetime import timedelta, datetime
+from datetime import timedelta
 from typing import Any, Literal, cast
 from fastapi import HTTPException, Request, Response, status
 from fastapi.responses import PlainTextResponse
-
 from backend.schemas.auth_schema import PasswordSetRequestBody
 from .auth_provider import AuthProvider
 from backend.config import Config
 import bcrypt
 import os
-from jose import jwt, JWTError
-from backend.helpers.now import now
 
 
 class AuthPasswordProvider(AuthProvider):
     async def is_enabled(self):
+        # For now OIDC replaces password auth
+        # But maybe it worth have an option to enable both
+        # (or several if another provider is added)
         return not Config.OIDC_ENABLED
 
     async def login(self, request: Request, response: Response):
@@ -132,14 +132,26 @@ async def is_authorized(self, request: Request):
         res = self._verify_token(token)
         return cast(Literal[True], bool(res))
 
-    def set_password(self, request: Request, payload: PasswordSetRequestBody):
+    async def callback(
+        self, request: Request, response: Response
+    ) -> Any:
+        raise NotImplementedError()
+
+    def set_password(
+        self, request: Request, payload: PasswordSetRequestBody
+    ):
         """
         Set new password if there is no password yet or if user authorized.
         """
+
         def write_and_return():
-            password_hash: str = self._get_password_hash(payload.password)
+            password_hash: str = self._get_password_hash(
+                payload.password
+            )
             self._write_password_hash(password_hash)
-            return PlainTextResponse(status_code=status.HTTP_201_CREATED)
+            return PlainTextResponse(
+                status_code=status.HTTP_201_CREATED
+            )
 
         if not self._read_password_hash():
             return write_and_return()
@@ -147,7 +159,7 @@ def write_and_return():
         _ = self.is_authorized(request)
         write_and_return()
 
-    def is_password_set(self)->bool:
+    def is_password_set(self) -> bool:
         """Check if a password is set"""
         password_hash: str | None = self._read_password_hash()
         return password_hash not in [None, ""]
diff --git a/backend/core/auth/auth_provider.py b/backend/core/auth/auth_provider.py
index 5f23e9f..4a2039a 100644
--- a/backend/core/auth/auth_provider.py
+++ b/backend/core/auth/auth_provider.py
@@ -39,6 +39,13 @@ async def is_authorized(self, request: Request) -> Literal[True]:
         """Whether user is authorized. Should raise 401 if not."""
         pass
 
+    @abstractmethod
+    async def callback(
+        self, request: Request, response: Response
+    ) -> Any:
+        """Provider callback endpoint handler"""
+        pass
+
     def _create_token(
         self, data: dict[str, Any], expires_delta: timedelta
     ) -> str:
diff --git a/backend/core/auth/auth_provider_chore.py b/backend/core/auth/auth_provider_chore.py
index a5c6df7..f333809 100644
--- a/backend/core/auth/auth_provider_chore.py
+++ b/backend/core/auth/auth_provider_chore.py
@@ -1,32 +1,31 @@
-from fastapi import HTTPException, Request, status
+from fastapi import Request
 from backend.core.auth.auth_oidc_provider import AuthOidcProvider
 from backend.core.auth.auth_password_provider import (
     AuthPasswordProvider,
 )
 from backend.core.auth.auth_provider import AuthProvider
-
+from backend.exception import TugNoAuthProviderException
 
 AUTH_PASSWORD_PROVIDER = AuthPasswordProvider()
 AUTH_OIDC_PROVIDER = AuthOidcProvider()
-AUTH_PROVIDERS: list[AuthProvider] = [
-    AUTH_PASSWORD_PROVIDER,
-    AUTH_OIDC_PROVIDER,
-]
+AUTH_PROVIDERS: dict[str, AuthProvider] = {
+    "password": AUTH_PASSWORD_PROVIDER,
+    "oidc": AUTH_OIDC_PROVIDER,
+}
+
+
+async def active_auth_provider() -> AuthProvider:
+    for p in AUTH_PROVIDERS.values():
+        if await p.is_enabled():
+            return p
+    raise TugNoAuthProviderException()
 
 
 async def is_authorized(request: Request):
     """
-    Dependency func that checks all enabled auth providers state.
+    Dependency func that checks active auth provider auth state.
     Raises 401 if none is authorized.
     """
-    for p in AUTH_PROVIDERS:
-        try:
-            if await p.is_enabled():
-                _ = await p.is_authorized(request)
-                return True
-        except:
-            pass
-    raise HTTPException(
-        status_code=status.HTTP_401_UNAUTHORIZED,
-        detail="Unauthorized",
-    )
+    provider = await active_auth_provider()
+    _ = await provider.is_authorized(request)
+    return True
diff --git a/backend/exception.py b/backend/exception.py
index f404d74..5649c71 100644
--- a/backend/exception.py
+++ b/backend/exception.py
@@ -2,4 +2,14 @@ class TugException(Exception):
     """Base tugtainer exception"""
 
     def __init__(self, message: str):
-        super().__init__(message)
\ No newline at end of file
+        super().__init__(message)
+
+
+class TugNoAuthProviderException(TugException):
+    """Exception for cases when no auth provider is enabled"""
+
+    def __init__(
+        self,
+        message: str = "No active authentication providers found.",
+    ):
+        super().__init__(message)
diff --git a/frontend/src/app/entities/auth/auth-api.service.ts b/frontend/src/app/entities/auth/auth-api.service.ts
index 0ab527b..e9839c3 100644
--- a/frontend/src/app/entities/auth/auth-api.service.ts
+++ b/frontend/src/app/entities/auth/auth-api.service.ts
@@ -1,7 +1,7 @@
 import { Injectable } from '@angular/core';
 import { BaseApiService } from '../base/base-api.service';
 import { Observable } from 'rxjs';
-import { ISetPasswordBody } from './auth-interface';
+import { ISetPasswordBody, TAuthProvider } from './auth-interface';
 
 @Injectable({
   providedIn: 'root',
@@ -9,12 +9,31 @@ import { ISetPasswordBody } from './auth-interface';
 export class AuthApiService extends BaseApiService<'/auth'> {
   protected override readonly prefix = '/auth';
 
-  login(password: string): Observable<any> {
-    return this.httpClient.post(
-      `${this.basePath}/login`,
-      {},
-      { params: { password }, withCredentials: true },
-    );
+  /**
+   * Check if auth provider enabled
+   * @param provider provider code
+   * @returns
+   */
+  isAuthProviderEnabled(provider: TAuthProvider): Observable<boolean> {
+    return this.httpClient.get<boolean>(`${this.basePath}/${provider}/enabled`);
+  }
+
+  /**
+   * Auth with active auth provider
+   * @param body
+   * @param params
+   * @returns
+   */
+  login(body: { [K: string]: any } = {}, params: { [K: string]: any } = {}): Observable<any> {
+    return this.httpClient.post(`${this.basePath}/login`, body, { params, withCredentials: true });
+  }
+
+  /**
+   * Login with redirection to provider
+   * @param provider
+   */
+  initiateLogin(provider: TAuthProvider): void {
+    window.location.href = `${this.basePath}/${provider}/login`;
   }
 
   refresh(): Observable<any> {
@@ -38,13 +57,4 @@ export class AuthApiService extends BaseApiService<'/auth'> {
   isPasswordSet(): Observable<boolean> {
     return this.httpClient.get<boolean>(`${this.basePath}/is_password_set`);
   }
-
-  isOidcEnabled(): Observable<boolean> {
-    return this.httpClient.get<boolean>(`${this.basePath}/oidc/enabled`);
-  }
-
-  initiateOidcLogin(): void {
-    // This will redirect to the OIDC provider, so we don't expect a JSON response
-    window.location.href = `${this.basePath}/oidc/login`;
-  }
 }
diff --git a/frontend/src/app/entities/auth/auth-interface.ts b/frontend/src/app/entities/auth/auth-interface.ts
index 16b7fb3..b002321 100644
--- a/frontend/src/app/entities/auth/auth-interface.ts
+++ b/frontend/src/app/entities/auth/auth-interface.ts
@@ -1,4 +1,6 @@
 export interface ISetPasswordBody {
-    password: string;
-    confirm_password: string;
-}
\ No newline at end of file
+  password: string;
+  confirm_password: string;
+}
+
+export type TAuthProvider = 'password' | 'oidc';
diff --git a/frontend/src/app/features/auth-page/auth-page.html b/frontend/src/app/features/auth-page/auth-page.html
index d047ba4..7538336 100644
--- a/frontend/src/app/features/auth-page/auth-page.html
+++ b/frontend/src/app/features/auth-page/auth-page.html
@@ -1,33 +1,30 @@
 <div class="auth">
   <app-logo class="logo"></app-logo>
-  @if (isPasswordSet()) {
-    <!-- Show OIDC login if enabled, otherwise show password login -->
-    @if (isOidcEnabled()) {
-      <div class="oidc-only-login">
-        <p-button
-          [loading]="isLoading()"
-          severity="primary"
-          size="large"
-          class="oidc-login-button"
-          (onClick)="onOidcLogin()"
-        >
-          <i class="pi pi-id-card"></i>
-          <span pButtonLabel>
-            {{ 'AUTH.LOGIN_WITH_OIDC' | translate }}
-          </span>
-        </p-button>
-      </div>
-    } @else {
+  @if (isPasswordEnabled.value()) {
+    @if (isPasswordSet.value()) {
       <app-login-form
         [isLoading]="isLoading()"
         (OnSubmit)="onSubmitLogin($event)"
       >
       </app-login-form>
+    } @else {
+      <app-new-password-form
+        [isLoading]="isLoading()"
+        (OnSubmit)="onSubmitNewPassword($event)"
+      ></app-new-password-form>
     }
-  } @else {
-    <app-new-password-form
-      [isLoading]="isLoading()"
-      (OnSubmit)="onSubmitNewPassword($event)"
-    ></app-new-password-form>
+  }
+  @if (isOidcEnabled.value()) {
+    <div class="oidc-only-login">
+      <p-button
+        [loading]="isLoading()"
+        severity="primary"
+        size="large"
+        icon="pi pi-id-card"
+        [label]="'AUTH.LOGIN_WITH_OIDC' | translate"
+        (onClick)="onOidcLogin()"
+      >
+      </p-button>
+    </div>
   }
 </div>
diff --git a/frontend/src/app/features/auth-page/auth-page.scss b/frontend/src/app/features/auth-page/auth-page.scss
index 6daccd9..0161b63 100644
--- a/frontend/src/app/features/auth-page/auth-page.scss
+++ b/frontend/src/app/features/auth-page/auth-page.scss
@@ -6,54 +6,19 @@
   .logo {
     width: 100%;
     display: block;
-    padding-bottom: 16px;
+    padding-bottom: 1rem;
   }
 
   .auth {
     @include mx.floating-card-surface;
   }
 
-  .oidc-login-section {
-    margin-top: 1rem;
-    
-    .oidc-login-button {
-      width: 100%;
-      justify-content: center;
-    }
-    
-    p-divider {
-      margin: 1rem 0;
-    }
-  }
-
   .oidc-only-login {
     display: flex;
-    flex-direction: column;
+    flex-direction: row;
     align-items: center;
     justify-content: center;
-    text-align: center;
     gap: 2rem;
-    padding-top: 1rem;
-    min-height: 200px; // Ensure adequate space for centering
-    
-    .oidc-login-button {
-      width: 80%;
-      max-width: 300px;
-      min-height: 52px;
-      justify-content: center;
-      gap: 0.75rem;
-      font-size: 1.1rem;
-      font-weight: 600;
-      letter-spacing: 0.02em;
-      
-      i {
-        font-size: 1.3rem;
-      }
-      
-      span {
-        font-size: 1.1rem;
-        font-weight: 600;
-      }
-    }
+    width: 100%;
   }
 }
diff --git a/frontend/src/app/features/auth-page/auth-page.ts b/frontend/src/app/features/auth-page/auth-page.ts
index daaf57c..6ab4039 100644
--- a/frontend/src/app/features/auth-page/auth-page.ts
+++ b/frontend/src/app/features/auth-page/auth-page.ts
@@ -1,6 +1,6 @@
-import { ChangeDetectionStrategy, Component, inject, OnInit, signal } from '@angular/core';
+import { ChangeDetectionStrategy, Component, inject, resource, signal } from '@angular/core';
 import { Router } from '@angular/router';
-import { finalize } from 'rxjs';
+import { catchError, finalize, firstValueFrom, retry, throwError } from 'rxjs';
 import { AuthApiService } from 'src/app/entities/auth/auth-api.service';
 import { ISetPasswordBody } from 'src/app/entities/auth/auth-interface';
 import { NewPasswordForm } from 'src/app/shared/components/new-password-form/new-password-form';
@@ -18,34 +18,52 @@ import { TranslatePipe } from '@ngx-translate/core';
   styleUrl: './auth-page.scss',
   changeDetection: ChangeDetectionStrategy.OnPush,
 })
-export class AuthPage implements OnInit {
+export class AuthPage {
   private readonly authApiService = inject(AuthApiService);
   private readonly router = inject(Router);
   private readonly toastService = inject(ToastService);
 
   public readonly isLoading = signal<boolean>(false);
-  public readonly isPasswordSet = signal<boolean>(null);
-  public readonly isOidcEnabled = signal<boolean>(false);
+  public readonly isPasswordSet = resource({
+    defaultValue: false,
+    loader: () =>
+      firstValueFrom(
+        this.authApiService.isPasswordSet().pipe(
+          retry(1),
+          catchError((error) => {
+            this.toastService.error(error);
+            return throwError(() => error);
+          }),
+        ),
+      ),
+  });
+  public readonly isOidcEnabled = resource({
+    defaultValue: false,
+    loader: () =>
+      firstValueFrom(
+        this.authApiService.isAuthProviderEnabled('oidc').pipe(
+          retry(1),
+          catchError((error) => {
+            this.toastService.error(error);
+            return throwError(() => error);
+          }),
+        ),
+      ),
+  });
 
-  ngOnInit(): void {
-    this.updateIsPasswordSet();
-    this.updateIsOidcEnabled();
-  }
-
-  private updateIsPasswordSet(): void {
-    this.isLoading.set(true);
-    this.authApiService
-      .isPasswordSet()
-      .pipe(finalize(() => this.isLoading.set(false)))
-      .subscribe({
-        next: (res) => {
-          this.isPasswordSet.set(res);
-        },
-        error: (error) => {
-          this.toastService.error(error);
-        },
-      });
-  }
+  public readonly isPasswordEnabled = resource({
+    defaultValue: false,
+    loader: () =>
+      firstValueFrom(
+        this.authApiService.isAuthProviderEnabled('password').pipe(
+          retry(1),
+          catchError((error) => {
+            this.toastService.error(error);
+            return throwError(() => error);
+          }),
+        ),
+      ),
+  });
 
   onSubmitNewPassword($event: ISetPasswordBody): void {
     this.isLoading.set(true);
@@ -55,7 +73,7 @@ export class AuthPage implements OnInit {
       .subscribe({
         next: () => {
           this.toastService.success();
-          this.updateIsPasswordSet();
+          this.isPasswordSet.reload();
         },
         error: (error) => {
           this.toastService.error(error);
@@ -66,7 +84,7 @@ export class AuthPage implements OnInit {
   onSubmitLogin(password: string): void {
     this.isLoading.set(true);
     this.authApiService
-      .login(password)
+      .login({}, { password })
       .pipe(finalize(() => this.isLoading.set(false)))
       .subscribe({
         next: () => {
@@ -78,19 +96,7 @@ export class AuthPage implements OnInit {
       });
   }
 
-  private updateIsOidcEnabled(): void {
-    this.authApiService.isOidcEnabled().subscribe({
-      next: (res) => {
-        this.isOidcEnabled.set(res);
-      },
-      error: (error) => {
-        console.warn('Could not check OIDC status:', error);
-        this.isOidcEnabled.set(false);
-      },
-    });
-  }
-
   onOidcLogin(): void {
-    this.authApiService.initiateOidcLogin();
+    this.authApiService.initiateLogin('oidc');
   }
 }

From 6d8af5821d510aa19b9a1769936cdbad649972dc Mon Sep 17 00:00:00 2001
From: Quenary <evgeny.savin.nord@gmail.com>
Date: Thu, 6 Nov 2025 01:47:52 +0300
Subject: [PATCH 38/40] refactor: removed unused code

+ removed docker-compose (was removed in main)
+ removed env from docker-compose.dev.yml (for dev purposes it is handy to use .env in workspace)
+ removed oidc settings from frontend enum
+ removed unused validators and schemas
+ removed DOCKER_TIMEOUT (was removed in main)
---
 backend/enums/settings_enum.py                |  9 ----
 backend/schemas/auth_schema.py                | 13 -----
 backend/schemas/settings_schema.py            | 30 ++---------
 backend/schemas/validators.py                 | 53 -------------------
 docker-compose.dev.yml                        | 10 +---
 docker-compose.yml                            | 25 ---------
 frontend/public/i18n/en.json                  |  4 --
 .../entities/settings/settings-api.service.ts |  4 --
 .../entities/settings/settings-interface.ts   |  1 -
 .../features/settings-page/settings-page.scss |  2 -
 10 files changed, 4 insertions(+), 147 deletions(-)
 delete mode 100644 docker-compose.yml

diff --git a/backend/enums/settings_enum.py b/backend/enums/settings_enum.py
index 183ac35..7522236 100644
--- a/backend/enums/settings_enum.py
+++ b/backend/enums/settings_enum.py
@@ -10,15 +10,6 @@ class ESettingKey(str, Enum):
     CRONTAB_EXPR = "CRONTAB_EXPR"
     NOTIFICATION_URL = "NOTIFICATION_URL"
     TIMEZONE = "TIMEZONE"
-    DOCKER_TIMEOUT = "DOCKER_TIMEOUT"
-    
-    # OIDC Settings
-    OIDC_ENABLED = "OIDC_ENABLED"
-    OIDC_WELL_KNOWN_URL = "OIDC_WELL_KNOWN_URL"
-    OIDC_CLIENT_ID = "OIDC_CLIENT_ID"
-    OIDC_CLIENT_SECRET = "OIDC_CLIENT_SECRET"
-    OIDC_REDIRECT_URI = "OIDC_REDIRECT_URI"
-    OIDC_SCOPES = "OIDC_SCOPES"
 
 
 class ESettingType(str, Enum):
diff --git a/backend/schemas/auth_schema.py b/backend/schemas/auth_schema.py
index 40c92e7..a49b5f1 100644
--- a/backend/schemas/auth_schema.py
+++ b/backend/schemas/auth_schema.py
@@ -1,5 +1,4 @@
 from pydantic import BaseModel, field_validator
-from typing import Dict, Any, Optional
 from .validators import password_validator
 
 
@@ -11,15 +10,3 @@ class PasswordSetRequestBody(BaseModel):
     @classmethod
     def validate_password(cls, v: str) -> str:
         return password_validator(v)
-
-
-class OIDCConfigResponse(BaseModel):
-    enabled: bool
-    client_id: Optional[str] = None
-    redirect_uri: Optional[str] = None
-    scopes: Optional[str] = None
-
-
-class OIDCLoginResponse(BaseModel):
-    authorization_url: str
-    state: str
\ No newline at end of file
diff --git a/backend/schemas/settings_schema.py b/backend/schemas/settings_schema.py
index 0381f80..8d02069 100644
--- a/backend/schemas/settings_schema.py
+++ b/backend/schemas/settings_schema.py
@@ -2,13 +2,7 @@
 from typing import Union, cast
 from datetime import datetime
 from backend.enums.settings_enum import ESettingKey
-from .validators import (
-    validate_cron_expr, 
-    validate_timezone,
-    validate_oidc_well_known_url,
-    validate_oidc_client_id,
-    validate_oidc_scopes
-)
+from .validators import validate_cron_expr, validate_timezone
 
 
 class SettingsPatchRequestItem(BaseModel):
@@ -18,28 +12,10 @@ class SettingsPatchRequestItem(BaseModel):
     @model_validator(mode="after")
     def validate_setting(self):
         if self.key == ESettingKey.CRONTAB_EXPR:
-            _ = validate_cron_expr(cast(str, self.value))
+            _ = validate_cron_expr(str(self.value))
             return self
         elif self.key == ESettingKey.TIMEZONE:
-            _ = validate_timezone(cast(str, self.value))
-            return self
-        elif self.key == ESettingKey.OIDC_WELL_KNOWN_URL:
-            self.value = validate_oidc_well_known_url(cast(str, self.value))
-            return self
-        elif self.key == ESettingKey.OIDC_CLIENT_ID:
-            self.value = validate_oidc_client_id(cast(str, self.value))
-            return self
-        elif self.key == ESettingKey.OIDC_SCOPES:
-            self.value = validate_oidc_scopes(cast(str, self.value))
-            return self
-        elif self.key == ESettingKey.OIDC_WELL_KNOWN_URL:
-            self.value = validate_oidc_well_known_url(cast(str, self.value))
-            return self
-        elif self.key == ESettingKey.OIDC_CLIENT_ID:
-            self.value = validate_oidc_client_id(cast(str, self.value))
-            return self
-        elif self.key == ESettingKey.OIDC_SCOPES:
-            self.value = validate_oidc_scopes(cast(str, self.value))
+            _ = validate_timezone(str(self.value))
             return self
         else:
             return self
diff --git a/backend/schemas/validators.py b/backend/schemas/validators.py
index 220adf9..68864cd 100644
--- a/backend/schemas/validators.py
+++ b/backend/schemas/validators.py
@@ -2,7 +2,6 @@
 from datetime import datetime
 from cronsim import CronSim, CronSimError
 from zoneinfo import available_timezones
-from urllib.parse import urlparse
 
 
 VALID_TIMEZONES = available_timezones()
@@ -43,55 +42,3 @@ def validate_timezone(tz: str) -> str:
     if tz in VALID_TIMEZONES:
         return tz
     raise ValueError(f"Invalid timezone: {tz}")
-
-
-def validate_oidc_well_known_url(url: str) -> str:
-    """Validate OIDC well-known URL format"""
-    if not url:
-        return url  # Allow empty for disabled OIDC
-    
-    parsed = urlparse(url)
-    if not parsed.scheme or parsed.scheme not in ['http', 'https']:
-        raise ValueError("OIDC well-known URL must start with http:// or https://")
-    
-    if not parsed.netloc:
-        raise ValueError("Invalid OIDC well-known URL format")
-    
-    # Ensure it ends with the well-known path or allow custom paths
-    if not url.endswith('/.well-known/openid_configuration') and '/.well-known/' not in url:
-        raise ValueError("OIDC URL should point to a well-known configuration endpoint")
-    
-    return url
-
-
-def validate_oidc_client_id(client_id: str) -> str:
-    """Validate OIDC Client ID"""
-    if not client_id:
-        return client_id  # Allow empty for disabled OIDC
-    
-    # Basic validation - client IDs are typically alphanumeric with some special chars
-    if not re.match(r'^[a-zA-Z0-9._-]+$', client_id):
-        raise ValueError("OIDC Client ID contains invalid characters")
-    
-    return client_id
-
-
-def validate_oidc_scopes(scopes: str) -> str:
-    """Validate OIDC scopes"""
-    if not scopes:
-        return "openid"  # Default to openid scope
-    
-    # Split scopes and validate each one
-    scope_list = scopes.split()
-    valid_scope_pattern = r'^[a-zA-Z0-9._:-]+$'
-    
-    for scope in scope_list:
-        if not re.match(valid_scope_pattern, scope):
-            raise ValueError(f"Invalid OIDC scope: {scope}")
-    
-    # Ensure 'openid' is always included
-    if 'openid' not in scope_list:
-        scope_list.insert(0, 'openid')
-        scopes = ' '.join(scope_list)
-    
-    return scopes
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index ae32241..b4285a5 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -20,13 +20,5 @@ services:
       - tugtainer
     ports:
       - '9412:80'
-    environment:
-      # OIDC Configuration
-      OIDC_ENABLED: "false"
-      OIDC_WELL_KNOWN_URL: ""
-      OIDC_CLIENT_ID: ""
-      OIDC_CLIENT_SECRET: ""
-      OIDC_REDIRECT_URI: ""
-      OIDC_SCOPES: "openid profile email"
 volumes:
-  tugtainer_data_dev:
+  tugtainer_data_dev:
\ No newline at end of file
diff --git a/docker-compose.yml b/docker-compose.yml
deleted file mode 100644
index 3fd7540..0000000
--- a/docker-compose.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-networks:
-  tugtainer:
-    driver: bridge
-services:
-  app:
-    container_name: tugtainer
-    image: quenary/tugtainer:latest
-    volumes:
-      - tugtainer_data:/tugtainer
-      - /var/run/docker.sock:/var/run/docker.sock
-    restart: unless-stopped
-    networks:
-      - tugtainer
-    ports:
-      - '9412:80'
-    environment:
-      # OIDC Configuration
-      OIDC_ENABLED: "false"
-      OIDC_WELL_KNOWN_URL: ""
-      OIDC_CLIENT_ID: ""
-      OIDC_CLIENT_SECRET: ""
-      OIDC_REDIRECT_URI: ""
-      OIDC_SCOPES: "openid profile email"
-volumes:
-  tugtainer_data:
diff --git a/frontend/public/i18n/en.json b/frontend/public/i18n/en.json
index ca9f18f..e34c693 100644
--- a/frontend/public/i18n/en.json
+++ b/frontend/public/i18n/en.json
@@ -157,10 +157,6 @@
       "TIMEZONE": {
         "LABEL": "Timezone",
         "HINT": "Timezone in IANA format, e.g. Europe/Moscow"
-      },
-      "DOCKER_TIMEOUT": {
-        "LABEL": "Docker timeout",
-        "HINT": "Docker CLI call timeout. This applies primarily to API methods and does not apply to, for example, container re-creation or image pulling."
       }
     }
   }
diff --git a/frontend/src/app/entities/settings/settings-api.service.ts b/frontend/src/app/entities/settings/settings-api.service.ts
index ed084c1..cf3b253 100644
--- a/frontend/src/app/entities/settings/settings-api.service.ts
+++ b/frontend/src/app/entities/settings/settings-api.service.ts
@@ -24,8 +24,4 @@ export class SettingsApiService extends BaseApiService<'/settings'> {
   getAvailableTimezones(): Observable<string[]> {
     return this.httpClient.get<string[]>(`${this.basePath}/available_timezones`);
   }
-
-  testOidcConnection(well_known_url: string): Observable<any> {
-    return this.httpClient.post(`${this.basePath}/test_oidc`, { well_known_url });
-  }
 }
diff --git a/frontend/src/app/entities/settings/settings-interface.ts b/frontend/src/app/entities/settings/settings-interface.ts
index 9ec28e7..be4618a 100644
--- a/frontend/src/app/entities/settings/settings-interface.ts
+++ b/frontend/src/app/entities/settings/settings-interface.ts
@@ -18,5 +18,4 @@ export enum ESettingKey {
   CRONTAB_EXPR = 'CRONTAB_EXPR',
   NOTIFICATION_URL = 'NOTIFICATION_URL',
   TIMEZONE = 'TIMEZONE',
-  DOCKER_TIMEOUT = 'DOCKER_TIMEOUT',
 }
diff --git a/frontend/src/app/features/settings-page/settings-page.scss b/frontend/src/app/features/settings-page/settings-page.scss
index a34f624..636016d 100644
--- a/frontend/src/app/features/settings-page/settings-page.scss
+++ b/frontend/src/app/features/settings-page/settings-page.scss
@@ -4,5 +4,3 @@
   overflow: hidden;
   overflow-y: auto;
 }
-
-

From 85bdcc42abeb1b4db77a9c97d88810d3e6da24eb Mon Sep 17 00:00:00 2001
From: Bramble <Brramble@users.noreply.github.com>
Date: Sun, 9 Nov 2025 15:08:11 +0000
Subject: [PATCH 39/40] Backend changes for OIDC redirect

---
 .env.example            |  5 +++++
 backend/api/auth_api.py | 10 ++++++++++
 backend/config.py       |  2 ++
 3 files changed, 17 insertions(+)

diff --git a/.env.example b/.env.example
index 2f02616..9f7c539 100644
--- a/.env.example
+++ b/.env.example
@@ -71,4 +71,9 @@ OIDC_REDIRECT_URI=
 # Space-separated scopes
 # Default is "openid profile email"
 OIDC_SCOPES=
+# Automatically redirect to OIDC provider instead of showing login page
+# When enabled, users will be immediately redirected to the OIDC provider
+# instead of seeing the login screen (only works when password auth is disabled)
+# Default is FALSE
+OIDC_AUTO_REDIRECT=
 #endregion
\ No newline at end of file
diff --git a/backend/api/auth_api.py b/backend/api/auth_api.py
index 8dab64a..8086fcf 100644
--- a/backend/api/auth_api.py
+++ b/backend/api/auth_api.py
@@ -91,6 +91,16 @@ def is_password_set() -> bool:
     return AUTH_PASSWORD_PROVIDER.is_password_set()
 
 
+@router.get(
+    path="/oidc_auto_redirect",
+    description="Check if OIDC auto redirect is enabled",
+    response_model=bool,
+)
+async def oidc_auto_redirect() -> bool:
+    from backend.config import Config
+    return Config.OIDC_AUTO_REDIRECT
+
+
 @router.get(
     path="/{provider}/login", description="Login with provider"
 )
diff --git a/backend/config.py b/backend/config.py
index fdaff73..209338d 100644
--- a/backend/config.py
+++ b/backend/config.py
@@ -25,6 +25,7 @@ class Config:
     OIDC_CLIENT_SECRET: ClassVar[str]
     OIDC_REDIRECT_URI: ClassVar[str]
     OIDC_SCOPES: ClassVar[str]
+    OIDC_AUTO_REDIRECT: ClassVar[bool]
 
     @classmethod
     def load(cls):
@@ -63,6 +64,7 @@ def load(cls):
             cls.OIDC_CLIENT_SECRET = os.getenv("OIDC_CLIENT_SECRET", "")
             cls.OIDC_REDIRECT_URI = os.getenv("OIDC_REDIRECT_URI", "")
             cls.OIDC_SCOPES = os.getenv("OIDC_SCOPES", "openid profile email")
+            cls.OIDC_AUTO_REDIRECT = os.getenv("OIDC_AUTO_REDIRECT", "false").lower() == "true"
 
 
 Config.load()

From bd743ebc08d5ca0135544363a6c5f135cc191b5b Mon Sep 17 00:00:00 2001
From: Bramble <Brramble@users.noreply.github.com>
Date: Sun, 9 Nov 2025 15:08:57 +0000
Subject: [PATCH 40/40] Add OIDC auto-redirect check to auth page

New API method to check if OIDC auto-redirect is enabled and updates the AuthPage to automatically redirect to OIDC
---
 .../src/app/entities/auth/auth-api.service.ts |  8 +++++
 .../src/app/features/auth-page/auth-page.ts   | 33 +++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/frontend/src/app/entities/auth/auth-api.service.ts b/frontend/src/app/entities/auth/auth-api.service.ts
index e9839c3..32e779e 100644
--- a/frontend/src/app/entities/auth/auth-api.service.ts
+++ b/frontend/src/app/entities/auth/auth-api.service.ts
@@ -57,4 +57,12 @@ export class AuthApiService extends BaseApiService<'/auth'> {
   isPasswordSet(): Observable<boolean> {
     return this.httpClient.get<boolean>(`${this.basePath}/is_password_set`);
   }
+
+  /**
+   * Check if OIDC auto redirect is enabled
+   * @returns
+   */
+  isOidcAutoRedirectEnabled(): Observable<boolean> {
+    return this.httpClient.get<boolean>(`${this.basePath}/oidc_auto_redirect`);
+  }
 }
diff --git a/frontend/src/app/features/auth-page/auth-page.ts b/frontend/src/app/features/auth-page/auth-page.ts
index 6ab4039..6b5d5d6 100644
--- a/frontend/src/app/features/auth-page/auth-page.ts
+++ b/frontend/src/app/features/auth-page/auth-page.ts
@@ -23,6 +23,11 @@ export class AuthPage {
   private readonly router = inject(Router);
   private readonly toastService = inject(ToastService);
 
+  constructor() {
+    // Check for OIDC auto-redirect when component initializes
+    this.checkOidcAutoRedirect();
+  }
+
   public readonly isLoading = signal<boolean>(false);
   public readonly isPasswordSet = resource({
     defaultValue: false,
@@ -65,6 +70,20 @@ export class AuthPage {
       ),
   });
 
+  public readonly isOidcAutoRedirectEnabled = resource({
+    defaultValue: false,
+    loader: () =>
+      firstValueFrom(
+        this.authApiService.isOidcAutoRedirectEnabled().pipe(
+          retry(1),
+          catchError((error) => {
+            this.toastService.error(error);
+            return throwError(() => error);
+          }),
+        ),
+      ),
+  });
+
   onSubmitNewPassword($event: ISetPasswordBody): void {
     this.isLoading.set(true);
     this.authApiService
@@ -99,4 +118,18 @@ export class AuthPage {
   onOidcLogin(): void {
     this.authApiService.initiateLogin('oidc');
   }
+
+  private checkOidcAutoRedirect(): void {
+    // Wait for resources to load, then check if auto-redirect should happen
+    setTimeout(() => {
+      const oidcEnabled = this.isOidcEnabled.value();
+      const passwordEnabled = this.isPasswordEnabled.value();
+      const autoRedirectEnabled = this.isOidcAutoRedirectEnabled.value();
+
+      // Auto-redirect if OIDC auto-redirect is enabled, OIDC is enabled, and password auth is disabled
+      if (autoRedirectEnabled && oidcEnabled && !passwordEnabled) {
+        this.authApiService.initiateLogin('oidc');
+      }
+    }, 100);
+  }
 }