fix: Allow user-configurable OIDC timeout (#7496)

This commit is contained in:
Xavier L.
2026-04-20 23:22:36 -04:00
committed by GitHub
parent 83bc2f3889
commit c9a0cac055
3 changed files with 7 additions and 3 deletions

View File

@@ -3,7 +3,7 @@ import os
import secrets
from datetime import UTC, datetime
from pathlib import Path
from typing import Annotated, Any, NamedTuple
from typing import Annotated, Any, Literal, NamedTuple
from dateutil.tz import tzlocal
from pydantic import PlainSerializer, field_validator
@@ -349,6 +349,7 @@ class AppSettings(AppLoggingSettings):
OIDC_GROUPS_CLAIM: str | None = "groups"
OIDC_SCOPES_OVERRIDE: str | None = None
OIDC_TLS_CACERTFILE: str | None = None
OIDC_CLIENT_TIMEOUT: float | Literal["None", "default"] = "default"
@property
def OIDC_REQUIRES_GROUP_CLAIM(self) -> bool:

View File

@@ -1,4 +1,4 @@
from typing import Annotated
from typing import Annotated, Any
from authlib.integrations.starlette_client import OAuth
from fastapi import APIRouter, Depends, Header, Request, Response, status
@@ -36,7 +36,9 @@ if settings.OIDC_READY:
else:
groups_claim = settings.OIDC_GROUPS_CLAIM if settings.OIDC_REQUIRES_GROUP_CLAIM else ""
scope = f"openid email profile {groups_claim}"
client_args = {"scope": scope.rstrip()}
client_args: dict[str, Any] = {"scope": scope.rstrip()}
if settings.OIDC_CLIENT_TIMEOUT != "default":
client_args["timeout"] = settings.OIDC_CLIENT_TIMEOUT if settings.OIDC_CLIENT_TIMEOUT != "None" else None
if settings.OIDC_TLS_CACERTFILE:
client_args["verify"] = settings.OIDC_TLS_CACERTFILE