auth-oidc

Expose the Host as an OpenID Connect provider backed by auth sessions.

Install auth-oidc when another application needs to authenticate through the Host’s existing users and sessions. It depends on auth.

lenso module install auth
lenso module install auth-oidc
cargo run --bin migrate
lenso serve

The module contributes these endpoints:

• /.well-known/openid-configuration
• /.well-known/jwks.json
• /oauth/authorize
• /oauth/token

It is installed but disabled until complete module-local configuration is provided:

LENSO_MODULE_AUTH_OIDC__ENABLED=true
LENSO_MODULE_AUTH_OIDC__ISSUER=https://app.example.com
LENSO_MODULE_AUTH_OIDC__CONSOLE_REDIRECT_URIS='["https://client.example.com/oidc/callback"]'
LENSO_MODULE_AUTH_OIDC__JWKS='{"keys":[...]}'
LENSO_MODULE_AUTH_OIDC__ID_TOKEN_PRIVATE_KEY_PEM="$OIDC_SIGNING_KEY_PEM"

The client id defaults to lenso-console. Every redirect URI must match an allowed URI exactly and must not contain a fragment. Keep the private signing key in the Host’s secret store; publish only its matching public key through JWKS.

The independent Lenso Console Service owns its own operator identities. Adding auth-oidc to a business Host does not grant a business user Console access.