Sn0rrii 071570f754 fix(oidc): normalise trailing slash on both sides of issuer comparison (#995) ...

PyJWT compares the iss claim against discovery_issuer with an exact string
match. Authentik (and similar providers) include a trailing slash in the JWT
iss claim while the discovery document issuer may omit it, or vice-versa.

Disable PyJWT built-in issuer validation and compare both sides after
rstrip('/') to make the check slash-agnostic.

Adds a regression test that verifies a login succeeds when the provider is
configured without a trailing slash but the JWT iss claim carries one.

2026-04-16 09:40:50 +02:00

..

app

fix(oidc): normalise trailing slash on both sides of issuer comparison (#995)

2026-04-16 09:40:50 +02:00

tests

fix(oidc): normalise trailing slash on both sides of issuer comparison (#995)

2026-04-16 09:40:50 +02:00

__init__.py

…