Page History

...

OauthLoginAPIAuthenticatorCmd.authenticate()
  → _apiServer.loginUser()                    
    → accountMgr.authenticateUser()           
      → for (authenticator : _userAuthenticators) 
        → OAuth2UserAuthenticator.authenticate()  
          → GithubOAuth2Provider.verifyUser()     

Step 5: Login Page (External Tab) Behavior

• On page load, the UI calls listOauthProvider without a domain parameter
• External tab is enabled if response.listoauthproviderresponse.count > 0
• Global provider buttons (Google/GitHub) are rendered from the returned list
• If no global providers exist but domain providers do, the tab is enabled with the message: "Enter your domain to see available providers"
• When the user enters a domain path in the domain field, the UI calls listOauthProvider with domain=<path>
• Domain-specific provider buttons are rendered, or "No OAuth providers configured for this domain" is shown

Other Changes

Admin commands — how providers get registered/updated/deleted

...

The oauth2.enabled config key uses a new strictScope mode in ConfigKey.valueInScope() to prevent automatic inheritance from global to domain scope. Each domain must explicitly set oauth2.enabled=true to enable OAuth login.

Key difference from standard ConfigKey behavior: without strict scope, an unconfigured domain inherits the global value. With strict scope, unconfigured domains return null which is treated as disabled. This ensures domains must explicitly opt in to OAuth.

...