Add OIDC offline_token user sync by schliz · Pull Request #73 · HaDiNet/shiftings

schliz · 2026-03-15T17:45:26Z

Create a system for persisting offline_tokens for users that logged in via OpenID Connect. We can use this to periodically update the groups for users that haven't signed in for a while.

Resolves #41

schliz · 2026-03-15T17:50:54Z

closes #36

pablo-schmeiser

Very important and awaited feature!
Looks good to me 👍

Once @hd1ex approves this too, this is ready to be merged.
If @lewellien is still interested in this topic: They may want to review this as well.

hd1ex · 2026-03-15T19:01:09Z

Thanks for working on iCal support!
I didn't look at everything but will do. Overall it looks good to me, but I haven't tested it yet.

My first question is: Does this also fix or works upon fixing #41?
Meaning that it also adds the ability to communicate with the identity provider?
It feels like we'd just have to add a systemd timer to fix the issue.

Can you split the OIDC stuff to another change? I'd rather review and integrate these two things step by step.

hd1ex

See comment above.

Move _populate_user from AuthorizeSSOUser view into accounts/oidc.py as populate_user_from_oidc so it can be reused by the offline token refresh logic without a model-to-view circular dependency. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CalendarToken stores a unique per-user token for session-less iCal feed access. OIDCOfflineToken stores the OIDC refresh token and implements refresh_user_info() to sync groups from the identity provider before serving calendar data. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Introduce TokenAuthMixin that authenticates feed requests via a CalendarToken URL parameter and refreshes OIDC user data with a 10-minute cooldown. Register token feed URLs under /calendar/token/<token>/{user,participation,organization,event}/. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add token management views (create/regenerate/delete) and a Calendar Subscriptions card on the profile page showing copyable iCal URLs with regenerate and revoke controls. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Move the Calendar Subscriptions card from the left sidebar into the right column above Upcoming Shifts for better visibility. Add "Add to Calendar" buttons using the webcal:// protocol so users can subscribe with a single click from their device. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Combine the "Add to Calendar" button and the copyable URL input into one flex row per feed for a more compact layout. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Use the same card structure (p-3, center-items header row) as the user info card. Move regenerate and revoke buttons into the title row as icon-only buttons, and show the generate button there when no token exists. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add German translations for all calendar subscription strings. Rename "My Participations" to "My Shifts" for clarity. Increase spacing between subtitle text and feed sections. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Remove all obsolete (#~) entries including calendar-related strings and fix duplicate "My Shifts" entries that caused msgmerge errors. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

schliz · 2026-03-15T22:11:15Z

@hd1ex you can create a timer that runs src/shiftings/accounts/management/commands/sync_oidc_users.py for the desired functionality described in #41

hd1ex · 2026-03-16T13:11:26Z

src/shiftings/accounts/management/commands/sync_oidc_users.py

+        tokens = OIDCOfflineToken.objects.select_related('user').all()
+        total = tokens.count()
+        success = 0
+        failed = 0
+
+        self.stdout.write(f'Syncing {total} OIDC user(s)...')
+
+        for offline_token in tokens:
+            username = offline_token.user.username
+            if offline_token.refresh_user_info():
+                success += 1
+                logger.info('Synced user %s', username)
+            else:
+                failed += 1
+                logger.warning('Failed to sync user %s', username)
+                if options['purge_expired']:
+                    offline_token.delete()
+                    logger.info('Purged expired token for user %s', username)
+
+        self.stdout.write(self.style.SUCCESS(
+            f'Done. {success} synced, {failed} failed (of {total} total).'
+        ))


Can you also print out the time how long a refresh run took, so an admin can get a feeling of the performance impact? I also saw some async stuff was added to Django recently. I don't know if it is easy to add but it maybe an option to improve overall reactiveness, if this task is IO heavy.

When does such a token expire? Do I understand it correctly that we have to refresh the token regularly and expired tokens can only be "refreshed" if the user does relogin?

If so, this only solves #41 for future deployments.
On a running system no tokens are there (yet?) so this implies for me some kind of purge when this change is rolled out:

Terminate all user sessions (forcing them to relogin)

Update all group memberships by

either clearing them all and let the users log back in to rejoin

or using some kind of other data source (e.g. LDAP). This also does not solve the problem for inactive users, so I am in favor of the first option.

Maybe some scripting/documentation to support this would be nice.

The offline token expiry is handled by the OIDC IdP. This implementation currently does nothing on expiry. Ways to solve this is adding a grace period until the 30. June and begin clearing group associations and requiring re-authentication from then. The HaDiKo deployment of Shiftings should use quite short token periods which would force everybody using the App to have logged in at least once since then.

schliz requested review from hd1ex, mfbehrens and pablo-schmeiser as code owners March 15, 2026 17:45

pablo-schmeiser added the enhancement New feature or request label Mar 15, 2026

pablo-schmeiser approved these changes Mar 15, 2026

View reviewed changes

pablo-schmeiser removed the request for review from mfbehrens March 15, 2026 18:26

pablo-schmeiser linked an issue Mar 15, 2026 that may be closed by this pull request

Webcal #2

Open

schliz mentioned this pull request Mar 15, 2026

Add anonymous calendar links with user tokens #36

Closed

hd1ex requested changes Mar 15, 2026

View reviewed changes

schliz force-pushed the feat/ical-subscription branch from e0f7a40 to 8eb1778 Compare March 15, 2026 21:54

schliz changed the title ~~Add token-based iCal calendar subscriptions with OIDC offline token refresh~~ Add OIDC offline_token user sync Mar 15, 2026

schliz and others added 12 commits March 15, 2026 23:00

style: place calendar button and URL field in a single row

20ac9e6

Combine the "Add to Calendar" button and the copyable URL input into one flex row per feed for a more compact layout. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

feat: register CalendarToken and OIDCOfflineToken in admin

6a98b99

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

refactor: remove CalendarToken and calendar feed integration

8c120d1

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

refactor: move OIDCOfflineToken to standalone module, drop CalendarToken

01cf213

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

feat: add sync_oidc_users management command for periodic group sync

f59576a

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore: remove stale translation strings and clean up .po files

11c13e0

Remove all obsolete (#~) entries including calendar-related strings and fix duplicate "My Shifts" entries that caused msgmerge errors. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

schliz force-pushed the feat/ical-subscription branch from 8eb1778 to 11c13e0 Compare March 15, 2026 22:05

schliz requested a review from hd1ex March 15, 2026 22:10

schliz force-pushed the feat/ical-subscription branch from 3691cff to 11c13e0 Compare March 15, 2026 23:09

hd1ex reviewed Mar 16, 2026

View reviewed changes

pablo-schmeiser self-requested a review March 16, 2026 22:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add OIDC offline_token user sync#73

Add OIDC offline_token user sync#73
schliz wants to merge 13 commits intoHaDiNet:masterfrom
schliz:feat/ical-subscription

schliz commented Mar 15, 2026 •

edited

Loading

Uh oh!

schliz commented Mar 15, 2026

Uh oh!

pablo-schmeiser left a comment

Uh oh!

hd1ex commented Mar 15, 2026

Uh oh!

hd1ex left a comment

Uh oh!

schliz commented Mar 15, 2026

Uh oh!

hd1ex Mar 16, 2026 •

edited

Loading

Uh oh!

schliz Mar 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

schliz commented Mar 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

schliz commented Mar 15, 2026

Uh oh!

pablo-schmeiser left a comment

Choose a reason for hiding this comment

Uh oh!

hd1ex commented Mar 15, 2026

Uh oh!

hd1ex left a comment

Choose a reason for hiding this comment

Uh oh!

schliz commented Mar 15, 2026

Uh oh!

hd1ex Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

schliz Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

schliz commented Mar 15, 2026 •

edited

Loading

hd1ex Mar 16, 2026 •

edited

Loading