Add auth_time, acr and azp support for OIDC claims

2025-12-31 17:07:54 +11:00
parent fcdd2b6de7
commit d036e25fef
8 changed files with 72 additions and 20 deletions
--- a/app/controllers/concerns/authentication.rb
+++ b/app/controllers/concerns/authentication.rb
@@ -44,9 +44,9 @@ module Authentication
      final_url
    end

-    def start_new_session_for(user)
+    def start_new_session_for(user, acr: "1")
      user.update!(last_sign_in_at: Time.current)
-      user.sessions.create!(user_agent: request.user_agent, ip_address: request.remote_ip).tap do |session|
+      user.sessions.create!(user_agent: request.user_agent, ip_address: request.remote_ip, acr: acr).tap do |session|
        Current.session = session

        # Extract root domain for cross-subdomain cookies (required for forward auth)