OpenConext · ricardovdheijden · May 18, 2026 · Apr 9, 2026 · Apr 9, 2026 · Apr 10, 2026
diff --git a/.run/BE - MyConextServerApplication (MyConext) - SkipIDP.run.xml b/.run/BE - MyConextServerApplication (MyConext) - SkipIDP.run.xml
@@ -0,0 +1,10 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="BE - MyConextServerApplication (MyConext) - Skip IDP" type="SpringBootApplicationConfigurationType" factoryName="Spring Boot">
+    <option name="ACTIVE_PROFILES" value="test" />
+    <module name="myconext-server" />
+    <option name="SPRING_BOOT_MAIN_CLASS" value="myconext.MyConextServerApplication" />
+    <method v="2">
+      <option name="Make" enabled="true" />
+    </method>
+  </configuration>
+</component>
diff --git a/.run/BE - MyConextServerApplication (MyConext).run.xml b/.run/BE - MyConextServerApplication (MyConext).run.xml
@@ -0,0 +1,10 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="BE - MyConextServerApplication (MyConext)" type="SpringBootApplicationConfigurationType" factoryName="Spring Boot">
+    <option name="ACTIVE_PROFILES" value="dev" />
+    <module name="myconext-server" />
+    <option name="SPRING_BOOT_MAIN_CLASS" value="myconext.MyConextServerApplication" />
+    <method v="2">
+      <option name="Make" enabled="true" />
+    </method>
+  </configuration>
+</component>
diff --git a/.run/BE - MyConextServerApplication (ServiceDesk) - SkipIDP.run.xml b/.run/BE - MyConextServerApplication (ServiceDesk) - SkipIDP.run.xml
@@ -0,0 +1,10 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="BE - MyConextServerApplication (ServiceDesk) - Skip IDP" type="SpringBootApplicationConfigurationType" factoryName="Spring Boot">
+    <option name="ACTIVE_PROFILES" value="test,servicedesk" />
+    <module name="myconext-server" />
+    <option name="SPRING_BOOT_MAIN_CLASS" value="myconext.MyConextServerApplication" />
+    <method v="2">
+      <option name="Make" enabled="true" />
+    </method>
+  </configuration>
+</component>
diff --git a/.run/BE - MyConextServerApplication (Servicedesk).run.xml b/.run/BE - MyConextServerApplication (Servicedesk).run.xml
@@ -0,0 +1,10 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="BE - MyConextServerApplication (Servicedesk)" type="SpringBootApplicationConfigurationType" factoryName="Spring Boot">
+    <option name="ACTIVE_PROFILES" value="dev,servicedesk" />
+    <module name="myconext-server" />
+    <option name="SPRING_BOOT_MAIN_CLASS" value="myconext.MyConextServerApplication" />
+    <method v="2">
+      <option name="Make" enabled="true" />
+    </method>
+  </configuration>
+</component>
diff --git a/.run/BE - TiqrApplication.run.xml b/.run/BE - TiqrApplication.run.xml
@@ -0,0 +1,9 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="BE - TiqrApplication" type="SpringBootApplicationConfigurationType" factoryName="Spring Boot">
+    <module name="tiqr-mock" />
+    <option name="SPRING_BOOT_MAIN_CLASS" value="tiqr.org.TiqrApplication" />
+    <method v="2">
+      <option name="Make" enabled="true" />
+    </method>
+  </configuration>
+</component>
diff --git a/.run/FE - Account-gui.run.xml b/.run/FE - Account-gui.run.xml
@@ -0,0 +1,12 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="FE - Account-gui" type="js.build_tools.npm">
+    <package-json value="$PROJECT_DIR$/account-gui/package.json" />
+    <command value="run" />
+    <scripts>
+      <script value="dev" />
+    </scripts>
+    <node-interpreter value="project" />
+    <envs />
+    <method v="2" />
+  </configuration>
+</component>
diff --git a/.run/FE - MyConext-gui.run.xml b/.run/FE - MyConext-gui.run.xml
@@ -0,0 +1,12 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="FE - MyConext-gui" type="js.build_tools.npm">
+    <package-json value="$PROJECT_DIR$/myconext-gui/package.json" />
+    <command value="run" />
+    <scripts>
+      <script value="dev" />
+    </scripts>
+    <node-interpreter value="project" />
+    <envs />
+    <method v="2" />
+  </configuration>
+</component>
diff --git a/.run/FE - Servicedesk.run.xml b/.run/FE - Servicedesk.run.xml
@@ -0,0 +1,12 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="FE - Servicedesk" type="js.build_tools.npm">
+    <package-json value="$PROJECT_DIR$/servicedesk-gui/package.json" />
+    <command value="run" />
+    <scripts>
+      <script value="dev" />
+    </scripts>
+    <node-interpreter value="project" />
+    <envs />
+    <method v="2" />
+  </configuration>
+</component>
diff --git a/account-gui/package.json b/account-gui/package.json
@@ -18,7 +18,7 @@
     "serialize-javascript": "^7.0.5",
     "serve": "^14.2.4",
     "style-loader": "^4.0.0",
-    "svelte": "^5.55.5",
+    "svelte": "5.19.3",
     "svelte-loader": "^3.2.4",
     "svelte-preprocess": "^6.0.3",
     "vite": "^8.0.10",

diff --git a/account-gui/pom.xml b/account-gui/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>org.openconext</groupId>
         <artifactId>myconext</artifactId>
-        <version>8.3.1-SNAPSHOT</version>
+        <version>8.4.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <artifactId>account-gui</artifactId>

diff --git a/account-gui/src/locale/js/en/strings.json b/account-gui/src/locale/js/en/strings.json
@@ -31,6 +31,7 @@
   "Header.Logout.COPY": "Logout",
   "Header.LogOff.COPY": "Log Off",
   "Landing.LogoutTitle.COPY": "You have been logged out",
+  "Landing.RateLimitTitle.COPY": "Too many failed attempts",
   "RegistrationCheck.MainText.COPY": "Checking for\nexisting registration\n",
   "RegistrationCheck.HighLight.COPY": "existing registration",
   "RegistrationCheck.LogoutStatus.COPY": "Close the browser to log out.",

diff --git a/account-gui/src/locale/js/nl/strings.json b/account-gui/src/locale/js/nl/strings.json
@@ -31,6 +31,7 @@
   "Header.Logout.COPY": "Uitloggen",
   "Header.LogOff.COPY": "Afmelden",
   "Landing.LogoutTitle.COPY": "Je bent uitgelogd",
+  "Landing.RateLimitTitle.COPY": "Te veel mislukte pogingen",
   "RegistrationCheck.MainText.COPY": "Controleren op\nbestaande inschrijving\n",
   "RegistrationCheck.HighLight.COPY": "bestaande inschrijving",
   "RegistrationCheck.LogoutStatus.COPY": "Sluit de browser om uit te loggen.",

diff --git a/account-gui/vite.config.js b/account-gui/vite.config.js
@@ -31,6 +31,11 @@ export default defineConfig({
                 changeOrigin: false,
                 secure: false
             },
+            '/doLogout': {
+                target: 'http://localhost:8081',
+                changeOrigin: false,
+                secure: false
+            },
             '/tiqr': {
                 target: 'http://localhost:8081',
                 changeOrigin: false,

diff --git a/account-gui/yarn.lock b/account-gui/yarn.lock
@@ -2,7 +2,7 @@
 # yarn lockfile v1
 
 
-"@ampproject/remapping@^2.2.0":
+"@ampproject/remapping@^2.2.0", "@ampproject/remapping@^2.3.0":
   version "2.3.0"
   resolved "https://registry.yarnpkg.com/@ampproject/remapping/-/remapping-2.3.0.tgz#ed441b6fa600072520ce18b43d2c8cc8caecc7f4"
   integrity sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==
@@ -1179,14 +1179,6 @@
     "@jridgewell/sourcemap-codec" "^1.4.10"
     "@jridgewell/trace-mapping" "^0.3.24"
 
-"@jridgewell/remapping@^2.3.4":
-  version "2.3.5"
-  resolved "https://registry.yarnpkg.com/@jridgewell/remapping/-/remapping-2.3.5.tgz#375c476d1972947851ba1e15ae8f123047445aa1"
-  integrity sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==
-  dependencies:
-    "@jridgewell/gen-mapping" "^0.3.5"
-    "@jridgewell/trace-mapping" "^0.3.24"
-
 "@jridgewell/resolve-uri@^3.1.0":
   version "3.1.2"
   resolved "https://registry.yarnpkg.com/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz#7a0ee601f60f99a20c7c7c5ff0c80388c1189bd6"
@@ -1430,11 +1422,6 @@
   dependencies:
     "@sinonjs/commons" "^3.0.0"
 
-"@sveltejs/acorn-typescript@^1.0.5":
-  version "1.0.9"
-  resolved "https://registry.yarnpkg.com/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.9.tgz#ac0bde368d6623727b0e0bc568cf6b4e5d5c4baa"
-  integrity sha512-lVJX6qEgs/4DOcRTpo56tmKzVPtoWAaVbL4hfO7t7NVwl9AAXzQR6cihesW1BmNMPl+bK6dreu2sOKBP2Q9CIA==
-
 "@sveltejs/vite-plugin-svelte-inspector@^5.0.0":
   version "5.0.0"
   resolved "https://registry.yarnpkg.com/@sveltejs/vite-plugin-svelte-inspector/-/vite-plugin-svelte-inspector-5.0.0.tgz#6daf8fb9fced43390614caf449409371847ba655"
@@ -1574,6 +1561,11 @@ accepts@~1.3.5:
     mime-types "~2.1.34"
     negotiator "0.6.3"
 
+acorn-typescript@^1.4.13:
+  version "1.4.13"
+  resolved "https://registry.yarnpkg.com/acorn-typescript/-/acorn-typescript-1.4.13.tgz#5f851c8bdda0aa716ffdd5f6ac084df8acc6f5ea"
+  integrity sha512-xsc9Xv0xlVfwp2o7sQ+GCQ1PgbkdcpWdTzrwXxO3xDMTAywVS3oXVOcOHuRjAPkS4P9b+yc/qNF15460v+jp4Q==
+
 acorn@^8.12.1:
   version "8.14.1"
   resolved "https://registry.yarnpkg.com/acorn/-/acorn-8.14.1.tgz#721d5dc10f7d5b5609a891773d47731796935dfb"
@@ -1655,10 +1647,10 @@ argparse@^1.0.7:
   dependencies:
     sprintf-js "~1.0.2"
 
-aria-query@5.3.1:
-  version "5.3.1"
-  resolved "https://registry.yarnpkg.com/aria-query/-/aria-query-5.3.1.tgz#ebcb2c0d7fc43e68e4cb22f774d1209cb627ab42"
-  integrity sha512-Z/ZeOgVl7bcSYZ/u/rh0fOpvEpq//LZmdbkXyc7syVzjPAhfOa9ebsdTSjEBDU4vs5nC98Kfduj1uFo0qyET3g==
+aria-query@^5.3.1:
+  version "5.3.2"
+  resolved "https://registry.yarnpkg.com/aria-query/-/aria-query-5.3.2.tgz#93f81a43480e33a338f19163a3d10a50c01dcd59"
+  integrity sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw==
 
 axobject-query@^4.1.0:
   version "4.1.0"
@@ -2141,11 +2133,6 @@ detect-newline@^3.0.0:
   resolved "https://registry.yarnpkg.com/detect-newline/-/detect-newline-3.1.0.tgz#576f5dfc63ae1a192ff192d8ad3af6308991b651"
   integrity sha512-TLz+x/vEXm/Y7P7wn1EJFNLxYpUD4TgMosxY6fAVJUnJMbupHBOncxyWUG9OpTaH9EBD7uFI5LfEgmMOc54DsA==
 
-devalue@^5.6.4:
-  version "5.7.1"
-  resolved "https://registry.yarnpkg.com/devalue/-/devalue-5.7.1.tgz#93e2d9412b909a7901d7b966ebb3479d15a390fd"
-  integrity sha512-MUbZ586EgQqdRnC4yDrlod3BEdyvE4TapGYHMW2CiaW+KkkFmWEFqBUaLltEZCGi0iFXCEjRF0OjF0DV2QHjOA==
-
 diff-sequences@^29.6.3:
   version "29.6.3"
   resolved "https://registry.yarnpkg.com/diff-sequences/-/diff-sequences-29.6.3.tgz#4deaf894d11407c51efc8418012f9e70b84ea921"
@@ -2263,10 +2250,10 @@ esprima@^4.0.0:
   resolved "https://registry.yarnpkg.com/esprima/-/esprima-4.0.1.tgz#13b04cdb3e6c5d19df91ab6987a8695619b0aa71"
   integrity sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==
 
-esrap@^2.2.4:
-  version "2.2.5"
-  resolved "https://registry.yarnpkg.com/esrap/-/esrap-2.2.5.tgz#23dd923664bd84d7b069ce3dea3b3c0dc91b6d3d"
-  integrity sha512-/yLB1538mag+dn0wsePTe8C0rDIjUOaJpMs2McodSzmM2msWcZsBSdRtg6HOBt0A/r82BN+Md3pgwSc/uWt2Ig==
+esrap@^1.4.3:
+  version "1.4.9"
+  resolved "https://registry.yarnpkg.com/esrap/-/esrap-1.4.9.tgz#350362c55d8c83b263edfb0fd48dac95162167de"
+  integrity sha512-3OMlcd0a03UGuZpPeUC1HxR3nA23l+HEyCiZw3b3FumJIN9KphoGzDJKMXI1S72jVS1dsenDyQC0kJlO1U9E1g==
   dependencies:
     "@jridgewell/sourcemap-codec" "^1.4.15"
 
@@ -3916,23 +3903,21 @@ svelte-routing@^2.13.0:
   resolved "https://registry.yarnpkg.com/svelte-routing/-/svelte-routing-2.13.0.tgz#d8215a55491e32203d4eaeda20b313dd257bdce7"
   integrity sha512-/NTxqTwLc7Dq306hARJrH2HLXOBtKd7hu8nxgoFDlK0AC4SOKnzisiX/9m8Uksei1QAWtlAEdF91YphNM8iDMg==
 
-svelte@^5.55.5:
-  version "5.55.5"
-  resolved "https://registry.yarnpkg.com/svelte/-/svelte-5.55.5.tgz#2d7160eb18a10c6f6a124bfbb010d353a937c069"
-  integrity sha512-2uCs/LZ9us+AktdzYJM8OcxQ8qnPS1kpaO7syGT/MgO+6Qr1Ybl+TqPq+97u7PHqmmMlye5ZkoyXONy5mjjAbw==
+svelte@5.19.3:
+  version "5.19.3"
+  resolved "https://registry.yarnpkg.com/svelte/-/svelte-5.19.3.tgz#2e763bca74618f486e43bbe07034669ad9139c8b"
+  integrity sha512-rb/bkYG9jq67OCWikMvaPnfOobyGn0JizVDwHpdeBtLiNXPMcoA9GTFC3BhptP7xGNquUU8J5GiS7PlGlfDAFA==
   dependencies:
-    "@jridgewell/remapping" "^2.3.4"
+    "@ampproject/remapping" "^2.3.0"
     "@jridgewell/sourcemap-codec" "^1.5.0"
-    "@sveltejs/acorn-typescript" "^1.0.5"
     "@types/estree" "^1.0.5"
-    "@types/trusted-types" "^2.0.7"
     acorn "^8.12.1"
-    aria-query "5.3.1"
+    acorn-typescript "^1.4.13"
+    aria-query "^5.3.1"
     axobject-query "^4.1.0"
     clsx "^2.1.1"
-    devalue "^5.6.4"
     esm-env "^1.2.1"
-    esrap "^2.2.4"
+    esrap "^1.4.3"
     is-reference "^3.0.3"
     locate-character "^3.0.0"
     magic-string "^0.30.11"

diff --git a/localizations.yaml b/localizations.yaml
@@ -225,6 +225,10 @@ SHARED:
       COPY:
         en: You have been logged out
         nl: Je bent uitgelogd
+    RateLimitTitle:
+      COPY:
+        en: Too many failed attempts
+        nl: Te veel mislukte pogingen
   RegistrationCheck:
     MainText:
       COPY:

diff --git a/myconext-gui/docker/Dockerfile b/myconext-gui/docker/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/openconext/openconext-basecontainers/apache2-shibboleth:latest
+FROM ghcr.io/openconext/openconext-basecontainers/apache2:latest
 COPY ./dist/ /var/www/
 COPY ./docker/conf/000-default.conf /etc/apache2/sites-enabled/000-default.conf
 
diff --git a/myconext-gui/docker/conf/000-default.conf b/myconext-gui/docker/conf/000-default.conf
@@ -20,67 +20,44 @@ RewriteCond %{REQUEST_URI} !^/robots.txt
 RewriteCond %{REQUEST_URI} !^/config
 RewriteCond %{REQUEST_URI} !^/fonts
 RewriteCond %{REQUEST_URI} !^/.well-known
+RewriteCond %{REQUEST_URI} !^/oauth2
+RewriteCond %{REQUEST_URI} !^/login/oauth2
+RewriteCond %{REQUEST_URI} !^/auth/login
+RewriteCond %{REQUEST_URI} !^/doLogout
 RewriteRule (.*) /index.html [L]
 
 ProxyPreserveHost On
-ProxyPass /Shibboleth.sso !
 
 ProxyPass /myconext/api http://myconextserver:8080/myconext/api
 ProxyPassReverse /myconext/api http://myconextserver:8080/myconext/api
 
 ProxyPass /tiqr http://myconextserver:8080/tiqr
 ProxyPassReverse /tiqr http://myconextserver:8080/tiqr
 
+ProxyPass /oauth2/authorization http://myconextserver:8080/oauth2/authorization
+ProxyPassReverse /oauth2/authorization http://myconextserver:8080/oauth2/authorization
+
+ProxyPass /login/oauth2 http://myconextserver:8080/login/oauth2
+ProxyPassReverse /login/oauth2 http://myconextserver:8080/login/oauth2
+
+ProxyPass /auth/login http://myconextserver:8080/auth/login
+ProxyPassReverse /auth/login http://myconextserver:8080/auth/login
+
+ProxyPass /doLogout http://myconextserver:8080/doLogout
+ProxyPassReverse /doLogout http://myconextserver:8080/doLogout
+
 ProxyPass /internal http://myconextserver:8080/internal
 ProxyPass /actuator http://myconextserver:8080/internal
 ProxyPass /robots.txt http://myconextserver:8080/robots.txt
 ProxyPass /config http://myconextserver:8080/config
 
-<Location />
-  AuthType shibboleth
-  ShibUseHeaders On
-  ShibRequireSession On
-  Require valid-user
-</Location>
-
 DocumentRoot "/var/www"
 
 <Directory "/var/www">
   Require all granted
   Options     -Indexes
 </Directory>
 
-# Public endpoints
-<Location ~ "/(config|register|404|robots.txt)">
-  Require all granted
-</Location>
-
-# After logout / delete
-<Location ~ "/landing(.*)">
-  Require all granted
-</Location>
-
-<Location ~ "/create-from-institution(.*)">
-  Require all granted
-</Location>
-
-<Location ~ "/internal/">
-  Require all granted
-</Location>
-
-# Svelte resources
-<Location ~ "(.*)(eot|svg|webp|ttf|woff2|woff|js|js\.map|css|css\.map|png|jpg|ico)$">
-  Require all granted
-</Location>
-
-<Location ~ "/.well-known/">
-  Require all granted
-</Location>
-
-<Location ~ "/(asset-)?manifest.json$">
-  Require all granted
-</Location>
-
 Header always set X-Frame-Options "DENY"
 Header always set Referrer-Policy "same-origin"
 Header always set X-Content-Type-Options "nosniff"
diff --git a/myconext-gui/package.json b/myconext-gui/package.json
@@ -21,7 +21,7 @@
     "serialize-javascript": "^7.0.5",
     "serve": "^14.2.4",
     "style-loader": "^4.0.0",
-    "svelte": "5.55.5",
+    "svelte": "5.19.3",
     "svelte-loader": "3.2.4",
     "svelte-preprocess": "^6.0.3",
     "svelte-select": "^5.8.3",

diff --git a/myconext-gui/pom.xml b/myconext-gui/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>org.openconext</groupId>
         <artifactId>myconext</artifactId>
-        <version>8.3.1-SNAPSHOT</version>
+        <version>8.4.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <artifactId>myconext-gui</artifactId>