Merge pull request #474 from os2display/feature/openid-connect-bundle-5

chore(deps): upgrade itk-dev/openid-connect-bundle to 5.0

Author: tuj

.env

@@ -146,6 +146,11 @@ RELATIONS_CHECKSUM_ENABLED=true
 
 ###> itk-dev/openid-connect-bundle ###
 # See docs/feed/openid-connect.md for variable explanations.
+# Total HTTP request timeout (seconds) for calls to the OIDC providers
+# (discovery, JWKS, token exchange). Bounds a hung/slow IdP so it cannot
+# tie up a php-fpm worker indefinitely. Applies to both providers.
+OIDC_HTTP_TIMEOUT=5
+
 # internal provider (admin login)
 # URL to OIDC provider's metadata/discovery endpoint.
 INTERNAL_OIDC_METADATA_URL=INTERNAL_OIDC_METADATA_URL

CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+- Upgraded `itk-dev/openid-connect-bundle` to 5.0 (and `itk-dev/openid-connect` to 5.0). Migrated the
+  OIDC exception catches in `AuthOidcController` and `AzureOidcAuthenticator` to the new
+  `OpenIdConnectExceptionInterface` marker, since concrete exceptions no longer extend the deprecated
+  `ItkOpenIdConnectException`. Added regression tests covering the exception-mapping branches and the
+  authenticator's claim-to-tenant-role provisioning and de-provisioning logic.
+- Bounded OIDC provider HTTP calls (discovery, JWKS, token exchange) with an explicit
+  `http_client_options.timeout` on both providers, configurable via the new `OIDC_HTTP_TIMEOUT` env var
+  (default 5s). Previously no timeout was set anywhere in the chain, so Guzzle waited indefinitely and a
+  hung/slow IdP could tie up a php-fpm worker.
 - Removed the deprecated feed types `SparkleIOFeedType`, `EventDatabaseApiFeedType` and `KobaFeedType`.
   Made the unknown-feed-type handling consistent: **reads degrade, writes are rejected.** Feed sources
   (and feeds) that reference a removed type keep loading — item and collection reads return them with no

composer.json

@@ -21,7 +21,7 @@
         "doctrine/doctrine-migrations-bundle": "^3.1",
         "doctrine/orm": "^2.9",
         "gesdinet/jwt-refresh-token-bundle": "^1.0",
-        "itk-dev/openid-connect-bundle": "^4.1",
+        "itk-dev/openid-connect-bundle": "^5.0",
         "justinrainbow/json-schema": "^5.2",
         "kubawerlos/php-cs-fixer-custom-fixers": "^3.11",
         "lexik/jwt-authentication-bundle": "^2.14",