Skip to content

Commit d2843aa

Browse files
brendan-kellamclaude
brendan-kellam
and
claude
authored
chore: remove deprecated env-var identity provider configuration (#1297)
* chore: remove deprecated env-var identity provider configuration Removes support for configuring GitHub, GitLab, Google, Okta, Keycloak, and Microsoft Entra ID identity providers via the deprecated AUTH_EE_*_CLIENT_ID/ SECRET/etc. environment variables. These providers must now be defined through the identityProviders section of the config file. GCP IAP env vars (AUTH_EE_GCP_IAP_ENABLED / AUTH_EE_GCP_IAP_AUDIENCE) are unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: add CHANGELOG entry for #1297 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feedback * docs: document AUTH_EE_* identity provider removal in v4-to-v5 guide Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * s * docs: clarify AUTH_EE_* removal lands in v5.0.2 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * changelog --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 parent cfab0cf commit d2843aa

5 files changed

Lines changed: 67 additions & 190 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
### Changed
11+
- Removed support for configuring the GitHub, GitLab, Google, Okta, Keycloak, and Microsoft Entra ID identity providers via the deprecated `AUTH_EE_*` environment variables. See the [v5 migration guide](http://docs.sourcebot.dev/docs/upgrade/v4-to-v5-guide#identity-providers-must-be-configured-via-the-config-file) for more details. [#1297](https://github.com/sourcebot-dev/sourcebot/pull/1297)
12+
- Anthropic thinking mode (adaptive vs. extended) is now resolved from the model's capabilities via the Anthropic Models API instead of a hardcoded model list. [#1294](https://github.com/sourcebot-dev/sourcebot/pull/1294)
13+
1014
### Added
1115
- [EE] Added prompt caching for Ask Sourcebot. For Anthropic models, the static prompt prefix (tool definitions, system prompt, and conversation history) is marked with a cache breakpoint so it is billed at the provider's discounted cache-read rate on subsequent agent steps and follow-up turns. Toggle with `SOURCEBOT_CHAT_PROMPT_CACHING_ENABLED` (default `true`). [#1278](https://github.com/sourcebot-dev/sourcebot/pull/1278)
1216
- [EE] Added a cached-token breakdown to the Ask Sourcebot message details, showing what share of the input tokens were served from the model provider's prompt cache. [#1278](https://github.com/sourcebot-dev/sourcebot/pull/1278)
1317
- Added `isLanguageModelConfigured` to the service ping, indicating whether at least one language model is configured. [#1296](https://github.com/sourcebot-dev/sourcebot/pull/1296)
1418

15-
### Changed
16-
- Anthropic thinking mode (adaptive vs. extended) is now resolved from the model's capabilities via the Anthropic Models API instead of a hardcoded model list. [#1294](https://github.com/sourcebot-dev/sourcebot/pull/1294)
17-
1819
### Fixed
1920
- Upgraded `protobufjs` to `^7.6.2`. [#1281](https://github.com/sourcebot-dev/sourcebot/pull/1281)
2021
- Upgraded `picomatch` to `^4.0.4`. [#1283](https://github.com/sourcebot-dev/sourcebot/pull/1283)

‎docs/docs/upgrade/v4-to-v5-guide.mdx‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,67 @@ docker exec sourcebot rm /data/.sourcebot/.secret /data/.sourcebot/.authjs-secre
176176
Sourcebot warns at startup if either file is still present.
177177
</Expandable>
178178

179+
### Identity providers must be configured via the config file
180+
<Note>
181+
**Who's affected:** Deployments that configure GitHub, GitLab, Google, Okta, Keycloak, or Microsoft Entra ID single sign-on through the deprecated `AUTH_EE_*` environment variables. Deployments that already define these providers in the [`identityProviders`](/docs/configuration/idp) config file section are not affected.
182+
</Note>
183+
184+
#### Description
185+
186+
In v4, you could configure these identity providers using `AUTH_EE_*` environment variables (for example `AUTH_EE_GITHUB_CLIENT_ID`). Those variables were deprecated in favor of the [`identityProviders`](/docs/configuration/idp) section of the config file. Starting in v5.0.2, the environment variable path has been removed. Sourcebot no longer reads these variables, and any provider configured only through them will stop appearing on the login screen. This also applies if you are upgrading from an earlier v5 release (v5.0.0 or v5.0.1), where these variables were still supported.
187+
188+
The following environment variables are no longer read:
189+
190+
| Provider | Removed environment variables |
191+
| :------- | :---------------------------- |
192+
| GitHub | `AUTH_EE_GITHUB_CLIENT_ID`, `AUTH_EE_GITHUB_CLIENT_SECRET`, `AUTH_EE_GITHUB_BASE_URL` |
193+
| GitLab | `AUTH_EE_GITLAB_CLIENT_ID`, `AUTH_EE_GITLAB_CLIENT_SECRET`, `AUTH_EE_GITLAB_BASE_URL` |
194+
| Google | `AUTH_EE_GOOGLE_CLIENT_ID`, `AUTH_EE_GOOGLE_CLIENT_SECRET` |
195+
| Okta | `AUTH_EE_OKTA_CLIENT_ID`, `AUTH_EE_OKTA_CLIENT_SECRET`, `AUTH_EE_OKTA_ISSUER` |
196+
| Keycloak | `AUTH_EE_KEYCLOAK_CLIENT_ID`, `AUTH_EE_KEYCLOAK_CLIENT_SECRET`, `AUTH_EE_KEYCLOAK_ISSUER` |
197+
| Microsoft Entra ID | `AUTH_EE_MICROSOFT_ENTRA_ID_CLIENT_ID`, `AUTH_EE_MICROSOFT_ENTRA_ID_CLIENT_SECRET`, `AUTH_EE_MICROSOFT_ENTRA_ID_ISSUER` |
198+
199+
#### Action Items
200+
201+
<Expandable title="Migrating to the config file">
202+
<br/>
203+
204+
Move each affected provider into the `identityProviders` array in your [config file](/docs/configuration/config-file). You don't need to rotate any secrets. Reference your existing environment variable values from the config using [tokens](/docs/configuration/config-file#tokens), keeping the same variable names if you like.
205+
206+
For example, a GitHub provider previously configured with environment variables:
207+
208+
```bash wrap icon="terminal"
209+
AUTH_EE_GITHUB_CLIENT_ID='your-client-id'
210+
AUTH_EE_GITHUB_CLIENT_SECRET='your-client-secret'
211+
```
212+
213+
becomes the following in the config file:
214+
215+
```json wrap icon="code"
216+
{
217+
"$schema": "https://raw.githubusercontent.com/sourcebot-dev/sourcebot/main/schemas/v3/index.json",
218+
"identityProviders": [
219+
{
220+
"provider": "github",
221+
"purpose": "sso",
222+
"clientId": {
223+
"env": "AUTH_EE_GITHUB_CLIENT_ID"
224+
},
225+
"clientSecret": {
226+
"env": "AUTH_EE_GITHUB_CLIENT_SECRET"
227+
}
228+
}
229+
]
230+
}
231+
```
232+
233+
<Note>
234+
Set `purpose` to `sso` to keep the provider usable for login. For providers that take an issuer (Okta, Keycloak, Microsoft Entra ID), add an `issuer` token. For self-hosted GitHub or GitLab, add a `baseUrl` string (this replaces `AUTH_EE_GITHUB_BASE_URL` and `AUTH_EE_GITLAB_BASE_URL`).
235+
</Note>
236+
237+
See the [external identity providers](/docs/configuration/idp) docs for the full per-provider config reference.
238+
</Expandable>
239+
179240

180241
## Upgrading
181242

‎packages/backend/src/ee/tokenRefresh.ts‎

Lines changed: 2 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -155,19 +155,9 @@ const refreshOAuthToken = async (
155155
const identityProviders = config?.identityProviders ?? [];
156156
const providerConfigs = identityProviders.filter(idp => idp.provider === provider);
157157

158-
// If no provider configs in the config file, try deprecated env vars.
158+
// No provider configs in the config file — nothing to refresh against.
159159
if (providerConfigs.length === 0) {
160-
const envCredentials = getDeprecatedEnvCredentials(provider);
161-
if (envCredentials) {
162-
logger.debug(`Using deprecated env vars for ${provider} token refresh`);
163-
const result = await tryRefreshToken(provider, refreshToken, envCredentials);
164-
if (result) {
165-
return result;
166-
}
167-
logger.error(`Failed to refresh ${provider} token using deprecated env credentials`);
168-
return null;
169-
}
170-
logger.error(`No provider config or env credentials found for: ${provider}`);
160+
logger.error(`No provider config found for: ${provider}`);
171161
return null;
172162
}
173163

@@ -291,26 +281,4 @@ const tryRefreshToken = async (
291281
}
292282

293283
return result.data;
294-
}
295-
296-
/**
297-
* Get credentials from deprecated environment variables.
298-
* This is for backwards compatibility with deployments using env vars instead of config file.
299-
*/
300-
const getDeprecatedEnvCredentials = (provider: string): ProviderCredentials | null => {
301-
if (provider === 'github' && env.AUTH_EE_GITHUB_CLIENT_ID && env.AUTH_EE_GITHUB_CLIENT_SECRET) {
302-
return {
303-
clientId: env.AUTH_EE_GITHUB_CLIENT_ID,
304-
clientSecret: env.AUTH_EE_GITHUB_CLIENT_SECRET,
305-
baseUrl: env.AUTH_EE_GITHUB_BASE_URL,
306-
};
307-
}
308-
if (provider === 'gitlab' && env.AUTH_EE_GITLAB_CLIENT_ID && env.AUTH_EE_GITLAB_CLIENT_SECRET) {
309-
return {
310-
clientId: env.AUTH_EE_GITLAB_CLIENT_ID,
311-
clientSecret: env.AUTH_EE_GITLAB_CLIENT_SECRET,
312-
baseUrl: env.AUTH_EE_GITLAB_BASE_URL,
313-
};
314-
}
315-
return null;
316284
}

‎packages/shared/src/env.server.ts‎

Lines changed: 0 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -385,94 +385,6 @@ const options = {
385385
* ignored.
386386
*/
387387
SOURCEBOT_TELEMETRY_PII_COLLECTION_ENABLED: booleanSchema.default('false'),
388-
389-
//// DEPRECATED ////
390-
391-
/**
392-
* @deprecated This setting is deprecated. Please use the `identityProviders` section of the config file instead.
393-
*/
394-
AUTH_EE_GITHUB_CLIENT_ID: z.string().optional(),
395-
396-
/**
397-
* @deprecated This setting is deprecated. Please use the `identityProviders` section of the config file instead.
398-
*/
399-
AUTH_EE_GITHUB_CLIENT_SECRET: z.string().optional(),
400-
401-
/**
402-
* @deprecated This setting is deprecated. Please use the `identityProviders` section of the config file instead.
403-
*/
404-
AUTH_EE_GITHUB_BASE_URL: z.string().optional(),
405-
406-
/**
407-
* @deprecated This setting is deprecated. Please use the `identityProviders` section of the config file instead.
408-
*/
409-
AUTH_EE_GITLAB_CLIENT_ID: z.string().optional(),
410-
411-
/**
412-
* @deprecated This setting is deprecated. Please use the `identityProviders` section of the config file instead.
413-
*/
414-
AUTH_EE_GITLAB_CLIENT_SECRET: z.string().optional(),
415-
416-
/**
417-
* @deprecated This setting is deprecated. Please use the `identityProviders` section of the config file instead.
418-
*/
419-
AUTH_EE_GITLAB_BASE_URL: z.string().default("https://gitlab.com"),
420-
421-
/**
422-
* @deprecated This setting is deprecated. Please use the `identityProviders` section of the config file instead.
423-
*/
424-
AUTH_EE_GOOGLE_CLIENT_ID: z.string().optional(),
425-
426-
/**
427-
* @deprecated This setting is deprecated. Please use the `identityProviders` section of the config file instead.
428-
*/
429-
AUTH_EE_GOOGLE_CLIENT_SECRET: z.string().optional(),
430-
431-
/**
432-
* @deprecated This setting is deprecated. Please use the `identityProviders` section of the config file instead.
433-
*/
434-
AUTH_EE_OKTA_CLIENT_ID: z.string().optional(),
435-
436-
/**
437-
* @deprecated This setting is deprecated. Please use the `identityProviders` section of the config file instead.
438-
*/
439-
AUTH_EE_OKTA_CLIENT_SECRET: z.string().optional(),
440-
441-
/**
442-
* @deprecated This setting is deprecated. Please use the `identityProviders` section of the config file instead.
443-
*/
444-
AUTH_EE_OKTA_ISSUER: z.string().optional(),
445-
446-
/**
447-
* @deprecated This setting is deprecated. Please use the `identityProviders` section of the config file instead.
448-
*/
449-
AUTH_EE_KEYCLOAK_CLIENT_ID: z.string().optional(),
450-
451-
/**
452-
* @deprecated This setting is deprecated. Please use the `identityProviders` section of the config file instead.
453-
*/
454-
AUTH_EE_KEYCLOAK_CLIENT_SECRET: z.string().optional(),
455-
456-
/**
457-
* @deprecated This setting is deprecated. Please use the `identityProviders` section of the config file instead.
458-
*/
459-
AUTH_EE_KEYCLOAK_ISSUER: z.string().optional(),
460-
461-
/**
462-
* @deprecated This setting is deprecated. Please use the `identityProviders` section of the config file instead.
463-
*/
464-
AUTH_EE_MICROSOFT_ENTRA_ID_CLIENT_ID: z.string().optional(),
465-
466-
/**
467-
* @deprecated
468-
* This setting is deprecated. Please use the `identityProviders` section of the config file instead.
469-
*/
470-
AUTH_EE_MICROSOFT_ENTRA_ID_CLIENT_SECRET: z.string().optional(),
471-
472-
/**
473-
* @deprecated This setting is deprecated. Please use the `identityProviders` section of the config file instead.
474-
*/
475-
AUTH_EE_MICROSOFT_ENTRA_ID_ISSUER: z.string().optional(),
476388
},
477389
runtimeEnv,
478390
emptyStringAsUndefined: true,

‎packages/web/src/ee/features/sso/sso.ts‎

Lines changed: 0 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -160,72 +160,7 @@ export const getEEIdentityProviders = async (): Promise<IdentityProvider[]> => {
160160
}
161161
}
162162

163-
// @deprecate in favor of defining identity providers throught the identityProvider object in the config file. This was done to allow for more control over
164-
// which identity providers are defined and their purpose. We've left this logic here to support backwards compat with deployments that expect these env vars,
165-
// but this logic will be removed in the future
166-
// We only go through this path if no identityProviders are defined in the config to prevent accidental duplication of providers
167163
if (identityProviders.length == 0) {
168-
if (env.AUTH_EE_GITHUB_CLIENT_ID && env.AUTH_EE_GITHUB_CLIENT_SECRET) {
169-
const baseUrl = (env.AUTH_EE_GITHUB_BASE_URL ?? 'https://github.com').replace(/\/+$/, '');
170-
providers.push({
171-
provider: await createGitHubProvider(
172-
env.AUTH_EE_GITHUB_CLIENT_ID,
173-
env.AUTH_EE_GITHUB_CLIENT_SECRET,
174-
baseUrl
175-
),
176-
purpose: "sso",
177-
issuerUrl: baseUrl
178-
});
179-
}
180-
181-
if (env.AUTH_EE_GITLAB_CLIENT_ID && env.AUTH_EE_GITLAB_CLIENT_SECRET) {
182-
const baseUrl = (env.AUTH_EE_GITLAB_BASE_URL ?? 'https://gitlab.com').replace(/\/+$/, '');
183-
providers.push({
184-
provider: await createGitLabProvider(
185-
env.AUTH_EE_GITLAB_CLIENT_ID,
186-
env.AUTH_EE_GITLAB_CLIENT_SECRET,
187-
baseUrl,
188-
),
189-
purpose: "sso",
190-
issuerUrl: baseUrl
191-
});
192-
}
193-
194-
if (env.AUTH_EE_GOOGLE_CLIENT_ID && env.AUTH_EE_GOOGLE_CLIENT_SECRET) {
195-
providers.push({
196-
provider: createGoogleProvider(env.AUTH_EE_GOOGLE_CLIENT_ID, env.AUTH_EE_GOOGLE_CLIENT_SECRET),
197-
purpose: "sso",
198-
issuerUrl: 'https://accounts.google.com'
199-
});
200-
}
201-
202-
if (env.AUTH_EE_OKTA_CLIENT_ID && env.AUTH_EE_OKTA_CLIENT_SECRET && env.AUTH_EE_OKTA_ISSUER) {
203-
const issuer = env.AUTH_EE_OKTA_ISSUER.replace(/\/+$/, '');
204-
providers.push({
205-
provider: createOktaProvider(env.AUTH_EE_OKTA_CLIENT_ID, env.AUTH_EE_OKTA_CLIENT_SECRET, issuer),
206-
purpose: "sso",
207-
issuerUrl: issuer
208-
});
209-
}
210-
211-
if (env.AUTH_EE_KEYCLOAK_CLIENT_ID && env.AUTH_EE_KEYCLOAK_CLIENT_SECRET && env.AUTH_EE_KEYCLOAK_ISSUER) {
212-
const issuer = env.AUTH_EE_KEYCLOAK_ISSUER.replace(/\/+$/, '');
213-
providers.push({
214-
provider: createKeycloakProvider(env.AUTH_EE_KEYCLOAK_CLIENT_ID, env.AUTH_EE_KEYCLOAK_CLIENT_SECRET, issuer),
215-
purpose: "sso",
216-
issuerUrl: issuer
217-
});
218-
}
219-
220-
if (env.AUTH_EE_MICROSOFT_ENTRA_ID_CLIENT_ID && env.AUTH_EE_MICROSOFT_ENTRA_ID_CLIENT_SECRET && env.AUTH_EE_MICROSOFT_ENTRA_ID_ISSUER) {
221-
const issuer = env.AUTH_EE_MICROSOFT_ENTRA_ID_ISSUER.replace(/\/+$/, '');
222-
providers.push({
223-
provider: createMicrosoftEntraIDProvider(env.AUTH_EE_MICROSOFT_ENTRA_ID_CLIENT_ID, env.AUTH_EE_MICROSOFT_ENTRA_ID_CLIENT_SECRET, issuer),
224-
purpose: "sso",
225-
issuerUrl: issuer
226-
});
227-
}
228-
229164
if (env.AUTH_EE_GCP_IAP_ENABLED && env.AUTH_EE_GCP_IAP_AUDIENCE) {
230165
providers.push({
231166
provider: createGCPIAPProvider(env.AUTH_EE_GCP_IAP_AUDIENCE),

0 commit comments

Comments
 (0)