Add authentication and SSL/TLS to ServicePulse #2729

warwickschroeder · 2025-11-24T05:14:39Z

Addresses: #1723

Supports JWT bearer tokens, OpenID Connect, OAuth2.0.
Uses Authorisation Code OAuth2 grant type
Authentication config is fed from the ServiceControl API. Defaults to disabled.
Adds config for direct HTTPS hosting. Defaults to disabled.
Adds config for HTTPS redirect and HSTS
Adds config for Forward Headers (reverse proxy). Defaults to "All" headers and "Any" proxies.
Add unit and acceptance tests for the windows service (.net framework) host and the container (.net8) host

src/Frontend/vite.config.ts

This should save ~286KB gzipped

…Add auth detail loading screen.

…me IdPs

…t8 host

abparticular · 2026-01-22T02:00:21Z

docs/authentication-testing.md

+
+## Prerequisites
+
+- ServicePulse built locally (see main README for build instructions)


Suggested change

- ServicePulse built locally (see main README for build instructions)

- ServicePulse built locally (see [main README for instructions](../README.md#setting-up-the-project-for-development))

abparticular · 2026-01-22T02:00:29Z

docs/forwarded-headers-testing.md

+
+## Prerequisites
+
+- ServicePulse built locally (see main README for build instructions)


Suggested change

- ServicePulse built locally (see main README for build instructions)

- ServicePulse built locally (see [main README for instructions](../README.md#setting-up-the-project-for-development))

abparticular · 2026-01-22T02:00:46Z

docs/https-testing.md

+## .NET 8 Prerequisites
+
+- [mkcert](https://github.com/FiloSottile/mkcert) for generating local development certificates
+- ServicePulse built locally (see main README for build instructions)


Suggested change

- ServicePulse built locally (see main README for build instructions)

- ServicePulse built locally (see [main README for instructions](../README.md#setting-up-the-project-for-development))

abparticular · 2026-01-22T02:01:00Z

docs/nginx-testing.md

+
+- [Docker Desktop](https://www.docker.com/products/docker-desktop/) installed and running
+- [mkcert](https://github.com/FiloSottile/mkcert) for generating local development certificates
+- ServicePulse built locally (see main README for build instructions)


Suggested change

- ServicePulse built locally (see main README for build instructions)

- ServicePulse built locally (see [main README for instructions](../README.md#setting-up-the-project-for-development))

abparticular · 2026-01-22T02:01:53Z

docs/authentication-testing.md

+
+This guide provides scenario-based tests for ServicePulse's OIDC authentication. Use this to verify authentication behavior during local development.
+
+For additional details on authentication in ServicePulse, see the [ServicePulse Security](https://docs.particular.net/servicepulse/security/configuration/authentication).


Suggested change

For additional details on authentication in ServicePulse, see the [ServicePulse Security](https://docs.particular.net/servicepulse/security/configuration/authentication).

For additional details on authentication in ServicePulse, see the [ServicePulse Security](https://docs.particular.net/servicepulse/security/configuration/authentication) documentation.

abparticular · 2026-01-22T02:13:50Z

docs/authentication.md

Similar to SC PR, this file can probably be removed

abparticular · 2026-01-22T02:13:58Z

docs/forwarded-headers.md

Similar to SC PR, this file can probably be removed

abparticular · 2026-01-22T02:14:25Z

docs/hosting-guide.md

Similar to SC PR, this file can probably be removed

abparticular · 2026-01-22T02:14:40Z

docs/https-configuration.md

Similar to SC PR, this file can probably be removed

abparticular · 2026-01-22T02:19:45Z

docs/https-testing.md

+
+This guide provides scenario-based tests for ServicePulse's direct HTTPS features. Use this to verify HTTPS behavior without a reverse proxy.
+
+> [!NOTE] HTTP to HTTPS redirection (`RedirectHttpToHttps`) is designed for reverse proxy scenarios where the proxy forwards HTTP requests to ServicePulse. When running with direct HTTPS, ServicePulse only binds to a single port (HTTPS). To test HTTP to HTTPS redirection, see [Reverse Proxy Testing](nginx-testing.md). HSTS should not be tested on localhost because browsers cache the HSTS policy, which could break other local development. To test HSTS, use the [NGINX reverse proxy setup](nginx-testing.md) with a custom hostname (`servicepulse.localhost`).


Suggested change

> [!NOTE] HTTP to HTTPS redirection (`RedirectHttpToHttps`) is designed for reverse proxy scenarios where the proxy forwards HTTP requests to ServicePulse. When running with direct HTTPS, ServicePulse only binds to a single port (HTTPS). To test HTTP to HTTPS redirection, see [Reverse Proxy Testing](nginx-testing.md). HSTS should not be tested on localhost because browsers cache the HSTS policy, which could break other local development. To test HSTS, use the [NGINX reverse proxy setup](nginx-testing.md) with a custom hostname (`servicepulse.localhost`).

> [!NOTE]

> HTTP to HTTPS redirection (`RedirectHttpToHttps`) is designed for reverse proxy scenarios where the proxy forwards HTTP requests to ServicePulse. When running with direct HTTPS, ServicePulse only binds to a single port (HTTPS). To test HTTP to HTTPS redirection, see [Reverse Proxy Testing](nginx-testing.md). HSTS should not be tested on localhost because browsers cache the HSTS policy, which could break other local development. To test HSTS, use the [NGINX reverse proxy setup](nginx-testing.md) with a custom hostname (`servicepulse.localhost`).

johnsimons

I reviewed the vue code and left a few comments

johnsimons · 2026-01-22T04:19:58Z

src/Frontend/eslint-rules/no-raw-fetch.js

Have you considered using TypeScript to create this rule?
It seems you can do it with https://typescript-eslint.io/developers/custom-rules

johnsimons · 2026-01-22T04:25:21Z

src/Frontend/src/assets/navbar.css

+  position: relative;
+  z-index: 1000;


Why did we have to change this?

johnsimons · 2026-01-22T04:38:47Z

src/Frontend/src/stores/MessageStore.ts

Why do we need these changes?

johnsimons · 2026-01-22T04:43:43Z

src/Frontend/src/stores/ServiceControlStore.ts

Why is this file added back?
As part of the refactoring @phase and I did, we removed this.

johnsimons · 2026-01-22T04:46:54Z

src/Frontend/src/views/LoggedOutView.vue

+    <div class="logged-out-content">
+      <h1 class="logged-out-title">You have been signed out</h1>
+      <p class="logged-out-message">You have successfully signed out of ServicePulse.</p>
+      <button v-if="authEnabled" type="button" class="btn btn-primary sign-in-button" @click="handleSignIn">Sign in again</button>


If authEnabled is false, doesn't that mean auth is disabled and hence why would we be rendering this view at all?

johnsimons · 2026-01-22T04:49:36Z

src/Frontend/src/App.vue

+    </div>
+  </div>
+  <div v-else-if="isAuthenticating" class="loading-overlay">
+    <div class="loading-spinner">


We probably should be using the existing LoadingSpinner component?

johnsimons · 2026-01-22T04:56:06Z

src/Frontend/src/App.vue

I wonder what this would look like if we were to wrap App with some other AuthApp component?
So instead of modifying App and add the auth to it, we would create a new AuthApp component that does the auth and then displays <App />.

johnsimons · 2026-01-22T05:00:06Z

package-lock.json

This does not seem to be need?

johnsimons · 2026-01-22T05:01:14Z

.github/workflows/ci.yml

        uses: actions/setup-dotnet@v5.1.0
        with:
-          dotnet-version: 7.0.x
+          dotnet-version: 8.0.x


We're bumping the major of .net.
So we need to bump our major too?

johnsimons · 2026-01-22T05:04:08Z

src/Frontend/test/preconditions/authentication.ts

+  enabled: boolean;
+  client_id: string;
+  authority: string;
+  api_scopes: string;


Should this be a string[]?

warwickschroeder assigned jasontaylordev and warwickschroeder Nov 24, 2025

jasontaylordev changed the title ~~Add initial authentication~~ Add initial authentication to ServicePulse Nov 25, 2025

warwickschroeder commented Nov 26, 2025

View reviewed changes

src/Frontend/vite.config.ts Outdated Show resolved Hide resolved

warwickschroeder force-pushed the genxp-3600-add-authentication branch from da0cc40 to 787ab48 Compare November 26, 2025 07:36

jasontaylordev force-pushed the genxp-3600-add-authentication branch 2 times, most recently from 48fcaed to c5d166e Compare December 1, 2025 04:53

warwickschroeder changed the title ~~Add initial authentication to ServicePulse~~ Add authentication and SSL/TLS to ServicePulse Dec 10, 2025

warwickschroeder marked this pull request as ready for review December 17, 2025 01:10

warwickschroeder requested a review from abparticular December 19, 2025 05:33

jasontaylordev force-pushed the genxp-3600-add-authentication branch from 559660c to 62dd485 Compare January 8, 2026 06:44

johnsimons and others added 19 commits January 15, 2026 11:56

Replace moment with dayjs

13e5b1b

This should save ~286KB gzipped

WIP - Add authentication

9ec501e

Load OIDC configuration from ServiceControl API instead of local env

919d422

Adding support for enabling/disabling authentication

b9d5fff

Add lint rule to check for raw fetch calls.

9f43613

Add user profile menu item. Fix timing issue when SC isnt available. …

9a1cf63

…Add auth detail loading screen.

Allow multiple api scopes. Add audience config which is needed for so…

607f692

…me IdPs

Package updates

9754f0f

Merging

c92d312

Add HTTPS config with documentation

ed1cf35

Update auth and https documentation

8b4b01e

Update doc naming

b4cfcc9

Fix doc namie

fbabd1f

Update auth testing docs. Add anon logout page.

279b0a7

Add authentication tests

d351ecd

Update authentication-testing.md

06f8591

Fix user profile dropdown appearing behind dashboard items

1dcaca6

Doc update

29e1db4

Update package-lock.json

d8e968d

warwickschroeder added 2 commits January 15, 2026 12:06

Move public doco to docs PR

0d07fe8

Update test docs. Split up auth tests to individual scenario tests.

477556a

warwickschroeder force-pushed the genxp-3600-add-authentication branch from 6abcbdc to 477556a Compare January 15, 2026 04:12

warwickschroeder added 6 commits January 15, 2026 12:26

Fix build error

2de747a

Add unit and acceptance tests for ServicePulse .net framework and .ne…

6bcd0e1

…t8 host

Update vulnerable package

d5b9b0e

Update dependancies

a441e74

Fix build issues. Warnings upgraded to error.

b081856

Update ci to check for .net8 test projects (up from .net7)

291bdd4

warwickschroeder mentioned this pull request Jan 19, 2026

Document ServiceControl / ServicePulse support for authentication and SSL/TLS Particular/docs.particular.net#7947

Open

warwickschroeder added 2 commits January 21, 2026 14:18

Update tests from review. Add some comments

ecddb4a

Clean frontend tests. Fix build issues

6f14cc3

warwickschroeder requested review from jasontaylordev and johnsimons January 21, 2026 06:37

abparticular reviewed Jan 22, 2026

View reviewed changes

johnsimons reviewed Jan 22, 2026

View reviewed changes


		## Prerequisites

		- ServicePulse built locally (see main README for build instructions)

	- ServicePulse built locally (see main README for build instructions)
	- ServicePulse built locally (see [main README for instructions](../README.md#setting-up-the-project-for-development))


		This guide provides scenario-based tests for ServicePulse's OIDC authentication. Use this to verify authentication behavior during local development.

		For additional details on authentication in ServicePulse, see the [ServicePulse Security](https://docs.particular.net/servicepulse/security/configuration/authentication).


		This guide provides scenario-based tests for ServicePulse's direct HTTPS features. Use this to verify HTTPS behavior without a reverse proxy.

		> [!NOTE] HTTP to HTTPS redirection (`RedirectHttpToHttps`) is designed for reverse proxy scenarios where the proxy forwards HTTP requests to ServicePulse. When running with direct HTTPS, ServicePulse only binds to a single port (HTTPS). To test HTTP to HTTPS redirection, see [Reverse Proxy Testing](nginx-testing.md). HSTS should not be tested on localhost because browsers cache the HSTS policy, which could break other local development. To test HSTS, use the [NGINX reverse proxy setup](nginx-testing.md) with a custom hostname (`servicepulse.localhost`).

	> [!NOTE] HTTP to HTTPS redirection (`RedirectHttpToHttps`) is designed for reverse proxy scenarios where the proxy forwards HTTP requests to ServicePulse. When running with direct HTTPS, ServicePulse only binds to a single port (HTTPS). To test HTTP to HTTPS redirection, see [Reverse Proxy Testing](nginx-testing.md). HSTS should not be tested on localhost because browsers cache the HSTS policy, which could break other local development. To test HSTS, use the [NGINX reverse proxy setup](nginx-testing.md) with a custom hostname (`servicepulse.localhost`).
	> [!NOTE]
	> HTTP to HTTPS redirection (`RedirectHttpToHttps`) is designed for reverse proxy scenarios where the proxy forwards HTTP requests to ServicePulse. When running with direct HTTPS, ServicePulse only binds to a single port (HTTPS). To test HTTP to HTTPS redirection, see [Reverse Proxy Testing](nginx-testing.md). HSTS should not be tested on localhost because browsers cache the HSTS policy, which could break other local development. To test HSTS, use the [NGINX reverse proxy setup](nginx-testing.md) with a custom hostname (`servicepulse.localhost`).

Add authentication and SSL/TLS to ServicePulse #2729

Are you sure you want to change the base?

Add authentication and SSL/TLS to ServicePulse #2729

Uh oh!

Conversation

warwickschroeder commented Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

johnsimons left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

warwickschroeder commented Nov 24, 2025 •

edited

Loading