Fixes #1187 - Restructure and overhaul Security > Third-Party Applications page - #1300
Open
ralf401 wants to merge 18 commits into
Open
Fixes #1187 - Restructure and overhaul Security > Third-Party Applications page#1300ralf401 wants to merge 18 commits into
ralf401 wants to merge 18 commits into
Conversation
15 tasks
ArtifactsProduced during runtime |
Replace outdated walkthrough (App Review 'Make public' checkbox, dev.twitter-era screenshots) with current Meta App Dashboard flow: use case selection, email permission, Valid OAuth Redirect URIs, app credentials, and Development vs Live mode note. Behavior claims verified against Zammad source: email permission requirement (omniauth-facebook requests scope 'email' and fetches 'name,email'; Authorization matches users by email), callback URL (/auth/facebook/callback via auth_provider_all) and app_id/app_secret fields (auth_facebook_credentials seed).
ralf401
force-pushed
the
rsc/fixes/1187
branch
from
September 9, 2026 06:16
011dac1 to
84bd74c
Compare
Replace 'quick login' walkthrough with current GitHub OAuth app flow: Developer settings > OAuth apps > New OAuth App, with homepage and callback URL fields as definition blocks. Old screenshots (register app, config, login page, authorize page) removed in follow-up; content verified against docs.github.com Creating an OAuth app and against Zammad source: callback URL (/auth/github/callback via auth_provider_all), App ID/App Secret fields (auth_github_credentials seed, Client ID/Client Secret on GitHub's side) and first-login authorization prompt.
Apply user-verified wording tweaks from following the actual flow. Delete the four old GitHub screenshots removed from the page in the rewrite (register, config, login icon, authorize screen).
Replace 'quick login' walkthrough with current GitLab OAuth application flow (avatar > Edit profile > Access > Applications), definition blocks for Name, Redirect URI and scopes. Content verified against docs.gitlab.com OAuth provider docs and Zammad source: read_user scope (omniauth initializer), callback URL (/auth/gitlab/callback via auth_provider_all), Site field for self-hosted instances (auth_gitlab_credentials seed) and Application ID/Secret mapping. Removed four stale screenshots.
Replace OAuth consent screen walkthrough with current Google Auth Platform flow: project setup, GET STARTED application registration (app name, support email, audience, contact email), separate OAuth client creation (Web application type, authorized redirect URIs). Content verified against Google Cloud console help (Manage OAuth Clients, Get started with Google Auth Platform) and Zammad source: callback URL /auth/google_oauth2/callback (auth_provider_all), Client ID/Client secret fields (auth_google_oauth2_credentials seed matches Google's labels directly). Secret visibility caveat included (secrets hashed since 2025). Removed three stale screenshots.
Start from the pre-release state of the page (#1269 overhaul) and apply cosmetic changes only: remove the emoji from the M365 channel note, drop the login-screen figure (screenshot removed with the other outdated media), keep everything else as shipped.
Start from the pre-release state and apply cosmetic changes only: Admin Panel -> admin settings terminology, nav path to house-style italics with hyphenated Third-party Applications, overlong section underline trimmed to title length. Content unchanged.
Merge the thin Configuration Guides section into Basic Configuration (the page already referenced it), keeping the saml-guides anchor. Replace the <your-zammad-url> placeholder holdout, fix straight-quote Submit button, drop double blank line. Content unchanged otherwise.
Numbered H2s (1. Register...) renamed to outcome-named headings without the Step X: prefix, matching the other provider pages. UI elements bold, button names double backticks, nav path segments italic, straight quotes replaced. Oxford comma removed. Admonition indentation fixed (hint body needs 3-space indent). No content changes. Same Step-prefix removal applied to the Keycloak sub-page and the OpenID Connect page.
Replace dev.twitter.com-era walkthrough (wrong channel callback URL, channel DM permissions, dead screenshots) with current X developer console flow. Keep the Twitter naming (matches Zammad UI labels). Content verified against docs.x.com (developer apps, OAuth API reference) and Zammad source: login callback URL is /auth/twitter/callback (auth_provider_all), not the channel callback the old page documented; credentials map to Twitter Key/Twitter Secret fields (auth_twitter_credentials seed); no permissions needed beyond the API Key and Secret (omniauth-twitter OAuth 1.0a). Added warning that X recommends OAuth 2.0 for new apps and gates API access. Removed five stale screenshots.
New page for the previously undocumented LinkedIn provider, following the set's template (intro, warning, app registration, credentials, callback URL, Zammad configuration). Content verified against LinkedIn developer documentation (Sign In with LinkedIn, Sign In with LinkedIn using OpenID Connect) and Zammad source: callback URL /auth/linkedin/callback (auth_provider_all), App ID/App Secret fields (auth_linkedin_credentials seed), legacy r_liteprofile/r_emailaddress scopes (omniauth-linkedin-oauth2). Includes warning that these scopes are deprecated since August 2023 and new apps may need the OpenID Connect provider route instead. LinkedIn graduates from the undocumented-providers list on the overview page (Weibo remains).
New page for the previously undocumented Weibo provider, kept deliberately short: intro, warning about the third-party omniauth-weibo-oauth2 gem (latest release 0.5.3, predates recent platform changes, Chinese-only developer portal, app review required), callback URL and credential mapping. No portal walkthrough to avoid documenting a UI that cannot be verified. Weibo graduates from the undocumented-providers list on the overview page - the list is removed entirely as all providers are now documented. Verified against Zammad source: callback /auth/weibo/callback (auth_provider_all), App ID/App Secret fields (auth_weibo_credentials seed uses client_id/client_secret), gem endpoints api.weibo.com/oauth2/* and Open API v2 profile endpoints.
ralf401
changed the title
Explain that Site is https://gitlab.com for the hosted service or the self-hosted instance URL otherwise. The two GitLab checkboxes (Confidential, Device authorization grant) are not documented: both defaults work with Zammad's OAuth 2.0 authorization-code flow, and the Confidential toggle only matters for public clients which a server-side app like Zammad is not.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.