Add optional OIDC avatar fetching from the “picture” claim

[bookstack] / app / Config / oidc.php

diff --git a/app/Config/oidc.php b/app/Config/oidc.php
index 5f61063f63377be49bf4b16eb259b89894f82e44..62f19a119c04bc222d30052a242e5adb2fbcc180 100644 (file)
--- a/app/Config/oidc.php
+++ b/app/Config/oidc.php
@@ -35,12 +35,13 @@ return [
     // OAuth2 endpoints.
     'authorization_endpoint' => env('OIDC_AUTH_ENDPOINT', null),
     'token_endpoint'         => env('OIDC_TOKEN_ENDPOINT', null),
+    'userinfo_endpoint'      => env('OIDC_USERINFO_ENDPOINT', null),
 
-    // OIDC RP-Initiated Logout endpoint
-    // A null value gets the URL from discovery, if active.
+    // OIDC RP-Initiated Logout endpoint URL.
     // A false value force-disables RP-Initiated Logout.
-    // A string value forces the given URL to be used.
-    'end_session_endpoint' => env('OIDC_END_SESSION_ENDPOINT', null),
+    // A true value gets the URL from discovery, if active.
+    // A string value is used as the URL.
+    'end_session_endpoint' => env('OIDC_END_SESSION_ENDPOINT', false),
 
     // Add extra scopes, upon those required, to the OIDC authentication request
     // Multiple values can be provided comma seperated.
@@ -53,4 +54,7 @@ return [
     'groups_claim' => env('OIDC_GROUPS_CLAIM', 'groups'),
     // When syncing groups, remove any groups that no longer match. Otherwise, sync only adds new groups.
     'remove_from_groups' => env('OIDC_REMOVE_FROM_GROUPS', false),
+
+    // When enabled, BookStack will fetch the user’s avatar from the 'picture' claim (SSRF risk if URLs are untrusted).
+    'fetch_avatars' => env('OIDC_FETCH_AVATARS', false),
 ];