oidc

El dominio oidc tiene 10 acciones. En la superficie meta se alcanzan todas a través de arcane_oidc; en la individual, cada una es una herramienta propia; en la dinámica se ejecutan con arcane_execute_action y el ID canónico.

Resumen

Acción	Título	Tipo
oidc.auth_url	Get OIDC auth URL	lectura
oidc.callback	Handle OIDC callback	escritura
oidc.config	Get OIDC config	lectura
oidc.device_auth_start	Initiate OIDC device authorization	escritura
oidc.device_token_exchange	Exchange device code for tokens	escritura
oidc.role_mapping_create	Create an OIDC role mapping	escritura
oidc.role_mapping_delete	Delete an OIDC role mapping	destructiva
oidc.role_mapping_list	List OIDC group-to-role mappings	lectura
oidc.role_mapping_update	Update an OIDC role mapping	escritura
oidc.status	Get OIDC status	lectura

Acciones

oidc.auth_url

Get OIDC auth URL

Generate an OIDC authorization URL for login

• Tipo: lectura
• Parámetros obligatorios: redirectUri
• Meta-herramienta: arcane_oidc con "action": "auth_url"
• Herramienta individual: arcane_oidc_auth_url
• Ruta de Arcane: POST /api/oidc/url
• ID de operación: get-oidc-auth-url
• Uso: Requires OIDC to be enabled (settings oidcEnabled, oidcClientId, oidcIssuerUrl). The result carries the oidc_state cookie Arcane sets under cookies.oidc_state. Pass it to oidc.callback as oidcState.
• Acciones relacionadas: oidc.callback, oidc.config, settings.update

oidc.callback

Handle OIDC callback

Process the OIDC callback and complete authentication

• Tipo: escritura
• Parámetros obligatorios: code, state
• Meta-herramienta: arcane_oidc con "action": "callback"
• Herramienta individual: arcane_oidc_callback
• Ruta de Arcane: POST /api/oidc/callback
• ID de operación: handle-oidc-callback
• Uso: Completes a browser authorization-code login: pass the provider’s code and state plus the oidc_state cookie value from oidc.auth_url as oidcState. Rate-limited to 5 requests/min per client IP. Returns status authenticated with token, refreshToken and user, or status mfa_required with a passkey challenge. The user’s group-claim role mappings are re-applied on every login.
• Acciones relacionadas: oidc.auth_url, oidc.role_mapping_list

oidc.config

Get OIDC config

Get the OIDC client configuration

• Tipo: lectura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_oidc con "action": "config"
• Herramienta individual: arcane_oidc_config
• Ruta de Arcane: GET /api/oidc/config
• ID de operación: get-oidc-config
• Uso: Public, no session needed. Returns the client-side OIDC settings (clientId, issuerUrl, redirectUri ending in /auth/oidc/callback, explicit endpoints, scopes, but never the secret). Fails with 400 ‘OIDC authentication is disabled’ when OIDC is off or neither client ID nor issuer URL is set. Use oidc.status for env-override info and settings.update to configure.
• Acciones relacionadas: oidc.status, oidc.auth_url, settings.update

oidc.device_auth_start

Initiate OIDC device authorization

Start the device authorization flow for CLI authentication

• Tipo: escritura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_oidc con "action": "device_auth_start"
• Herramienta individual: arcane_oidc_device_auth_start
• Ruta de Arcane: POST /api/oidc/device/code
• ID de operación: initiate-oidc-device-auth
• Uso: Requires OIDC to be enabled. Starts the device flow at the provider’s device_authorization_endpoint (setting or discovery). Show the user userCode and verificationUri, then poll oidc.device_token_exchange with the returned deviceCode.
• Acciones relacionadas: oidc.device_token_exchange, oidc.config

oidc.device_token_exchange

Exchange device code for tokens

Exchange a device code for authentication tokens

• Tipo: escritura
• Parámetros obligatorios: deviceCode
• Meta-herramienta: arcane_oidc con "action": "device_token_exchange"
• Herramienta individual: arcane_oidc_device_token_exchange
• Ruta de Arcane: POST /api/oidc/device/token
• ID de operación: exchange-oidc-device-token
• Uso: Poll with deviceCode from oidc.device_auth_start until the user approves at the provider. Errors authorization_pending and slow_down (HTTP 400) mean retry later, expired_token means start again, access_denied and mfa_required (HTTP 403: passkey-MFA accounts cannot use the device flow, use an API key instead). On success returns token, refreshToken, expiresAt and user, and creates or updates the local user and its OIDC role assignments.
• Acciones relacionadas: oidc.device_auth_start, api_key.my_create

oidc.role_mapping_create

Create an OIDC role mapping

• Tipo: escritura
• Parámetros obligatorios: claimValue, roleId
• Meta-herramienta: arcane_oidc con "action": "role_mapping_create"
• Herramienta individual: arcane_oidc_role_mapping_create
• Ruta de Arcane: POST /api/oidc/role-mappings
• ID de operación: create-oidc-role-mapping
• Uso: Global admin only. Maps a value of the OIDC groups claim (setting oidcGroupsClaim, default groups) to roleId from role.list. Optional environmentId (from environment.list) scopes the grant, omit for global. Applied as source=‘oidc’ role assignments at each user’s next OIDC login, not retroactively.
• Acciones relacionadas: oidc.role_mapping_list, oidc.role_mapping_update, role.list, environment.list

oidc.role_mapping_delete

Delete an OIDC role mapping

• Tipo: destructiva — exige confirm: true
• Parámetros obligatorios: id
• Meta-herramienta: arcane_oidc con "action": "role_mapping_delete"
• Herramienta individual: arcane_oidc_role_mapping_delete
• Ruta de Arcane: DELETE /api/oidc/role-mappings/{id}
• ID de operación: delete-oidc-role-mapping
• Uso: Global admin only. id from oidc.role_mapping_list. Rows with source env (declared by the OIDC_ROLE_MAPPINGS env var) are read-only and return 409. Role assignments users already received stay until their next OIDC login re-syncs them.
• Acciones relacionadas: oidc.role_mapping_list, role.user_assignments_get

oidc.role_mapping_list

List OIDC group-to-role mappings

Returns every mapping. On each OIDC login the user’s group claim is matched against ClaimValue and matching rows become source=‘oidc’ role assignments.

• Tipo: lectura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_oidc con "action": "role_mapping_list"
• Herramienta individual: arcane_oidc_role_mapping_list
• Ruta de Arcane: GET /api/oidc/role-mappings
• ID de operación: list-oidc-role-mappings
• Uso: Global admin only. Each item holds id, claimValue, roleId, optional environmentId and source (manual = editable, env = from OIDC_ROLE_MAPPINGS, read-only). Use the id with oidc.role_mapping_update or oidc.role_mapping_delete.
• Acciones relacionadas: oidc.role_mapping_create, oidc.role_mapping_update, oidc.role_mapping_delete, role.list

oidc.role_mapping_update

Update an OIDC role mapping

• Tipo: escritura
• Parámetros obligatorios: id, claimValue, roleId
• Meta-herramienta: arcane_oidc con "action": "role_mapping_update"
• Herramienta individual: arcane_oidc_role_mapping_update
• Ruta de Arcane: PUT /api/oidc/role-mappings/{id}
• ID de operación: update-oidc-role-mapping
• Uso: Global admin only. id from oidc.role_mapping_list. Full replace: claimValue and roleId are required, and omitting environmentId makes the mapping global. Rows with source env return 409. Takes effect at each user’s next OIDC login.
• Acciones relacionadas: oidc.role_mapping_list, role.list, environment.list

oidc.status

Get OIDC status

Get the current OIDC configuration status

• Tipo: lectura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_oidc con "action": "status"
• Herramienta individual: arcane_oidc_status
• Ruta de Arcane: GET /api/oidc/status
• ID de operación: get-oidc-status
• Uso: Public, no session needed. Returns envForced (oidcEnabled pinned by environment variable), envConfigured (env client ID and issuer set, only computed when envForced), mergeAccounts, providerName and providerLogoUrl. It does not say whether OIDC is enabled in settings. Read oidcEnabled via settings.get or try oidc.config.
• Acciones relacionadas: oidc.config, settings.get