Tribu

What’s changed

• Single Sign-On via OpenID Connect (#167, #193). Tribu now delegates authentication to any OIDC-compatible identity provider with PKCE- protected authorization-code flow and JWKS-verified ID tokens. Provider presets ship for Authentik, Zitadel, and Keycloak plus a generic fallback. A new Admin > Single Sign-On panel covers issuer, client credentials, scopes, button label, and an inline test of the provider’s discovery document. Invitation links can finish onboarding entirely through the IdP. Password login can be disabled once SSO has proven itself end-to-end, with a 30-day proof-of-life window so a broken SSO config cannot lock admins out.
• MIT license (#175). Tribu is now released under the MIT license. See the LICENSE file and the README badge.
• README and community overhaul (#174, #176-#190, #194). Clearer positioning for families and self-hosters, stronger trust signals, framed mobile and desktop hero screenshots, a repo-local CONTRIBUTING.md, a PR template, and polished community entry points.

Upgrade Notes

• Migration 0030 adds the oidc_identities table and makes users.password_hash nullable so SSO-only accounts can exist. The backend container runs alembic upgrade head on startup before uvicorn.
• If you enable SSO, register <your-tribu>/auth/oidc/callback as the redirect URI at your provider. The admin panel shows the exact URL Tribu will submit so it matches what you register.
• Tribu’s frontend already rewrites /auth/oidc/* to the backend. If your reverse proxy routes /api/* directly, keep /auth/oidc/* going through the frontend so the callback URL stays consistent.
• The OIDC client secret is stored in system_settings as plaintext, same trust model as JWT_SECRET. Put the database volume on encrypted storage if your threat model requires it.

Verification

• Backend 295 tests green, +27 over v1.6.1 covering OIDC configuration, discovery hardening, token exchange with basic-auth fallback, real RS256 ID token verification, lockout-gate edge cases, and redirect_uri pinning across proxy-host drift.
• Frontend 143 tests green, +13 covering the SSO login button, admin settings panel, effective callback URL alignment, and invite-bound SSO signup.
• Next.js production build clean.
• End-to-end Docker-compose smoke against a real IdP discovery endpoint.