This pull request has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.

Thanks for this — it's a genuinely useful feature and the OidcUserResolver is clean, well-factored and nicely unit-tested (the break-glass guard applying after mapping is a nice touch). I can't merge it as-is though; here's what's blocking it, roughly in priority order:

1. The jumbojett/openid-connect-php dependency isn't declared in composer.json/composer.lock.
OidcController does use Jumbojett\OpenIDConnectClient; and new OpenIDConnectClient(...), but the package is only pulled in by the bundled Dockerfile at image-build time. That means:

• A normal composer install from this repo doesn't install it, so enabling OIDC_ENABLED=true on any non-Docker install fatals.
• The official LSIO image is built from this repo's composer.json, so it wouldn't ship the dependency either.

The client library needs to be a real composer require jumbojett/openid-connect-php:^1.0 committed to composer.json + composer.lock.

2. The bundled Dockerfile shouldn't live in this repo.
Heimdall's official image is built by the LinuxServer pipeline, not from a root Dockerfile. This one is FROM lscr.io/linuxserver/heimdall and COPY overlay/app/ ... from an overlay/ tree that isn't part of this PR - it's clearly extracted from a separate overlay-based deployment repo and won't build against this layout. Please drop it (and AUTHENTIK_OIDC.md, which is branch-specific). Any docs should go in the standard README/wiki as generic SSO docs.

3. The OIDC state/nonce session security is unverified — this is the real one.
Your own // NOTE: in OidcController flags it: jumbojett stores the state and nonce in PHP's native $_SESSION, but Laravel manages its own session and doesn't session_start(). If $_SESSION isn't persisted across the redirect, the state (CSRF) and nonce (replay) checks — the security core of the auth-code flow — silently pass without actually protecting anything. This needs to be proven correct (ideally with a test that a mismatched state is rejected), or fixed with a custom session handler bridging jumbojett to Laravel's session, before it can go in.

4. Identity is keyed on preferred_username, not sub.
preferred_username is a mutable claim; if a provider reassigns a username, a new user could inherit an existing Heimdall account. The immutable sub (which you already fetch) is the correct stable identifier to match/provision against — consider persisting sub and matching on it, with preferred_username only as a display/creation hint.

Minor: the login button hardcodes "Authentik" and inline styles — a generic "Sign in with SSO" label + CSS class would fit better since the feature is provider-agnostic; and the two oidc.* routes are always registered — fine, since the controller guards on enabled, but worth a comment.

Items 1–3 are hard blockers. If you can split out the deployment/Dockerfile bits, add the composer dependency properly, and nail down the session/state handling with a test, I'd be happy to take another look.