GitLab

OpenID Connect, which is what Okta, Entra, Google and Keycloak all speak.
Authorization code with PKCE, and nothing that arrives in a browser is
believed: the code is swapped for an id token on a connection of our own and
the signature checked against the keys the provider publishes. A replayed
login finds its state spent, and rotated keys are refetched once before a
token is called a fake. No dependency for any of it.

SAML is not here. It would mean verifying xml signatures, which is
unforgiving to get right, and every provider worth integrating with has
spoken OIDC for years.

sso_only refuses a password login even with the right password, which is also
everybody locked out on the morning the provider is down. enable_local_login.sh
puts the password form back from the server, through the app's own settings, so
it lands in the audit trail and needs no restart.

Also fixes a host that carried its port into https.request, so a provider or a
graph endpoint on a non standard port was looked up as a name with a colon in
it.