v2.22

settings [OAUTH2_ID_TOKEN_WHITELIST_FIELDS and
  OAUTH2_REQUEST_PERMISSIONS](https://github.com/wekan/wekan/commit/b66f471e530d41a3f12e4bfc29548313e9a73c35).
  Thanks to xet7.

.meteor/packages

@@ -90,3 +90,4 @@ wekan:wekan-ldap
 wekan:accounts-cas
 wekan-scrollbar
 mquandalle:perfect-scrollbar
+mdg:meteor-apm-agent

.meteor/versions

@@ -84,6 +84,7 @@ localstorage@1.2.0
 logging@1.1.19
 matb33:collection-hooks@0.8.4
 matteodem:easy-search@1.6.4
+mdg:meteor-apm-agent@3.1.2
 mdg:validation-error@0.5.1
 meteor@1.8.2
 meteor-base@1.2.0
@@ -144,7 +145,7 @@ retry@1.0.9
 routepolicy@1.0.12
 rzymek:fullcalendar@3.8.0
 salleman:accounts-oidc@1.0.10
-salleman:oidc@1.0.10
+salleman:oidc@1.0.12
 service-configuration@1.0.11
 session@1.1.7
 sha@1.0.9

CHANGELOG.md

@@ -1,3 +1,52 @@
+# v2.22 2019-02-13 Wekan release
+
+This release adds the following new features:
+
+- [Kadira integration](https://github.com/wekan/wekan/issues/2152). Thanks to GavinLilly.
+- Add [configurable](https://github.com/wekan/wekan/issues/1874#issuecomment-462759627)
+  settings [OAUTH2_ID_TOKEN_WHITELIST_FIELDS and
+  OAUTH2_REQUEST_PERMISSIONS](https://github.com/wekan/wekan/commit/b66f471e530d41a3f12e4bfc29548313e9a73c35).
+  Thanks to xet7.
+
+and fixes the following bugs:
+
+- [Fix: Remove overlap of side bar button with card/list menu button on
+   mobile browser](https://github.com/wekan/wekan/issues/2183). Thanks to xet7.
+
+Thanks to above GitHub users for their contributions, and translators for their translations.
+    
+# v2.21 2019-02-12 Wekan release
+
+This release adds the following new features:
+
+- [Bump salleman-oidc to 1.0.12](https://github.com/wekan/wekan/commit/352e5c6cb07b1a09ef692af6f6c49c3b1f3e91c1). Thanks to danpatdav.
+- [Added parameters for OIDC claim mapping](https://github.com/wekan/wekan/commit/bdbbb12f967f7e4f605e6c3310290180f6c8c6d1).
+  These mapping parameters take advantage of new code in salleman-oidc 1.0.12 to override the default claim names provided by the userinfo endpoint.
+  Thanks to danpatdav.
+- [Add OIDC claim mapping parameters to docker-compose.yml/Snap/Source](https://github.com/wekan/wekan/commit/59314ab17d65e9579d2f29b32685b7777f2a06a1).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions.
+
+# v2.20 2019-02-11 Wekan release
+
+This release adds the following new features:
+
+- [Add OIDC / OAuth2 optional setting DEBUG=true to salleman-oidc and Dockerfile](https://github.com/wekan/wekan/pull/2181).
+  Thanks to danpatdav.
+- [Add OIDC / OAuth2 optional setting DEBUG=true to docker-compose.yml/Snap/Source](https://github.com/wekan/wekan/commits/8e02170dd1d5a638ba47dcca910e6eecbfd03baf).
+  Thanks to xet7.
+
+Thanks to above GitHub users for their contributions and translators for their translations.
+
+# v2.19 2019-02-09 Wekan release
+
+This release removes the following new features:
+
+- [Remove oplog from snap](https://github.com/wekan/wekan/commit/f1bd36a3b87f97927dfe60572646a457e1f7ef66). Need to think how to do it properly.
+
+Thanks to GitHub user xet7 for conrtibutions.
+
 # v2.18 2019-02-08 Wekan release
 
 This release adds the folloging new features:

Dockerfile

@@ -2,6 +2,7 @@ FROM debian:buster-slim
 LABEL maintainer="wekan"
 
 # Declare Arguments
+ARG DEBUG
 ARG NODE_VERSION
 ARG METEOR_RELEASE
 ARG METEOR_EDGE
@@ -25,6 +26,12 @@ ARG OAUTH2_SERVER_URL
 ARG OAUTH2_AUTH_ENDPOINT
 ARG OAUTH2_USERINFO_ENDPOINT
 ARG OAUTH2_TOKEN_ENDPOINT
+ARG OAUTH2_ID_MAP
+ARG OAUTH2_USERNAME_MAP
+ARG OAUTH2_FULLNAME_MAP
+ARG OAUTH2_EMAIL_MAP
+ARG OAUTH2_ID_TOKEN_WHITELIST_FIELDS
+ARG OAUTH2_REQUEST_PERMISSIONS
 ARG LDAP_ENABLE
 ARG LDAP_PORT
 ARG LDAP_HOST
@@ -76,6 +83,7 @@ ARG DEFAULT_AUTHENTICATION_METHOD
 # DOES NOT WORK: paxctl fix for alpine linux: https://github.com/wekan/wekan/issues/1303
 # ENV BUILD_DEPS="paxctl"
 ENV BUILD_DEPS="apt-utils bsdtar gnupg gosu wget curl bzip2 build-essential python python3 python3-distutils git ca-certificates gcc-7" \
+    DEBUG=false \
     NODE_VERSION=v8.15.0 \
     METEOR_RELEASE=1.6.0.1 \
     USE_EDGE=false \
@@ -99,6 +107,12 @@ ENV BUILD_DEPS="apt-utils bsdtar gnupg gosu wget curl bzip2 build-essential pyth
     OAUTH2_AUTH_ENDPOINT="" \
     OAUTH2_USERINFO_ENDPOINT="" \
     OAUTH2_TOKEN_ENDPOINT="" \
+    OAUTH2_ID_MAP="" \
+    OAUTH2_USERNAME_MAP="" \
+    OAUTH2_FULLNAME_MAP="" \
+    OAUTH2_EMAIL_MAP="" \
+    OAUTH2_ID_TOKEN_WHITELIST_FIELDS=[] \
+    OAUTH2_REQUEST_PERMISSIONS=[openid] \
     LDAP_ENABLE=false \
     LDAP_PORT=389 \
     LDAP_HOST="" \

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v2.18.0"
+appVersion: "v2.22.0"
 files:
   userUploads:
     - README.md

client/components/lists/list.styl

@@ -84,6 +84,7 @@
     padding-left: 10px
     color: #a6a6a6
 
+
   .list-header-menu
     position: absolute
     padding: 27px 19px
@@ -155,6 +156,9 @@
     float: left
 
 @media screen and (max-width: 800px)
+  .list-header-menu
+    margin-right: 30px
+
   .mini-list
     flex: 0 0 60px
     height: 60px

docker-compose.yml

@@ -191,9 +191,12 @@ services:
       # - MONGO_OPLOG_URL=mongodb://<username>:<password>@<mongoDbURL>/local?authSource=admin&replicaSet=rsWekan
       #---------------------------------------------------------------
       # ==== OPTIONAL: KADIRA PERFORMANCE MONITORING FOR METEOR ====
-      # https://github.com/smeijer/kadira
+      # https://github.com/edemaine/kadira-compose
+      # https://github.com/meteor/meteor-apm-agent
       # https://blog.meteor.com/kadira-apm-is-now-open-source-490469ffc85f
-      # - export KADIRA_OPTIONS_ENDPOINT=http://127.0.0.1:11011
+      #- APM_OPTIONS_ENDPOINT=http://<kadira-ip>:11011
+      #- APM_APP_ID=
+      #- APM_APP_SECRET=
       #---------------------------------------------------------------
       # ==== OPTIONAL: LOGS AND STATS ====
       # https://github.com/wekan/wekan/wiki/Logs
@@ -219,23 +222,19 @@ services:
       - WITH_API=true
       #-----------------------------------------------------------------
       # ==== CORS =====
-      # CORS: Set Access-Control-Allow-Origin header. Example: *
+      # CORS: Set Access-Control-Allow-Origin header.
       #- CORS=*
       #-----------------------------------------------------------------
       # ==== MATOMO INTEGRATION ====
       # Optional: Integration with Matomo https://matomo.org that is installed to your server
       # The address of the server where Matomo is hosted.
-      # example: - MATOMO_ADDRESS=https://example.com/matomo
-      #- MATOMO_ADDRESS=
+      #- MATOMO_ADDRESS=https://example.com/matomo
       # The value of the site ID given in Matomo server for Wekan
-      # example: - MATOMO_SITE_ID=12345
-      #- MATOMO_SITE_ID=
+      #- MATOMO_SITE_ID=1
       # The option do not track which enables users to not be tracked by matomo
-      # example:  - MATOMO_DO_NOT_TRACK=false
-      #- MATOMO_DO_NOT_TRACK=
+      #- MATOMO_DO_NOT_TRACK=true
       # The option that allows matomo to retrieve the username:
-      # example: MATOMO_WITH_USERNAME=true
-      #- MATOMO_WITH_USERNAME=false
+      #- MATOMO_WITH_USERNAME=true
       #-----------------------------------------------------------------
       # ==== BROWSER POLICY AND TRUSTED IFRAME URL ====
       # Enable browser policy and allow one trusted URL that can have iframe that has Wekan embedded inside.
@@ -243,38 +242,79 @@ services:
       # and allows all iframing etc. See wekan/server/policy.js
       - BROWSER_POLICY_ENABLED=true
       # When browser policy is enabled, HTML code at this Trusted URL can have iframe that embeds Wekan inside.
-      #- TRUSTED_URL=
+      #- TRUSTED_URL=https://intra.example.com
       #-----------------------------------------------------------------
       # ==== OUTGOING WEBHOOKS ====
       # What to send to Outgoing Webhook, or leave out. Example, that includes all that are default: cardId,listId,oldListId,boardId,comment,user,card,commentId .
-      # example: WEBHOOKS_ATTRIBUTES=cardId,listId,oldListId,boardId,comment,user,card,commentId
-      #- WEBHOOKS_ATTRIBUTES=
+      #- WEBHOOKS_ATTRIBUTES=cardId,listId,oldListId,boardId,comment,user,card,commentId
       #-----------------------------------------------------------------
-      # ==== OAUTH2 ONLY WITH OIDC AND DOORKEEPER AS INDENTITY PROVIDER
+      # ==== Debug OIDC OAuth2 etc ====
+      #- DEBUG=true
+      #-----------------------------------------------------------------
+      # ==== OAUTH2 AZURE ====
+      # https://github.com/wekan/wekan/wiki/Azure
+      # 1) Register the application with Azure. Make sure you capture
+      #    the application ID as well as generate a secret key.
+      # 2) Configure the environment variables. This differs slightly
+      #     by installation type, but make sure you have the following:
+      #- OAUTH2_ENABLED=true
+      # Application GUID captured during app registration:
+      #- OAUTH2_CLIENT_ID=xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx
+      # Secret key generated during app registration:
+      #- OAUTH2_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+      #- OAUTH2_SERVER_URL=https://login.microsoftonline.com/
+      #- OAUTH2_AUTH_ENDPOINT=/oauth2/v2.0/authorize
+      #- OAUTH2_USERINFO_ENDPOINT=https://graph.microsoft.com/oidc/userinfo
+      #- OAUTH2_TOKEN_ENDPOINT=/oauth2/v2.0/token
+      # The claim name you want to map to the unique ID field:
+      #- OAUTH2_ID_MAP=email
+      # The claim name you want to map to the username field:
+      #- OAUTH2_USERNAME_MAP=email
+      # The claim name you want to map to the full name field:
+      #- OAUTH2_FULLNAME_MAP=name
+      # Tthe claim name you want to map to the email field:
+      #- OAUTH2_EMAIL_MAP=email
+      #-----------------------------------------------------------------
+      # ==== OAUTH2 KEYCLOAK ====
+      # https://github.com/wekan/wekan/wiki/Keycloak  <== MAPPING INFO, REQUIRED
+      #- OAUTH2_ENABLED=true
+      #- OAUTH2_CLIENT_ID=<Keycloak create Client ID>
+      #- OAUTH2_SERVER_URL=<Keycloak server name>/auth
+      #- OAUTH2_AUTH_ENDPOINT=/realms/<keycloak realm>/protocol/openid-connect/auth
+      #- OAUTH2_USERINFO_ENDPOINT=/realms/<keycloak realm>/protocol/openid-connect/userinfo
+      #- OAUTH2_TOKEN_ENDPOINT=/realms/<keycloak realm>/protocol/openid-connect/token
+      #- OAUTH2_SECRET=<keycloak client secret>
+      #-----------------------------------------------------------------
+      # ==== OAUTH2 DOORKEEPER ====
       # https://github.com/wekan/wekan/issues/1874
       # https://github.com/wekan/wekan/wiki/OAuth2
       # Enable the OAuth2 connection
-      # example: OAUTH2_ENABLED=true
-      #- OAUTH2_ENABLED=false
+      #- OAUTH2_ENABLED=true
       # OAuth2 docs: https://github.com/wekan/wekan/wiki/OAuth2
-      # OAuth2 Client ID, for example from Rocket.Chat. Example: abcde12345
-      # example: OAUTH2_CLIENT_ID=abcde12345
-      #- OAUTH2_CLIENT_ID=
-      # OAuth2 Secret, for example from Rocket.Chat: Example: 54321abcde
-      # example: OAUTH2_SECRET=54321abcde
-      #- OAUTH2_SECRET=
-      # OAuth2 Server URL, for example Rocket.Chat. Example: https://chat.example.com
-      # example: OAUTH2_SERVER_URL=https://chat.example.com
-      #- OAUTH2_SERVER_URL=
-      # OAuth2 Authorization Endpoint. Example: /oauth/authorize
-      # example: OAUTH2_AUTH_ENDPOINT=/oauth/authorize
-      #- OAUTH2_AUTH_ENDPOINT=
-      # OAuth2 Userinfo Endpoint. Example: /oauth/userinfo
-      # example: OAUTH2_USERINFO_ENDPOINT=/oauth/userinfo
-      #- OAUTH2_USERINFO_ENDPOINT=
-      # OAuth2 Token Endpoint. Example: /oauth/token
-      # example: OAUTH2_TOKEN_ENDPOINT=/oauth/token
-      #- OAUTH2_TOKEN_ENDPOINT=
+      # OAuth2 Client ID.
+      #- OAUTH2_CLIENT_ID=abcde12345
+      # OAuth2 Secret.
+      #- OAUTH2_SECRET=54321abcde
+      # OAuth2 Server URL.
+      #- OAUTH2_SERVER_URL=https://chat.example.com
+      # OAuth2 Authorization Endpoint.
+      #- OAUTH2_AUTH_ENDPOINT=/oauth/authorize
+      # OAuth2 Userinfo Endpoint.
+      #- OAUTH2_USERINFO_ENDPOINT=/oauth/userinfo
+      # OAuth2 Token Endpoint.
+      #- OAUTH2_TOKEN_ENDPOINT=/oauth/token
+      # OAuth2 ID Mapping
+      #- OAUTH2_ID_MAP=
+      # OAuth2 Username Mapping
+      #- OAUTH2_USERNAME_MAP=
+      # OAuth2 Fullname Mapping
+      #- OAUTH2_FULLNAME_MAP=
+      # OAuth2 Email Mapping
+      #- OAUTH2_EMAIL_MAP=
+      # OAUTH2 ID Token Whitelist Fields.
+      #- OAUTH2_ID_TOKEN_WHITELIST_FIELDS=[]
+      # OAUTH2 Request Permissions.
+      #- OAUTH2_REQUEST_PERMISSIONS=[openid email profile]
       #-----------------------------------------------------------------
       # ==== LDAP ====
       # https://github.com/wekan/wekan/wiki/LDAP

i18n/es.i18n.json

@@ -363,9 +363,9 @@
     "muted-info": "No serás notificado de ningún cambio en este tablero",
     "my-boards": "Mis tableros",
     "name": "Nombre",
-    "no-archived-cards": "No hay tarjetas en el Archivo",
-    "no-archived-lists": "No hay listas en el Archivo",
-    "no-archived-swimlanes": "No hay carriles en el Archivo",
+    "no-archived-cards": "No hay tarjetas archivadas.",
+    "no-archived-lists": "No hay listas archivadas.",
+    "no-archived-swimlanes": "No hay carriles archivados.",
     "no-results": "Sin resultados",
     "normal": "Normal",
     "normal-desc": "Puedes ver y editar tarjetas. No puedes cambiar la configuración.",
@@ -660,6 +660,6 @@
     "add-custom-html-before-body-end": "Añade HTML personalizado después de </body>",
     "error-undefined": "Algo no está bien",
     "error-ldap-login": "Ocurrió un error al intentar acceder",
-    "display-authentication-method": "Visualizar método de autentificación",
-    "default-authentication-method": "Método de autentificación por defecto"
+    "display-authentication-method": "Mostrar el método de autenticación",
+    "default-authentication-method": "Método de autenticación por defecto"
 }

i18n/he.i18n.json

@@ -14,7 +14,7 @@
     "act-archivedBoard": "__board__ הועבר לארכיון",
     "act-archivedCard": "__card__ הועבר לארכיון",
     "act-archivedList": "__list__ הועבר לארכיון",
-    "act-archivedSwimlane": "__swimlane__ נשמר בארכיון",
+    "act-archivedSwimlane": "__swimlane__ הועבר לארכיון",
     "act-importBoard": "הלוח __board__ יובא",
     "act-importCard": "הכרטיס __card__ יובא",
     "act-importList": "הרשימה  __list__ יובאה",
@@ -84,7 +84,7 @@
     "archive-board": "העברת הלוח לארכיון",
     "archive-card": "העברת הכרטיס לארכיון",
     "archive-list": "העברת הרשימה לארכיון",
-    "archive-swimlane": "שמור נתיב זרימה לארכיון",
+    "archive-swimlane": "העברת מסלול לארכיון",
     "archive-selection": "העברת הבחירה לארכיון",
     "archiveBoardPopup-title": "להעביר לוח זה לארכיון?",
     "archived-items": "להעביר לארכיון",
@@ -335,10 +335,10 @@
     "list-archive-cards-pop": "כל הכרטיסים מרשימה זו יוסרו מהלוח. לצפייה בכרטיסים השמורים בארכיון ולהחזירם ללוח, ניתן ללחוץ על „תפריט” > „פריטים בארכיון”.",
     "list-move-cards": "העברת כל הכרטיסים שברשימה זו",
     "list-select-cards": "בחירת כל הכרטיסים שברשימה זו",
-    "set-color-list": "Set Color",
+    "set-color-list": "הגדרת צבע",
     "listActionPopup-title": "פעולות רשימה",
     "swimlaneActionPopup-title": "פעולות על מסלול",
-    "swimlaneAddPopup-title": "Add a Swimlane below",
+    "swimlaneAddPopup-title": "הוספת מסלול מתחת",
     "listImportCardPopup-title": "יבוא כרטיס מ־Trello",
     "listMorePopup-title": "עוד",
     "link-list": "קישור לרשימה זו",
@@ -365,7 +365,7 @@
     "name": "שם",
     "no-archived-cards": "אין כרטיסים בארכיון",
     "no-archived-lists": "אין רשימות בארכיון",
-    "no-archived-swimlanes": "לא שמורים מסלולים בארכיון",
+    "no-archived-swimlanes": "אין מסלולים בארכיון.",
     "no-results": "אין תוצאות",
     "normal": "רגיל",
     "normal-desc": "הרשאה לצפות ולערוך כרטיסים. לא ניתן לשנות הגדרות.",
@@ -520,9 +520,9 @@
     "editCardReceivedDatePopup-title": "החלפת מועד הקבלה",
     "editCardEndDatePopup-title": "החלפת מועד הסיום",
     "setCardColorPopup-title": "הגדרת צבע",
-    "setCardActionsColorPopup-title": "Choose a color",
-    "setSwimlaneColorPopup-title": "Choose a color",
-    "setListColorPopup-title": "Choose a color",
+    "setCardActionsColorPopup-title": "בחירת צבע",
+    "setSwimlaneColorPopup-title": "בחירת צבע",
+    "setListColorPopup-title": "בחירת צבע",
     "assigned-by": "הוקצה על ידי",
     "requested-by": "התבקש על ידי",
     "board-delete-notice": "מחיקה היא לצמיתות. כל הרשימות, הכרטיבים והפעולות שקשורים בלוח הזה ילכו לאיבוד.",
@@ -660,6 +660,6 @@
     "add-custom-html-before-body-end": "הוספת קוד HTML מותאם אישית לפני ה־</body> הסוגר.",
     "error-undefined": "מהו השתבש",
     "error-ldap-login": "אירעה שגיאה בעת ניסיון הכניסה",
-    "display-authentication-method": "Display Authentication Method",
-    "default-authentication-method": "Default Authentication Method"
+    "display-authentication-method": "הצגת שיטת אימות",
+    "default-authentication-method": "שיטת אימות כבררת מחדל"
 }

i18n/pl.i18n.json

@@ -1,6 +1,6 @@
 {
     "accept": "Akceptuj",
-    "act-activity-notify": "Activity Notification",
+    "act-activity-notify": "Powiadomienia aktywności",
     "act-addAttachment": "dodano załącznik __attachement__ do __card__",
     "act-addSubtask": "dodał podzadanie __checklist__ do __card__",
     "act-addChecklist": "dodał listę zadań __checklist__ to __card__",
@@ -78,7 +78,7 @@
     "and-n-other-card": "I __count__ inna karta",
     "and-n-other-card_plural": "I __count__ inne karty",
     "apply": "Zastosuj",
-    "app-is-offline": "Loading, please wait. Refreshing the page will cause data loss. If loading does not work, please check that server has not stopped.",
+    "app-is-offline": "Trwa ładowanie, proszę czekać. Odświeżenie strony może spowodować utratę danych. Jeśli strona się nie przeładowuje, upewnij się, że serwer działa poprawnie.",
     "archive": "Przenieś do Archiwum",
     "archive-all": "Przenieś wszystko do Archiwum",
     "archive-board": "Przenieś tablicę do Archiwum",
@@ -169,30 +169,30 @@
     "close-board-pop": "Będziesz w stanie przywrócić tablicę poprzez kliknięcie przycisku \"Archiwizuj\" w nagłówku strony domowej.",
     "color-black": "czarny",
     "color-blue": "niebieski",
-    "color-crimson": "crimson",
-    "color-darkgreen": "darkgreen",
-    "color-gold": "gold",
-    "color-gray": "gray",
+    "color-crimson": "karmazynowy",
+    "color-darkgreen": "ciemnozielony",
+    "color-gold": "złoty",
+    "color-gray": "szary",
     "color-green": "zielony",
-    "color-indigo": "indigo",
+    "color-indigo": "indygo",
     "color-lime": "limonkowy",
-    "color-magenta": "magenta",
-    "color-mistyrose": "mistyrose",
-    "color-navy": "navy",
+    "color-magenta": "fuksjowy",
+    "color-mistyrose": "różowy",
+    "color-navy": "granatowy",
     "color-orange": "pomarańczowy",
-    "color-paleturquoise": "paleturquoise",
-    "color-peachpuff": "peachpuff",
+    "color-paleturquoise": "turkusowy",
+    "color-peachpuff": "brzoskwiniowy",
     "color-pink": "różowy",
-    "color-plum": "plum",
+    "color-plum": "śliwkowy",
     "color-purple": "fioletowy",
     "color-red": "czerwony",
-    "color-saddlebrown": "saddlebrown",
-    "color-silver": "silver",
+    "color-saddlebrown": "jasnobrązowy",
+    "color-silver": "srebrny",
     "color-sky": "błękitny",
-    "color-slateblue": "slateblue",
-    "color-white": "white",
+    "color-slateblue": "szaroniebieski",
+    "color-white": "miały",
     "color-yellow": "żółty",
-    "unset-color": "Unset",
+    "unset-color": "Nieustawiony",
     "comment": "Komentarz",
     "comment-placeholder": "Dodaj komentarz",
     "comment-only": "Tylko komentowanie",
@@ -299,19 +299,19 @@
     "import-board": "importuj tablice",
     "import-board-c": "Import tablicy",
     "import-board-title-trello": "Importuj tablicę z Trello",
-    "import-board-title-wekan": "Import board from previous export",
-    "import-sandstorm-backup-warning": "Do not delete data you import from original exported board or Trello before checking does this grain close and open again, or do you get Board not found error, that means data loss.",
+    "import-board-title-wekan": "Importuj tablicę z poprzedniego eksportu",
+    "import-sandstorm-backup-warning": "Nie usuwaj danych, które importujesz ze źródłowej tablicy lub Trello zanim upewnisz się, że wszystko zostało prawidłowo przeniesione przy czym brane jest pod uwagę ponowne uruchomienie strony, ponieważ w przypadku błędu braku tablicy stracisz dane.",
     "import-sandstorm-warning": "Zaimportowana tablica usunie wszystkie istniejące dane na aktualnej tablicy oraz zastąpi ją danymi z tej importowanej.",
     "from-trello": "Z Trello",
-    "from-wekan": "From previous export",
+    "from-wekan": "Z poprzedniego eksportu",
     "import-board-instruction-trello": "W twojej tablicy na Trello przejdź do 'Menu', następnie 'Więcej', 'Drukuj i eksportuj', 'Eksportuj jako JSON' i skopiuj wynik",
-    "import-board-instruction-wekan": "In your board, go to 'Menu', then 'Export board', and copy the text in the downloaded file.",
+    "import-board-instruction-wekan": "Na Twojej tablicy przejdź do 'Menu', a następnie wybierz 'Eksportuj tablicę' i skopiuj tekst w pobranym pliku.",
     "import-board-instruction-about-errors": "W przypadku, gdy otrzymujesz błędy importowania tablicy, czasami importowanie pomimo wszystko działa poprawnie i tablica znajduje się w oknie Wszystkie tablice.",
     "import-json-placeholder": "Wklej Twoje dane JSON tutaj",
     "import-map-members": "Przypisz członków",
-    "import-members-map": "Your imported board has some members. Please map the members you want to import to your users",
+    "import-members-map": "Twoje zaimportowane tablice mają kilku członków. Proszę wybierz członków których chcesz zaimportować dla Twoich użytkowników",
     "import-show-user-mapping": "Przejrzyj wybranych członków",
-    "import-user-select": "Pick your existing user you want to use as this member",
+    "import-user-select": "Wybierz istniejącego użytkownika, który ma stać się członkiem",
     "importMapMembersAddPopup-title": "Wybierz użytkownika",
     "info": "Wersja",
     "initials": "Inicjały",
@@ -335,10 +335,10 @@
     "list-archive-cards-pop": "To usunie wszystkie karty z tej listy z tej tablicy. Aby przejrzeć karty w Archiwum i przywrócić na tablicę, kliknij \"Menu\" > \"Archiwizuj\".",
     "list-move-cards": "Przenieś wszystkie karty z tej listy",
     "list-select-cards": "Zaznacz wszystkie karty z tej listy",
-    "set-color-list": "Set Color",
+    "set-color-list": "Ustaw kolor",
     "listActionPopup-title": "Lista akcji",
     "swimlaneActionPopup-title": "Opcje diagramu czynności",
-    "swimlaneAddPopup-title": "Add a Swimlane below",
+    "swimlaneAddPopup-title": "Dodaj diagram czynności poniżej",
     "listImportCardPopup-title": "Zaimportuj kartę z Trello",
     "listMorePopup-title": "Więcej",
     "link-list": "Podepnij do tej listy",
@@ -478,14 +478,14 @@
     "send-smtp-test": "Wyślij wiadomość testową do siebie",
     "invitation-code": "Kod z zaproszenia",
     "email-invite-register-subject": "__inviter__ wysłał Ci zaproszenie",
-    "email-invite-register-text": "Dear __user__,\n\n__inviter__ invites you to kanban board for collaborations.\n\nPlease follow the link below:\n__url__\n\nAnd your invitation code is: __icode__\n\nThanks.",
-    "email-smtp-test-subject": "SMTP Test Email",
+    "email-invite-register-text": "Drogi __user__,\n\n__inviter__ zaprasza Cię do współpracy na naszej tablicy kanban.\n\nAby kontynuować, wejdź w poniższy link:\n__url__\n\nTwój kod zaproszenia to: __icode__\n\nDziękuję.",
+    "email-smtp-test-subject": "Wiadomość testowa SMTP",
     "email-smtp-test-text": "Wiadomość testowa została wysłana z powodzeniem.",
     "error-invitation-code-not-exist": "Kod zaproszenia nie istnieje",
     "error-notAuthorized": "Nie jesteś uprawniony do przeglądania tej strony.",
     "outgoing-webhooks": "Wychodzące webhooki",
     "outgoingWebhooksPopup-title": "Wychodzące webhooki",
-    "boardCardTitlePopup-title": "Card Title Filter",
+    "boardCardTitlePopup-title": "Filtruj poprzez nazwę karty",
     "new-outgoing-webhook": "Nowy wychodzący webhook",
     "no-name": "(nieznany)",
     "Node_version": "Wersja Node",
@@ -498,7 +498,7 @@
     "OS_Totalmem": "Dostępna pamięć RAM",
     "OS_Type": "Typ systemu",
     "OS_Uptime": "Czas działania systemu",
-    "days": "days",
+    "days": "dni",
     "hours": "godzin",
     "minutes": "minut",
     "seconds": "sekund",
@@ -519,10 +519,10 @@
     "card-end-on": "Kończy się",
     "editCardReceivedDatePopup-title": "Zmień datę odebrania",
     "editCardEndDatePopup-title": "Zmień datę ukończenia",
-    "setCardColorPopup-title": "Set color",
-    "setCardActionsColorPopup-title": "Choose a color",
-    "setSwimlaneColorPopup-title": "Choose a color",
-    "setListColorPopup-title": "Choose a color",
+    "setCardColorPopup-title": "Ustaw kolor",
+    "setCardActionsColorPopup-title": "Wybierz kolor",
+    "setSwimlaneColorPopup-title": "Wybierz kolor",
+    "setListColorPopup-title": "Wybierz kolor",
     "assigned-by": "Przypisane przez",
     "requested-by": "Zlecone przez",
     "board-delete-notice": "Usuwanie jest permanentne. Stracisz wszystkie listy, kart oraz czynności przypisane do tej tablicy.",
@@ -561,14 +561,14 @@
     "r-delete-rule": "Usuń regułę",
     "r-new-rule-name": "Nowa nazwa reguły",
     "r-no-rules": "Brak regułę",
-    "r-when-a-card": "When a card",
+    "r-when-a-card": "Gdy karta",
     "r-is": "jest",
-    "r-is-moved": "is moved",
-    "r-added-to": "added to",
+    "r-is-moved": "jest przenoszona",
+    "r-added-to": "dodana do",
     "r-removed-from": "Usunięto z",
     "r-the-board": "tablicy",
     "r-list": "lista",
-    "set-filter": "Set Filter",
+    "set-filter": "Ustaw filtr",
     "r-moved-to": "Przeniesiono do",
     "r-moved-from": "Przeniesiono z",
     "r-archived": "Przeniesione z Archiwum",
@@ -576,7 +576,7 @@
     "r-a-card": "karta",
     "r-when-a-label-is": "Gdy etykieta jest",
     "r-when-the-label-is": "Gdy etykieta jest",
-    "r-list-name": "list name",
+    "r-list-name": "nazwa listy",
     "r-when-a-member": "Gdy członek jest",
     "r-when-the-member": "Gdy członek jest",
     "r-name": "nazwa",
@@ -601,7 +601,7 @@
     "r-label": "etykieta",
     "r-member": "członek",
     "r-remove-all": "Usuń wszystkich członków tej karty",
-    "r-set-color": "Set color to",
+    "r-set-color": "Ustaw kolor na",
     "r-checklist": "lista zadań",
     "r-check-all": "Zaznacz wszystkie",
     "r-uncheck-all": "Odznacz wszystkie",
@@ -626,9 +626,9 @@
     "r-d-unarchive": "Przywróć kartę z Archiwum",
     "r-d-add-label": "Dodaj etykietę",
     "r-d-remove-label": "Usuń etykietę",
-    "r-create-card": "Create new card",
-    "r-in-list": "in list",
-    "r-in-swimlane": "in swimlane",
+    "r-create-card": "Utwórz nową kartę",
+    "r-in-list": "na liście",
+    "r-in-swimlane": "w diagramie zdarzeń",
     "r-d-add-member": "Dodaj członka",
     "r-d-remove-member": "Usuń członka",
     "r-d-remove-all-member": "Usuń wszystkich członków",
@@ -639,14 +639,14 @@
     "r-d-check-of-list": "z listy zadań",
     "r-d-add-checklist": "Dodaj listę zadań",
     "r-d-remove-checklist": "Usuń listę zadań",
-    "r-by": "by",
+    "r-by": "przez",
     "r-add-checklist": "Dodaj listę zadań",
-    "r-with-items": "with items",
-    "r-items-list": "item1,item2,item3",
-    "r-add-swimlane": "Add swimlane",
-    "r-swimlane-name": "swimlane name",
-    "r-board-note": "Note: leave a field empty to match every possible value.",
-    "r-checklist-note": "Note: checklist's items have to be written as comma separated values.",
+    "r-with-items": "z elementami",
+    "r-items-list": "element1,element2,element3",
+    "r-add-swimlane": "Dodaj diagram zdarzeń",
+    "r-swimlane-name": "Nazwa diagramu",
+    "r-board-note": "Uwaga: pozostaw pole puste, aby każda wartość była brana pod uwagę.",
+    "r-checklist-note": "Uwaga: wartości elementów listy muszą być oddzielone przecinkami.",
     "r-when-a-card-is-moved": "Gdy karta jest przeniesiona do innej listy",
     "ldap": "LDAP",
     "oauth2": "OAuth2",
@@ -656,10 +656,10 @@
     "custom-product-name": "Niestandardowa nazwa produktu",
     "layout": "Układ strony",
     "hide-logo": "Ukryj logo",
-    "add-custom-html-after-body-start": "Add Custom HTML after <body> start",
-    "add-custom-html-before-body-end": "Add Custom HTML before </body> end",
-    "error-undefined": "Something went wrong",
-    "error-ldap-login": "An error occurred while trying to login",
-    "display-authentication-method": "Display Authentication Method",
-    "default-authentication-method": "Default Authentication Method"
+    "add-custom-html-after-body-start": "Dodaj niestandardowy kod HTML po <body> starcie",
+    "add-custom-html-before-body-end": "Dodaj niestandardowy kod HTML przed </body> końcem",
+    "error-undefined": "Coś poszło nie tak",
+    "error-ldap-login": "Wystąpił błąd w trakcie logowania",
+    "display-authentication-method": "Wyświetl metodę logowania",
+    "default-authentication-method": "Domyślna metoda logowania"
 }

i18n/pt-BR.i18n.json

@@ -654,7 +654,7 @@
     "authentication-method": "Método de autenticação",
     "authentication-type": "Tipo de autenticação",
     "custom-product-name": "Nome Customizado do Produto",
-    "layout": "Leiaute",
+    "layout": "Layout",
     "hide-logo": "Esconder Logo",
     "add-custom-html-after-body-start": "Adicionar HTML Customizado depois do início do <body>",
     "add-custom-html-before-body-end": "Adicionar HTML Customizado antes do fim do </body>",

i18n/ru.i18n.json

@@ -660,6 +660,6 @@
     "add-custom-html-before-body-end": "Добавить HTML до завершения </body>",
     "error-undefined": "Что-то пошло не так",
     "error-ldap-login": "Ошибка при попытке авторизации",
-    "display-authentication-method": "Display Authentication Method",
-    "default-authentication-method": "Default Authentication Method"
+    "display-authentication-method": "Показывать способ авторизации",
+    "default-authentication-method": "Способ авторизации по умолчанию"
 }

i18n/zh-CN.i18n.json

@@ -660,6 +660,6 @@
     "add-custom-html-before-body-end": "添加定制的HTML在结束</body>之后",
     "error-undefined": "出了点问题",
     "error-ldap-login": "尝试登陆时出错",
-    "display-authentication-method": "Display Authentication Method",
-    "default-authentication-method": "Default Authentication Method"
+    "display-authentication-method": "显示认证方式",
+    "default-authentication-method": "缺省认证方式"
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "wekan",
-  "version": "v2.18.0",
+  "version": "v2.22.0",
   "description": "Open-Source kanban",
   "private": true,
   "scripts": {

releases/virtualbox/start-wekan.sh

@@ -1,29 +1,33 @@
 # If you want to restart even on crash, uncomment while and done lines.
 
 #while true; do
-	cd ~/repos/wekan/.build/bundle
-	export MONGO_URL='mongodb://127.0.0.1:27017/admin'
+        cd ~/repos/wekan/.build/bundle
+        #---------------------------------------------
+        # Debug OIDC OAuth2 etc.
+        #export export DEBUG=true
+        #---------------------------------------------
+        export MONGO_URL='mongodb://127.0.0.1:27017/admin'
         # ROOT_URL EXAMPLES FOR WEBSERVERS: https://github.com/wekan/wekan/wiki/Settings
-	# Production: https://example.com/wekan
-	# Local: http://localhost:3000
-	#export ipaddress=$(ifdata -pa eth0)
-	export ROOT_URL='http://localhost'
+        # Production: https://example.com/wekan
+        # Local: http://localhost:3000
+        #export ipaddress=$(ifdata -pa eth0)
+        export ROOT_URL='http://localhost'
         #---------------------------------------------
         # Working email IS NOT REQUIRED to use Wekan.
         # https://github.com/wekan/wekan/wiki/Adding-users
-	# https://github.com/wekan/wekan/wiki/Troubleshooting-Mail
-	# https://github.com/wekan/wekan-mongodb/blob/master/docker-compose.yml
-	export MAIL_URL='smtp://user:pass@mailserver.example.com:25/'
-	export MAIL_FROM='Wekan Support <support@example.com>'
-	# This is local port where Wekan Node.js runs, same as below on Caddyfile settings.
-	export PORT=80
+        # https://github.com/wekan/wekan/wiki/Troubleshooting-Mail
+        # https://github.com/wekan/wekan-mongodb/blob/master/docker-compose.yml
+        export MAIL_URL='smtp://user:pass@mailserver.example.com:25/'
+        export MAIL_FROM='Wekan Support <support@example.com>'
+        # This is local port where Wekan Node.js runs, same as below on Caddyfile settings.
+        export PORT=80
         #---------------------------------------------
-	# Wekan Export Board works when WITH_API='true'.
+        # Wekan Export Board works when WITH_API='true'.
         # If you disable Wekan API, Export Board does not work.
-	export WITH_API='true'
+        export WITH_API='true'
         #---------------------------------------------
         # CORS: Set Access-Control-Allow-Origin header. Example: *
-        #- CORS=*
+        #export CORS=*
         #---------------------------------------------
         ## Optional: Integration with Matomo https://matomo.org that is installed to your server
         ## The address of the server where Matomo is hosted:
@@ -39,36 +43,81 @@
         # Example: export MATOMO_WITH_USERNAME=true
         #export MATOMO_WITH_USERNAME='false'
         # Enable browser policy and allow one trusted URL that can have iframe that has Wekan embedded inside.
-	# Setting this to false is not recommended, it also disables all other browser policy protections
-	# and allows all iframing etc. See wekan/server/policy.js
-	# Default value: true
-	export BROWSER_POLICY_ENABLED=true
+        # Setting this to false is not recommended, it also disables all other browser policy protections
+        # and allows all iframing etc. See wekan/server/policy.js
+        # Default value: true
+        export BROWSER_POLICY_ENABLED=true
         # When browser policy is enabled, HTML code at this Trusted URL can have iframe that embeds Wekan inside.
-	# Example: export TRUSTED_URL=http://example.com
+        # Example: export TRUSTED_URL=http://example.com
         export TRUSTED_URL=''
         # What to send to Outgoing Webhook, or leave out. Example, that includes all that are default: cardId,listId,oldListId,boardId,comment,user,card,commentId .
         # Example: export WEBHOOKS_ATTRIBUTES=cardId,listId,oldListId,boardId,comment,user,card,commentId
-	export WEBHOOKS_ATTRIBUTES=''
+        export WEBHOOKS_ATTRIBUTES=''
         #---------------------------------------------
+        # ==== OAUTH2 AZURE ====
+        # https://github.com/wekan/wekan/wiki/Azure
+        # 1) Register the application with Azure. Make sure you capture
+        #    the application ID as well as generate a secret key.
+        # 2) Configure the environment variables. This differs slightly
+        #     by installation type, but make sure you have the following:
+        #export OAUTH2_ENABLED=true
+        # Application GUID captured during app registration:
+        #export OAUTH2_CLIENT_ID=xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx
+        # Secret key generated during app registration:
+        #export OAUTH2_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+        #export OAUTH2_SERVER_URL=https://login.microsoftonline.com/
+        #export OAUTH2_AUTH_ENDPOINT=/oauth2/v2.0/authorize
+        #export OAUTH2_USERINFO_ENDPOINT=https://graph.microsoft.com/oidc/userinfo
+        #export OAUTH2_TOKEN_ENDPOINT=/oauth2/v2.0/token
+        # The claim name you want to map to the unique ID field:
+        #export OAUTH2_ID_MAP=email
+        # The claim name you want to map to the username field:
+        #export OAUTH2_USERNAME_MAP=email
+        # The claim name you want to map to the full name field:
+        #export OAUTH2_FULLNAME_MAP=name
+        # Tthe claim name you want to map to the email field:
+        #export OAUTH2_EMAIL_MAP=email
+        #-----------------------------------------------------------------
+        # ==== OAUTH2 KEYCLOAK ====
+        # https://github.com/wekan/wekan/wiki/Keycloak  <== MAPPING INFO, REQUIRED
+        #export OAUTH2_ENABLED=true
+        #export OAUTH2_CLIENT_ID=<Keycloak create Client ID>
+        #export OAUTH2_SERVER_URL=<Keycloak server name>/auth
+        #export OAUTH2_AUTH_ENDPOINT=/realms/<keycloak realm>/protocol/openid-connect/auth
+        #export OAUTH2_USERINFO_ENDPOINT=/realms/<keycloak realm>/protocol/openid-connect/userinfo
+        #export OAUTH2_TOKEN_ENDPOINT=/realms/<keycloak realm>/protocol/openid-connect/token
+        #export OAUTH2_SECRET=<keycloak client secret>
+        #-----------------------------------------------------------------
+        # ==== OAUTH2 DOORKEEPER ====
+        # https://github.com/wekan/wekan/issues/1874
+        # https://github.com/wekan/wekan/wiki/OAuth2
+        # Enable the OAuth2 connection
+        #export OAUTH2_ENABLED=true
         # OAuth2 docs: https://github.com/wekan/wekan/wiki/OAuth2
-        # OAuth2 Client ID, for example from Rocket.Chat. Example: abcde12345
-        # example: export OAUTH2_CLIENT_ID=abcde12345
-        #export OAUTH2_CLIENT_ID=''
-        # OAuth2 Secret, for example from Rocket.Chat: Example: 54321abcde
-        # example: export OAUTH2_SECRET=54321abcde
-        #export OAUTH2_SECRET=''
-        # OAuth2 Server URL, for example Rocket.Chat. Example: https://chat.example.com
-        # example: export OAUTH2_SERVER_URL=https://chat.example.com
-        #export OAUTH2_SERVER_URL=''
-        # OAuth2 Authorization Endpoint. Example: /oauth/authorize
-        # example: export OAUTH2_AUTH_ENDPOINT=/oauth/authorize
-        #export OAUTH2_AUTH_ENDPOINT=''
-        # OAuth2 Userinfo Endpoint. Example: /oauth/userinfo
-        # example: export OAUTH2_USERINFO_ENDPOINT=/oauth/userinfo
-        #export OAUTH2_USERINFO_ENDPOINT=''
-        # OAuth2 Token Endpoint. Example: /oauth/token
-        # example: export OAUTH2_TOKEN_ENDPOINT=/oauth/token
-        #export OAUTH2_TOKEN_ENDPOINT=''
+        # OAuth2 Client ID.
+        #export OAUTH2_CLIENT_ID=abcde12345
+        # OAuth2 Secret.
+        #export OAUTH2_SECRET=54321abcde
+        # OAuth2 Server URL.
+        #export OAUTH2_SERVER_URL=https://chat.example.com
+        # OAuth2 Authorization Endpoint.
+        #export OAUTH2_AUTH_ENDPOINT=/oauth/authorize
+        # OAuth2 Userinfo Endpoint.
+        #export OAUTH2_USERINFO_ENDPOINT=/oauth/userinfo
+        # OAuth2 Token Endpoint.
+        #export OAUTH2_TOKEN_ENDPOINT=/oauth/token
+        # OAuth2 ID Mapping
+        #export OAUTH2_ID_MAP=
+        # OAuth2 Username Mapping
+        #export OAUTH2_USERNAME_MAP=
+        # OAuth2 Fullname Mapping
+        #export OAUTH2_FULLNAME_MAP=
+        # OAuth2 Email Mapping
+        #export OAUTH2_EMAIL_MAP=
+        # OAUTH2 ID Token Whitelist Fields.
+        #export OAUTH2_ID_TOKEN_WHITELIST_FIELDS=[]
+        # OAUTH2 Request Permissions.
+        #export OAUTH2_REQUEST_PERMISSIONS=[openid profile email]
         #---------------------------------------------
         # LDAP_ENABLE : Enable or not the connection by the LDAP
         # example :  export LDAP_ENABLE=true
@@ -192,15 +241,15 @@
         #export LDAP_DEFAULT_DOMAIN=
         # LOGOUT_WITH_TIMER : Enables or not the option logout with timer
         # example : LOGOUT_WITH_TIMER=true
-        #- LOGOUT_WITH_TIMER=
+        #export LOGOUT_WITH_TIMER=
         # LOGOUT_IN : The number of days
         # example : LOGOUT_IN=1
-        #- LOGOUT_IN=
-        #- LOGOUT_ON_HOURS=
+        #export LOGOUT_IN=
+        #export LOGOUT_ON_HOURS=
         # LOGOUT_ON_MINUTES : The number of minutes
         # example : LOGOUT_ON_MINUTES=55
-        #- LOGOUT_ON_MINUTES=
+        #export LOGOUT_ON_MINUTES=
 
-	node main.js & >> ~/repos/wekan.log
-	cd ~/repos
+        node main.js & >> ~/repos/wekan.log
+        cd ~/repos
 #done

sandstorm-pkgdef.capnp

@@ -22,10 +22,10 @@ const pkgdef :Spk.PackageDefinition = (
     appTitle = (defaultText = "Wekan"),
     # The name of the app as it is displayed to the user.
 
-    appVersion = 220,
+    appVersion = 224,
     # Increment this for every release.
 
-    appMarketingVersion = (defaultText = "2.18.0~2019-02-08"),
+    appMarketingVersion = (defaultText = "2.22.0~2019-02-13"),
     # Human-readable presentation of the app version.
 
     minUpgradableAppVersion = 0,

server/authentication.js

@@ -76,8 +76,8 @@ Meteor.startup(() => {
             authorizationEndpoint: process.env.OAUTH2_AUTH_ENDPOINT,
             userinfoEndpoint: process.env.OAUTH2_USERINFO_ENDPOINT,
             tokenEndpoint: process.env.OAUTH2_TOKEN_ENDPOINT,
-            idTokenWhitelistFields: [],
-            requestPermissions: ['openid'],
+            idTokenWhitelistFields: process.env.OAUTH2_ID_TOKEN_WHITELIST_FIELDS || [],
+            requestPermissions: process.OAUTH2_REQUEST_PERMISSIONS || ['openid'],
           },
         }
       );

snap-src/bin/config

@@ -3,9 +3,13 @@
 # All supported keys are defined here together with descriptions and default values
 
 # list of supported keys
-keys="MONGODB_BIND_UNIX_SOCKET MONGODB_BIND_IP MONGODB_PORT MAIL_URL MAIL_FROM ROOT_URL PORT DISABLE_MONGODB CADDY_ENABLED CADDY_BIND_PORT WITH_API CORS MATOMO_ADDRESS MATOMO_SITE_ID MATOMO_DO_NOT_TRACK MATOMO_WITH_USERNAME BROWSER_POLICY_ENABLED TRUSTED_URL WEBHOOKS_ATTRIBUTES OAUTH2_ENABLED OAUTH2_CLIENT_ID OAUTH2_SECRET OAUTH2_SERVER_URL OAUTH2_AUTH_ENDPOINT OAUTH2_USERINFO_ENDPOINT OAUTH2_TOKEN_ENDPOINT LDAP_ENABLE LDAP_PORT LDAP_HOST LDAP_BASEDN LDAP_LOGIN_FALLBACK LDAP_RECONNECT LDAP_TIMEOUT LDAP_IDLE_TIMEOUT LDAP_CONNECT_TIMEOUT LDAP_AUTHENTIFICATION LDAP_AUTHENTIFICATION_USERDN LDAP_AUTHENTIFICATION_PASSWORD LDAP_LOG_ENABLED LDAP_BACKGROUND_SYNC LDAP_BACKGROUND_SYNC_INTERVAL LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS LDAP_ENCRYPTION LDAP_CA_CERT LDAP_REJECT_UNAUTHORIZED LDAP_USER_SEARCH_FILTER LDAP_USER_SEARCH_SCOPE LDAP_USER_SEARCH_FIELD LDAP_SEARCH_PAGE_SIZE LDAP_SEARCH_SIZE_LIMIT LDAP_GROUP_FILTER_ENABLE LDAP_GROUP_FILTER_OBJECTCLASS LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT LDAP_GROUP_FILTER_GROUP_NAME LDAP_UNIQUE_IDENTIFIER_FIELD LDAP_UTF8_NAMES_SLUGIFY LDAP_USERNAME_FIELD LDAP_FULLNAME_FIELD LDAP_MERGE_EXISTING_USERS LDAP_SYNC_USER_DATA LDAP_SYNC_USER_DATA_FIELDMAP LDAP_SYNC_GROUP_ROLES LDAP_DEFAULT_DOMAIN LOGOUT_WITH_TIMER LOGOUT_IN LOGOUT_ON_HOURS LOGOUT_ON_MINUTES DEFAULT_AUTHENTICATION_METHOD"
+keys="DEBUG MONGODB_BIND_UNIX_SOCKET MONGODB_BIND_IP MONGODB_PORT MAIL_URL MAIL_FROM ROOT_URL PORT DISABLE_MONGODB CADDY_ENABLED CADDY_BIND_PORT WITH_API CORS MATOMO_ADDRESS MATOMO_SITE_ID MATOMO_DO_NOT_TRACK MATOMO_WITH_USERNAME BROWSER_POLICY_ENABLED TRUSTED_URL WEBHOOKS_ATTRIBUTES OAUTH2_ENABLED OAUTH2_CLIENT_ID OAUTH2_SECRET OAUTH2_SERVER_URL OAUTH2_AUTH_ENDPOINT OAUTH2_USERINFO_ENDPOINT OAUTH2_TOKEN_ENDPOINT OAUTH2_ID_MAP OAUTH2_USERNAME_MAP OAUTH2_FULLNAME_MAP OAUTH2_EMAIL_MAP OAUTH2_ID_TOKEN_WHITELIST_FIELDS OAUTH2_REQUEST_PERMISSIONS LDAP_ENABLE LDAP_PORT LDAP_HOST LDAP_BASEDN LDAP_LOGIN_FALLBACK LDAP_RECONNECT LDAP_TIMEOUT LDAP_IDLE_TIMEOUT LDAP_CONNECT_TIMEOUT LDAP_AUTHENTIFICATION LDAP_AUTHENTIFICATION_USERDN LDAP_AUTHENTIFICATION_PASSWORD LDAP_LOG_ENABLED LDAP_BACKGROUND_SYNC LDAP_BACKGROUND_SYNC_INTERVAL LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS LDAP_ENCRYPTION LDAP_CA_CERT LDAP_REJECT_UNAUTHORIZED LDAP_USER_SEARCH_FILTER LDAP_USER_SEARCH_SCOPE LDAP_USER_SEARCH_FIELD LDAP_SEARCH_PAGE_SIZE LDAP_SEARCH_SIZE_LIMIT LDAP_GROUP_FILTER_ENABLE LDAP_GROUP_FILTER_OBJECTCLASS LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT LDAP_GROUP_FILTER_GROUP_NAME LDAP_UNIQUE_IDENTIFIER_FIELD LDAP_UTF8_NAMES_SLUGIFY LDAP_USERNAME_FIELD LDAP_FULLNAME_FIELD LDAP_MERGE_EXISTING_USERS LDAP_SYNC_USER_DATA LDAP_SYNC_USER_DATA_FIELDMAP LDAP_SYNC_GROUP_ROLES LDAP_DEFAULT_DOMAIN LOGOUT_WITH_TIMER LOGOUT_IN LOGOUT_ON_HOURS LOGOUT_ON_MINUTES DEFAULT_AUTHENTICATION_METHOD"
 
 # default values
+DESCRIPTION_DEBUG="Debug OIDC OAuth2 etc. Example: sudo snap set wekan debug='true'"
+DEFAULT_DEBUG="false"
+KEY_DEBUG="debug"
+
 DESCRIPTION_MONGODB_BIND_UNIX_SOCKET="mongodb binding unix socket:\n"\
 "\t\t\t Default behaviour will preffer binding over unix socket, to disable unix socket binding set value to 'nill' string\n"\
 "\t\t\t To bind to instance of mongodb provided through content interface,set value to relative path to the socket inside '$SNAP_DATA/shared' directory"
@@ -114,6 +118,34 @@ DESCRIPTION_OAUTH2_TOKEN_ENDPOINT="OAuth2 token endpoint. Example: /oauth/token"
 DEFAULT_OAUTH2_TOKEN_ENDPOINT=""
 KEY_OAUTH2_TOKEN_ENDPOINT="oauth2-token-endpoint"
 
+DESCRIPTION_OAUTH2_ID_MAP="OAuth2 ID Mapping. Example: email"
+DEFAULT_OAUTH2_ID_MAP=""
+KEY_OAUTH2_ID_MAP="oauth2-id-map"
+
+DESCRIPTION_OAUTH2_USERNAME_MAP="OAuth2 Username Mapping. Example: email"
+DEFAULT_OAUTH2_USERNAME_MAP=""
+KEY_OAUTH2_USERNAME_MAP="oauth2-username-map"
+
+DESCRIPTION_OAUTH2_FULLNAME_MAP="OAuth2 Fullname Mapping. Example: name"
+DEFAULT_OAUTH2_FULLNAME_MAP=""
+KEY_OAUTH2_FULLNAME_MAP="oauth2-fullname-map"
+
+DESCRIPTION_OAUTH2_FULLNAME_MAP="OAuth2 Fullname Mapping. Example: name"
+DEFAULT_OAUTH2_FULLNAME_MAP=""
+KEY_OAUTH2_FULLNAME_MAP="oauth2-fullname-map"
+
+DESCRIPTION_OAUTH2_EMAIL_MAP="OAuth2 Email Mapping. Example: email"
+DEFAULT_OAUTH2_EMAIL_MAP=""
+KEY_OAUTH2_EMAIL_MAP="oauth2-email-map"
+
+DESCRIPTION_OAUTH2_ID_TOKEN_WHITELIST_FIELDS="OAuth2 ID Token Whitelist Fields. Example: []"
+DEFAULT_OAUTH2_ID_TOKEN_WHITELIST_FIELDS=""
+KEY_OAUTH2_ID_TOKEN_WHITELIST_FIELDS="oauth2-id-token-whitelist-fields"
+
+DESCRIPTION_OAUTH2_REQUEST_PERMISSIONS="OAuth2 Request Permissions. Example: [openid profile email]"
+DEFAULT_OAUTH2_REQUEST_PERMISSIONS=""
+KEY_OAUTH2_REQUEST_PERMISSIONS="oauth2-request-permissions"
+
 DESCRIPTION_LDAP_ENABLE="Enable or not the connection by the LDAP"
 DEFAULT_LDAP_ENABLE="false"
 KEY_LDAP_ENABLE="ldap-enable"
@@ -290,7 +322,6 @@ DESCRIPTION_LOGOUT_ON_MINUTES="The number of minutes"
 DEFAULT_LOGOUT_ON_MINUTES=""
 KEY_LOGOUT_ON_MINUTES="logout-on-minutes"
 
-
 DESCRIPTION_DEFAULT_AUTHENTICATION_METHOD="The default authentication method used if a user does not exist to create and authenticate. Method can be password or ldap."
 DEFAULT_DEFAULT_AUTHENTICATION_METHOD=""
 KEY_DEFAULT_AUTHENTICATION_METHOD="default-authentication-method"

snap-src/bin/mongodb-control

@@ -29,4 +29,4 @@ if [ "x" != "x${MONGODB_PORT}" ]; then
 fi
 echo "mongodb bind options: $BIND_OPTIONS"
 
-mongod --dbpath $SNAP_COMMON --logpath $SNAP_COMMON/mongodb.log --logappend --journal $BIND_OPTIONS --smallfiles --oplogSize 128
+mongod --dbpath $SNAP_COMMON --logpath $SNAP_COMMON/mongodb.log --logappend --journal $BIND_OPTIONS --smallfiles

snap-src/bin/wekan-help

@@ -8,6 +8,13 @@ if [ "$CADDY_ENABLED" = "true" ]; then
 fi
 
 echo -e "Wekan: The open-source kanban.\n"
+echo -e "\n"
+echo -e "Debug OIDC OAuth2 etc."
+echo -e "To enable the Debug of Wekan:"
+echo -e "\t$ snap set $SNAP_NAME debug='true'"
+echo -e "\t-Disable the Debug of Wekan:"
+echo -e "\t$ snap set $SNAP_NAME debug='false'"
+echo -e "\n"
 echo -e "Make sure you have connected all interfaces, check more by calling $ snap interfaces ${SNAP_NAME}"
 echo -e "\n"
 echo -e "${SNAP_NAME} has multiple services, to check status use systemctl"
@@ -29,250 +36,280 @@ echo -e "\t\t-disable mongodb in $SNAP_NAME by calling: $ snap set $SNAP_NAME se
 echo -e "\t\t-set mongodb-bind-unix-socket to point to serving mongodb. Use relative path inside shared directory, e.g run/mongodb-27017.sock"
 echo -e "\n"
 echo -e "To enable the API of wekan:"
-echo -e "\t$ snap set $SNAP_NAME WITH_API='true'"
+echo -e "\t$ snap set $SNAP_NAME with-api='true'"
 echo -e "\t-Disable the API:"
-echo -e "\t$ snap set $SNAP_NAME WITH_API='false'"
+echo -e "\t$ snap set $SNAP_NAME with-api='false'"
 echo -e "\n"
 echo -e "To enable the CORS of wekan, to set Access-Control-Allow-Origin header:"
-echo -e "\t$ snap set $SNAP_NAME CORS='*'"
+echo -e "\t$ snap set $SNAP_NAME cors='*'"
 echo -e "\t-Disable the CORS:"
-echo -e "\t$ snap set $SNAP_NAME CORS=''"
+echo -e "\t$ snap set $SNAP_NAME cors=''"
 echo -e "\n"
 echo -e "Enable browser policy and allow one trusted URL that can have iframe that has Wekan embedded inside."
 echo -e "\t\t Setting this to false is not recommended, it also disables all other browser policy protections"
 echo -e "\t\t and allows all iframing etc. See wekan/server/policy.js"
-echo -e "To enable the Content Policy of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME CONTENT_POLICY_ENABLED='true'"
-echo -e "\t-Disable the Content Policy of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME CONTENT_POLICY_ENABLED='false'"
+echo -e "To enable the Browser Policy of Wekan:"
+echo -e "\t$ snap set $SNAP_NAME browser-policy-enabled='true'"
+echo -e "\t-Disable the Browser Policy of Wekan:"
+echo -e "\t$ snap set $SNAP_NAME browser-policy-enabled='false'"
 echo -e "\n"
 echo -e "When browser policy is enabled, HTML code at this URL can have iframe that embeds Wekan inside."
 echo -e "To enable the Trusted URL of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME TRUSTED_URL='https://example.com'"
+echo -e "\t$ snap set $SNAP_NAME trusted-url='https://example.com'"
 echo -e "\t-Disable the Trusted URL of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME TRUSTED_URL=''"
+echo -e "\t$ snap set $SNAP_NAME trusted-url=''"
 echo -e "\n"
 echo -e "What to send to Outgoing Webhook, or leave out. Example, that includes all that are default: cardId,listId,oldListId,boardId,comment,user,card,commentId ."
 echo -e "To enable the Webhooks Attributes of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME WEBHOOKS_ATTRIBUTES='cardId,listId,oldListId,boardId,comment,user,card,commentId'"
+echo -e "\t$ snap set $SNAP_NAME webhooks-attributes='cardId,listId,oldListId,boardId,comment,user,card,commentId'"
 echo -e "\t-Disable the Webhooks Attributes of Wekan to send all default ones:"
-echo -e "\t$ snap set $SNAP_NAME WEBHOOKS_ATTRIBUTES=''"
+echo -e "\t$ snap set $SNAP_NAME webhooks-attributes=''"
 echo -e "\n"
-echo -e "OAuth2 Client ID, for example from Rocket.Chat. Example: abcde12345"
+echo -e "OAuth2 Client ID."
 echo -e "To enable the OAuth2 Client ID of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME OAUTH2_CLIENT_ID='54321abcde'"
+echo -e "\t$ snap set $SNAP_NAME oauth2-client-id='54321abcde'"
 echo -e "\t-Disable the OAuth2 Client ID of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME OAUTH2_CLIENT_ID=''"
+echo -e "\t$ snap set $SNAP_NAME oauth2-client-id=''"
 echo -e "\n"
-echo -e "OAuth2 Secret, for example from Rocket.Chat. Example: 54321abcde"
+echo -e "OAuth2 Secret."
 echo -e "To enable the OAuth2 Secret of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME OAUTH2_SECRET='54321abcde'"
+echo -e "\t$ snap set $SNAP_NAME oauth2-secret='54321abcde'"
 echo -e "\t-Disable the OAuth2 Secret of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME OAUTH2_SECRET=''"
+echo -e "\t$ snap set $SNAP_NAME oauth2-secret=''"
 echo -e "\n"
-echo -e "OAuth2 Server URL, for example Rocket.Chat. Example: https://chat.example.com"
+echo -e "OAuth2 Server URL."
 echo -e "To enable the OAuth2 Server URL of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME OAUTH2_SERVER_URL='https://chat.example.com'"
+echo -e "\t$ snap set $SNAP_NAME oauth2-server-url='https://chat.example.com'"
 echo -e "\t-Disable the OAuth2 Server URL of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME OAUTH2_SERVER_URL=''"
+echo -e "\t$ snap set $SNAP_NAME oauth2-server-url=''"
 echo -e "\n"
-echo -e "OAuth2 Server URL, for example Rocket.Chat. Example: https://chat.example.com"
-echo -e "To enable the OAuth2 Server URL of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME OAUTH2_SERVER_URL='https://chat.example.com'"
-echo -e "\t-Disable the OAuth2 Server URL of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME OAUTH2_SERVER_URL=''"
-echo -e "\n"
-echo -e "OAuth2 Authorization Endpoint. Example: /oauth/authorize"
+echo -e "OAuth2 Authorization Endpoint."
 echo -e "To enable the OAuth2 Authorization Endpoint of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME OAUTH2_AUTH_ENDPOINT='/oauth/authorize'"
+echo -e "\t$ snap set $SNAP_NAME oauth2-auth-endpoint='/oauth/authorize'"
 echo -e "\t-Disable the OAuth2 Authorization Endpoint of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME OAUTH2_AUTH_ENDPOINT=''"
+echo -e "\t$ snap set $SNAP_NAME oauth2-auth-endpoint=''"
 echo -e "\n"
-echo -e "OAuth2 Userinfo Endpoint. Example: /oauth/userinfo"
+echo -e "OAuth2 Userinfo Endpoint."
 echo -e "To enable the OAuth2 Userinfo Endpoint of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME OAUTH2_USERINFO_ENDPOINT='/oauth/authorize'"
+echo -e "\t$ snap set $SNAP_NAME oauth2-userinfo-endpoint='/oauth/authorize'"
 echo -e "\t-Disable the OAuth2 Userinfo Endpoint of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME OAUTH2_USERINFO_ENDPOINT=''"
+echo -e "\t$ snap set $SNAP_NAME oauth2-userinfo-endpoint=''"
 echo -e "\n"
-echo -e "OAuth2 Token Endpoint. Example: /oauth/token"
+echo -e "OAuth2 Token Endpoint."
 echo -e "To enable the OAuth2 Token Endpoint of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME OAUTH2_TOKEN_ENDPOINT='/oauth/token'"
+echo -e "\t$ snap set $SNAP_NAME oauth2-token-endpoint='/oauth/token'"
 echo -e "\t-Disable the OAuth2 Token Endpoint of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME OAUTH2_TOKEN_ENDPOINT=''"
+echo -e "\t$ snap set $SNAP_NAME oauth2-token-endpoint=''"
+echo -e "\n"
+echo -e "OAuth2 ID Mapping."
+echo -e "To enable the OAuth2 ID Mapping of Wekan:"
+echo -e "\t$ snap set $SNAP_NAME oauth2-id-map='username.uid'"
+echo -e "\t-Disable the OAuth2 ID Mapping of Wekan:"
+echo -e "\t$ snap set $SNAP_NAME oauth2-id-map=''"
+echo -e "\n"
+echo -e "OAuth2 Username Mapping."
+echo -e "To enable the OAuth2 Username Mapping of Wekan:"
+echo -e "\t$ snap set $SNAP_NAME oauth2-username-map='username'"
+echo -e "\t-Disable the OAuth2 Username Mapping of Wekan:"
+echo -e "\t$ snap set $SNAP_NAME oauth2-username-map=''"
+echo -e "\n"
+echo -e "OAuth2 Fullname Mapping."
+echo -e "To enable the OAuth2 Fullname Mapping of Wekan:"
+echo -e "\t$ snap set $SNAP_NAME oauth2-fullname-map='fullname'"
+echo -e "\t-Disable the OAuth2 Fullname Mapping of Wekan:"
+echo -e "\t$ snap set $SNAP_NAME oauth2-fullname-map=''"
+echo -e "\n"
+echo -e "OAuth2 Email Mapping."
+echo -e "To enable the OAuth2 Email Mapping of Wekan:"
+echo -e "\t$ snap set $SNAP_NAME oauth2-email-map='email'"
+echo -e "\t-Disable the OAuth2 Email Mapping of Wekan:"
+echo -e "\t$ snap set $SNAP_NAME oauth2-email-map=''"
+echo -e "\n"
+echo -e "OAuth2 ID Token Whitelist Fields."
+echo -e "To enable the OAuth2 ID Token Whitelist Fields of Wekan:"
+echo -e "\t$ snap set $SNAP_NAME oauth2-id-token-whitelist-fields='[]'"
+echo -e "\t-Disable the OAuth2 ID Token Whitelist Fields of Wekan:"
+echo -e "\t$ snap set $SNAP_NAME oauth2-id-token-whitelist-fields=''"
+echo -e "\n"
+echo -e "OAuth2 Request Permissions."
+echo -e "To enable the OAuth2 Request Permissions of Wekan:"
+echo -e "\t$ snap set $SNAP_NAME oauth2-request-permissions='[openid profile email]'"
+echo -e "\t-Disable the OAuth2 Request Permissions of Wekan:"
+echo -e "\t$ snap set $SNAP_NAME oauth2-request-permissions=''"
 echo -e "\n"
 echo -e "Ldap Enable."
 echo -e "To enable the ldap of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_ENABLE='true'"
+echo -e "\t$ snap set $SNAP_NAME ldap-enable='true'"
 echo -e "\t-Disable the ldap of Wekan:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_ENABLE='false'"
+echo -e "\t$ snap set $SNAP_NAME ldap-enable='false'"
 echo -e "\n"
 echo -e "Ldap Port."
 echo -e "The port of the ldap server:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_PORT='12345'"
+echo -e "\t$ snap set $SNAP_NAME ldap-port='12345'"
 echo -e "\n"
 echo -e "Ldap Host."
 echo -e "The host server for the LDAP server:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_HOST='localhost'"
+echo -e "\t$ snap set $SNAP_NAME ldap-host='localhost'"
 echo -e "\n"
 echo -e "Ldap Base Dn."
 echo -e "The base DN for the LDAP Tree:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_BASEDN='ou=user,dc=example,dc=org'"
+echo -e "\t$ snap set $SNAP_NAME ldap-basedn='ou=user,dc=example,dc=org'"
 echo -e "\n"
 echo -e "Ldap Login Fallback."
 echo -e "Fallback on the default authentication method:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_LOGIN_FALLBACK='true'"
+echo -e "\t$ snap set $SNAP_NAME ldap-login-fallback='true'"
 echo -e "\n"
 echo -e "Ldap Reconnect."
 echo -e "Reconnect to the server if the connection is lost:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_RECONNECT='false'"
+echo -e "\t$ snap set $SNAP_NAME ldap-reconnect='false'"
 echo -e "\n"
 echo -e "Ldap Timeout."
 echo -e "Overall timeout, in milliseconds:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_TIMEOUT='12345'"
+echo -e "\t$ snap set $SNAP_NAME ldap-timeout='12345'"
 echo -e "\n"
 echo -e "Ldap Idle Timeout."
 echo -e "Specifies the timeout for idle LDAP connections in milliseconds:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_IDLE_TIMEOUT='12345'"
+echo -e "\t$ snap set $SNAP_NAME ldap-idle-timeout='12345'"
 echo -e "\n"
 echo -e "Ldap Connect Timeout."
 echo -e "Connection timeout, in milliseconds:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_CONNECT_TIMEOUT='12345'"
+echo -e "\t$ snap set $SNAP_NAME ldap-connect-timeout='12345'"
 echo -e "\n"
 echo -e "Ldap Authentication."
 echo -e "If the LDAP needs a user account to search:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_AUTHENTIFICATION='true'"
+echo -e "\t$ snap set $SNAP_NAME ldap-authentication='true'"
 echo -e "\n"
 echo -e "Ldap Authentication User Dn."
 echo -e "The search user Dn:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_AUTHENTIFICATION_USERDN='cn=admin,dc=example,dc=org'"
+echo -e "\t$ snap set $SNAP_NAME ldap-authentication-userdn='cn=admin,dc=example,dc=org'"
 echo -e "\n"
 echo -e "Ldap Authentication Password."
 echo -e "The password for the search user:"
-echo -e "\t$ snap set $SNAP_NAME AUTHENTIFICATION_PASSWORD='admin'"
+echo -e "\t$ snap set $SNAP_NAME ldap-authentication-password='admin'"
 echo -e "\n"
 echo -e "Ldap Log Enabled."
 echo -e "Enable logs for the module:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_LOG_ENABLED='true'"
+echo -e "\t$ snap set $SNAP_NAME ldap-log-enabled='true'"
 echo -e "\n"
 echo -e "Ldap Background Sync."
 echo -e "If the sync of the users should be done in the background:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_BACKGROUND_SYNC='true'"
+echo -e "\t$ snap set $SNAP_NAME ldap-background-sync='true'"
 echo -e "\n"
 echo -e "Ldap Background Sync Interval."
 echo -e "At which interval does the background task sync in milliseconds:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_BACKGROUND_SYNC_INTERVAL='12345'"
+echo -e "\t$ snap set $SNAP_NAME ldap-background-sync-interval='12345'"
 echo -e "\n"
 echo -e "Ldap Background Sync Keep Existant Users Updated."
-echo -e "\t$ snap set $SNAP_NAME LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED='true'"
+echo -e "\t$ snap set $SNAP_NAME ldap-background-sync-keep-existant-users-updated='true'"
 echo -e "\n"
 echo -e "Ldap Background Sync Import New Users."
-echo -e "\t$ snap set $SNAP_NAME LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS='true'"
+echo -e "\t$ snap set $SNAP_NAME ldap-background-sync-import-new-users='true'"
 echo -e "\n"
 echo -e "Ldap Encryption."
 echo -e "Allow LDAPS:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_ENCRYPTION='ssl'"
+echo -e "\t$ snap set $SNAP_NAME ldap-encryption='ssl'"
 echo -e "\n"
 echo -e "Ldap Ca Cert."
 echo -e "The certification for the LDAPS server:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_CA_CERT=-----BEGIN CERTIFICATE-----MIIE+zCCA+OgAwIBAgIkAhwR/6TVLmdRY6hHxvUFWc0+Enmu/Hu6cj+G2FIdAgIC...-----END CERTIFICATE-----"
+echo -e "\t$ snap set $SNAP_NAME ldap-ca-cert=-----BEGIN CERTIFICATE-----MIIE+zCCA+OgAwIBAgIkAhwR/6TVLmdRY6hHxvUFWc0+Enmu/Hu6cj+G2FIdAgIC...-----END CERTIFICATE-----"
 echo -e "\n"
 echo -e "Ldap Reject Unauthorized."
 echo -e "Reject Unauthorized Certificate:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_REJECT_UNAUTHORIZED='true'"
+echo -e "\t$ snap set $SNAP_NAME ldap-reject-unauthorized='true'"
 echo -e "\n"
 echo -e "Ldap User Search Filter."
 echo -e "Optional extra LDAP filters. Don't forget the outmost enclosing parentheses if needed:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_USER_SEARCH_FILTER=''"
+echo -e "\t$ snap set $SNAP_NAME ldap-user-search-filter=''"
 echo -e "\n"
 echo -e "Ldap User Search Scope."
 echo -e "base (search only in the provided DN), one (search only in the provided DN and one level deep), or sub (search the whole subtree). Example: one"
-echo -e "\t$ snap set $SNAP_NAME LDAP_USER_SEARCH_SCOPE=one"
+echo -e "\t$ snap set $SNAP_NAME ldap-user-search-scope=one"
 echo -e "\n"
 echo -e "Ldap User Search Field."
 echo -e "Which field is used to find the user:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_USER_SEARCH_FIELD='uid'"
+echo -e "\t$ snap set $SNAP_NAME ldap-user-search-field='uid'"
 echo -e "\n"
 echo -e "Ldap Search Page Size."
 echo -e "Used for pagination (0=unlimited):"
-echo -e "\t$ snap set $SNAP_NAME LDAP_SEARCH_PAGE_SIZE='12345'"
+echo -e "\t$ snap set $SNAP_NAME ldap-search-page-size='12345'"
 echo -e "\n"
 echo -e "Ldap Search Size Limit."
 echo -e "The limit number of entries (0=unlimited):"
-echo -e "\t$ snap set $SNAP_NAME LDAP_SEARCH_SIZE_LIMIT='12345'"
+echo -e "\t$ snap set $SNAP_NAME ldap-search-size-limit='12345'"
 echo -e "\n"
 echo -e "Ldap Group Filter Enable."
 echo -e "Enable group filtering:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_GROUP_FILTER_ENABLE='true'"
+echo -e "\t$ snap set $SNAP_NAME ldap-group-filter-enable='true'"
 echo -e "\n"
 echo -e "Ldap Group Filter ObjectClass."
 echo -e "The object class for filtering:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_GROUP_FILTER_OBJECTCLASS='group'"
+echo -e "\t$ snap set $SNAP_NAME ldap-group-filter-objectclass='group'"
 echo -e "\n"
 echo -e "Ldap Group Filter Id Attribute."
-echo -e "\t$ snap set $SNAP_NAME LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE=''"
+echo -e "\t$ snap set $SNAP_NAME ldap-group-filter-group-id-attribute=''"
 echo -e "\n"
 echo -e "Ldap Group Filter Member Attribute."
-echo -e "\t$ snap set $SNAP_NAME LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE=''"
+echo -e "\t$ snap set $SNAP_NAME ldap-group-filter-group-member-attribute=''"
 echo -e "\n"
 echo -e "Ldap Group Filter Member Format."
-echo -e "\t$ snap set $SNAP_NAME LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT=''"
+echo -e "\t$ snap set $SNAP_NAME ldap-group-filter-group-member-format=''"
 echo -e "\n"
 echo -e "Ldap Group Filter Group Name."
-echo -e "\t$ snap set $SNAP_NAME LDAP_GROUP_FILTER_GROUP_NAME=''"
+echo -e "\t$ snap set $SNAP_NAME ldap-group-filter-group-name=''"
 echo -e "\n"
 echo -e "Ldap Unique Identifier Field."
 echo -e "This field is sometimes class GUID (Globally Unique Identifier):"
-echo -e "\t$ snap set $SNAP_NAME LDAP_UNIQUE_IDENTIFIER_FIELD=guid"
+echo -e "\t$ snap set $SNAP_NAME ldap-unique-identifier-field=guid"
 echo -e "\n"
 echo -e "Ldap Utf8 Names Slugify."
 echo -e "Convert the username to utf8:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_UTF8_NAMES_SLUGIFY='false'"
+echo -e "\t$ snap set $SNAP_NAME ldap-utf8-names-slugify='false'"
 echo -e "\n"
 echo -e "Ldap Username Field."
 echo -e "Which field contains the ldap username:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_USERNAME_FIELD='username'"
+echo -e "\t$ snap set $SNAP_NAME ldap-username-field='username'"
 echo -e "\n"
 echo -e "Ldap Fullname Field."
 echo -e "Which field contains the ldap fullname:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_FULLNAME_FIELD='fullname'"
+echo -e "\t$ snap set $SNAP_NAME ldap-fullname-field='fullname'"
 echo -e "\n"
 echo -e "Ldap Merge Existing Users."
-echo -e "\t$ snap set $SNAP_NAME LDAP_MERGE_EXISTING_USERS='true'"
+echo -e "\t$ snap set $SNAP_NAME ldap-merge-existing-users='true'"
 echo -e "\n"
 echo -e "Ldap Sync User Data."
 echo -e "Enable synchronization of user data:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_SYNC_USER_DATA='true'"
+echo -e "\t$ snap set $SNAP_NAME ldap-sync-user-data='true'"
 echo -e "\n"
 echo -e "Ldap Sync User Data Fieldmap."
 echo -e "A field map for the matching:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_SYNC_USER_DATA_FIELDMAP={\"cn\":\"name\", \"mail\":\"email\"}"
+echo -e "\t$ snap set $SNAP_NAME ldap-sync-user-data-fieldmap={\"cn\":\"name\", \"mail\":\"email\"}"
 echo -e "\n"
 echo -e "Ldap Sync Group Roles."
-echo -e "\t$ snap set $SNAP_NAME LDAP_SYNC_GROUP_ROLES=''"
+echo -e "\t$ snap set $SNAP_NAME ldap-sync-group-roles=''"
 echo -e "\n"
 echo -e "Ldap Default Domain."
 echo -e "The default domain of the ldap it is used to create email if the field is not map correctly with the LDAP_SYNC_USER_DATA_FIELDMAP:"
-echo -e "\t$ snap set $SNAP_NAME LDAP_DEFAULT_DOMAIN=''"
+echo -e "\t$ snap set $SNAP_NAME ldap-default-domain=''"
 echo -e "\n"
 # echo -e "Logout with timer."
 # echo -e "Enable or not the option that allows to disconnect an user after a given time:"
-# echo -e "\t$ snap set $SNAP_NAME LOGOUT_WITH_TIMER='true'"
+# echo -e "\t$ snap set $SNAP_NAME logout-with-timer='true'"
 # echo -e "\n"
 # echo -e "Logout in."
 # echo -e "Logout in how many days:"
-# echo -e "\t$ snap set $SNAP_NAME LOGOUT_IN='1'"
+# echo -e "\t$ snap set $SNAP_NAME logout-in='1'"
 # echo -e "\n"
 # echo -e "Logout on hours."
 # echo -e "Logout in how many hours:"
-# echo -e "\t$ snap set $SNAP_NAME LOGOUT_ON_HOURS='9'"
+# echo -e "\t$ snap set $SNAP_NAME logout-on-hours='9'"
 # echo -e "\n"
 # echo -e "Logout on minutes."
 # echo -e "Logout in how many minutes:"
-# echo -e "\t$ snap set $SNAP_NAME LOGOUT_ON_MINUTES='5'"
+# echo -e "\t$ snap set $SNAP_NAME logout-on-minutes='5'"
 # echo -e "\n"
 echo -e "Default authentication method."
 echo -e "The default authentication method used if a user does not exist to create and authenticate. Method can be password or ldap."
-echo -e "\t$ snap set $SNAP_NAME DEFAULT_AUTHENTICATION_METHOD='ldap'"
+echo -e "\t$ snap set $SNAP_NAME default-authentication-method='ldap'"
 echo -e "\n"
 # parse config file for supported settings keys
 echo -e "wekan supports settings keys"

start-wekan.bat

@@ -1,3 +1,10 @@
+REM ------------------------------------------------------------
+
+REM # Debug OIDC OAuth2 etc.
+REM SET DEBUG=true
+
+REM ------------------------------------------------------------
+
 SET MONGO_URL=mongodb://127.0.0.1:27017/wekan
 SET ROOT_URL=http://127.0.0.1:2000/
 SET MAIL_URL=smtp://user:pass@mailserver.example.com:25/
@@ -67,6 +74,11 @@ REM # OAuth2 Token Endpoint. Example: /oauth/token
 REM # example: OAUTH2_TOKEN_ENDPOINT=/oauth/token
 REM SET OAUTH2_TOKEN_ENDPOINT=
 
+REM # OAUTH2 ID Token Whitelist Fields.
+REM SET OAUTH2_ID_TOKEN_WHITELIST_FIELDS=[]
+REM # OAUTH2 Request Permissions.
+REM SET OAUTH2_REQUEST_PERMISSIONS=[openid email profile]
+
 REM ------------------------------------------------------------
 
 REM # LDAP_ENABLE : Enable or not the connection by the LDAP
@@ -245,4 +257,4 @@ REM SET LOGOUT_ON_MINUTES=
 
 cd .build\bundle
 node main.js
-cd ..\..
+cd ..\..

start-wekan.sh

@@ -20,6 +20,10 @@ function wekan_repo_check(){
 #while true; do
       wekan_repo_check
       cd .build/bundle
+      #---------------------------------------------
+      # Debug OIDC OAuth2 etc.
+      #export DEBUG=true
+      #---------------------------------------------
       export MONGO_URL='mongodb://127.0.0.1:27019/wekan'
       #---------------------------------------------
       # Production: https://example.com/wekan
@@ -41,7 +45,7 @@ function wekan_repo_check(){
       export WITH_API='true'
       #---------------------------------------------
       # CORS: Set Access-Control-Allow-Origin header. Example: *
-      #- CORS=*
+      #export CORS=*
       #---------------------------------------------
       ## Optional: Integration with Matomo https://matomo.org that is installed to your server
       ## The address of the server where Matomo is hosted:
@@ -68,25 +72,70 @@ function wekan_repo_check(){
       # Example: export WEBHOOKS_ATTRIBUTES=cardId,listId,oldListId,boardId,comment,user,card,commentId
       export WEBHOOKS_ATTRIBUTES=''
       #---------------------------------------------
+      # ==== OAUTH2 AZURE ====
+      # https://github.com/wekan/wekan/wiki/Azure
+      # 1) Register the application with Azure. Make sure you capture
+      #    the application ID as well as generate a secret key.
+      # 2) Configure the environment variables. This differs slightly
+      #     by installation type, but make sure you have the following:
+      #export OAUTH2_ENABLED=true
+      # Application GUID captured during app registration:
+      #export OAUTH2_CLIENT_ID=xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx
+      # Secret key generated during app registration:
+      #export OAUTH2_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+      #export OAUTH2_SERVER_URL=https://login.microsoftonline.com/
+      #export OAUTH2_AUTH_ENDPOINT=/oauth2/v2.0/authorize
+      #export OAUTH2_USERINFO_ENDPOINT=https://graph.microsoft.com/oidc/userinfo
+      #export OAUTH2_TOKEN_ENDPOINT=/oauth2/v2.0/token
+      # The claim name you want to map to the unique ID field:
+      #export OAUTH2_ID_MAP=email
+      # The claim name you want to map to the username field:
+      #export OAUTH2_USERNAME_MAP=email
+      # The claim name you want to map to the full name field:
+      #export OAUTH2_FULLNAME_MAP=name
+      # The claim name you want to map to the email field:
+      #export OAUTH2_EMAIL_MAP=email
+      # OAUTH2 ID Token Whitelist Fields.
+      #export OAUTH2_ID_TOKEN_WHITELIST_FIELDS=[]
+      # OAUTH2 Request Permissions.
+      #export OAUTH2_REQUEST_PERMISSIONS=[openid profile email]
+      #-----------------------------------------------------------------
+      # ==== OAUTH2 KEYCLOAK ====
+      # https://github.com/wekan/wekan/wiki/Keycloak  <== MAPPING INFO, REQUIRED
+      #export OAUTH2_ENABLED=true
+      #export OAUTH2_CLIENT_ID=<Keycloak create Client ID>
+      #export OAUTH2_SERVER_URL=<Keycloak server name>/auth
+      #export OAUTH2_AUTH_ENDPOINT=/realms/<keycloak realm>/protocol/openid-connect/auth
+      #export OAUTH2_USERINFO_ENDPOINT=/realms/<keycloak realm>/protocol/openid-connect/userinfo
+      #export OAUTH2_TOKEN_ENDPOINT=/realms/<keycloak realm>/protocol/openid-connect/token
+      #export OAUTH2_SECRET=<keycloak client secret>
+      #-----------------------------------------------------------------
+      # ==== OAUTH2 DOORKEEPER ====
+      # https://github.com/wekan/wekan/issues/1874
+      # https://github.com/wekan/wekan/wiki/OAuth2
+      # Enable the OAuth2 connection
+      #export OAUTH2_ENABLED=true
       # OAuth2 docs: https://github.com/wekan/wekan/wiki/OAuth2
-      # OAuth2 Client ID, for example from Rocket.Chat. Example: abcde12345
-      # example: export OAUTH2_CLIENT_ID=abcde12345
-      #export OAUTH2_CLIENT_ID=''
-      # OAuth2 Secret, for example from Rocket.Chat: Example: 54321abcde
-      # example: export OAUTH2_SECRET=54321abcde
-      #export OAUTH2_SECRET=''
-      # OAuth2 Server URL, for example Rocket.Chat. Example: https://chat.example.com
-      # example: export OAUTH2_SERVER_URL=https://chat.example.com
-      #export OAUTH2_SERVER_URL=''
-      # OAuth2 Authorization Endpoint. Example: /oauth/authorize
-      # example: export OAUTH2_AUTH_ENDPOINT=/oauth/authorize
-      #export OAUTH2_AUTH_ENDPOINT=''
-      # OAuth2 Userinfo Endpoint. Example: /oauth/userinfo
-      # example: export OAUTH2_USERINFO_ENDPOINT=/oauth/userinfo
-      #export OAUTH2_USERINFO_ENDPOINT=''
-      # OAuth2 Token Endpoint. Example: /oauth/token
-      # example: export OAUTH2_TOKEN_ENDPOINT=/oauth/token
-      #export OAUTH2_TOKEN_ENDPOINT=''
+      # OAuth2 Client ID.
+      #export OAUTH2_CLIENT_ID=abcde12345
+      # OAuth2 Secret.
+      #export OAUTH2_SECRET=54321abcde
+      # OAuth2 Server URL.
+      #export OAUTH2_SERVER_URL=https://chat.example.com
+      # OAuth2 Authorization Endpoint.
+      #export OAUTH2_AUTH_ENDPOINT=/oauth/authorize
+      # OAuth2 Userinfo Endpoint.
+      #export OAUTH2_USERINFO_ENDPOINT=/oauth/userinfo
+      # OAuth2 Token Endpoint.
+      #export OAUTH2_TOKEN_ENDPOINT=/oauth/token
+      # OAuth2 ID Mapping
+      #export OAUTH2_ID_MAP=
+      # OAuth2 Username Mapping
+      #export OAUTH2_USERNAME_MAP=
+      # OAuth2 Fullname Mapping
+      #export OAUTH2_FULLNAME_MAP=
+      # OAuth2 Email Mapping
+      #export OAUTH2_EMAIL_MAP=
       #---------------------------------------------
       # LDAP_ENABLE : Enable or not the connection by the LDAP
       # example :  export LDAP_ENABLE=true
@@ -210,14 +259,14 @@ function wekan_repo_check(){
       #export LDAP_DEFAULT_DOMAIN=
       # LOGOUT_WITH_TIMER : Enables or not the option logout with timer
       # example : LOGOUT_WITH_TIMER=true
-      #- LOGOUT_WITH_TIMER=
+      #export LOGOUT_WITH_TIMER=
       # LOGOUT_IN : The number of days
       # example : LOGOUT_IN=1
-      #- LOGOUT_IN=
-      #- LOGOUT_ON_HOURS=
+      #export LOGOUT_IN=
+      #export LOGOUT_ON_HOURS=
       # LOGOUT_ON_MINUTES : The number of minutes
       # example : LOGOUT_ON_MINUTES=55
-      #- LOGOUT_ON_MINUTES=
+      #export LOGOUT_ON_MINUTES=
 
       node main.js
       # & >> ../../wekan.log