Enforce external identity for Ghost Admin sessions

frank commented

2026-07-24 22:46:25 +00:00

Owner

Goal

Make the configured SSO adapter authoritative for browser-based Ghost Admin sessions.

Ghost must reject or clear an existing session when the current external identity is missing, unauthorized, unknown, or different from the session user.

Problem

Ghost currently exchanges SSO credentials for a Ghost session before serving /ghost. When the credentials map to a valid Ghost staff user, Ghost assigns that user to the session.

When credentials are missing, invalid, unauthorized, or do not map to a Ghost user, the SSO middleware falls through without clearing an existing Ghost session. A different external user can therefore reuse a previous user’s Ghost session in the same browser.

Browser-authenticated Admin API requests must also reconcile the external identity before accepting the Ghost session cookie.

Sub-tasks

#48 Make SSO session exchange fail closed.
#49 Add configurable strict SSO session handling.
#50 Reconcile external identity on Admin API requests.

Acceptance criteria

Valid external identities create or update the matching Ghost session.
Unknown or unauthorized identities cannot reuse an existing Ghost session.
Missing external credentials invalidate the Ghost session in strict mode.
Switching between valid users updates the Ghost session safely.
Browser-authenticated Admin API requests verify the current external identity.
Admin API and staff tokens continue to work independently of browser SSO.
Existing non-strict SSO behavior remains available.

Scope

This epic covers session validation and external-identity reconciliation.

Coordinated logout between Ghost and the external identity provider is handled separately.

## Goal Make the configured SSO adapter authoritative for browser-based Ghost Admin sessions. Ghost must reject or clear an existing session when the current external identity is missing, unauthorized, unknown, or different from the session user. ## Problem Ghost currently exchanges SSO credentials for a Ghost session before serving `/ghost`. When the credentials map to a valid Ghost staff user, Ghost assigns that user to the session. When credentials are missing, invalid, unauthorized, or do not map to a Ghost user, the SSO middleware falls through without clearing an existing Ghost session. A different external user can therefore reuse a previous user’s Ghost session in the same browser. Browser-authenticated Admin API requests must also reconcile the external identity before accepting the Ghost session cookie. ## Sub-tasks * [ ] #48 Make SSO session exchange fail closed. * [ ] #49 Add configurable strict SSO session handling. * [ ] #50 Reconcile external identity on Admin API requests. ## Acceptance criteria * [ ] Valid external identities create or update the matching Ghost session. * [ ] Unknown or unauthorized identities cannot reuse an existing Ghost session. * [ ] Missing external credentials invalidate the Ghost session in strict mode. * [ ] Switching between valid users updates the Ghost session safely. * [ ] Browser-authenticated Admin API requests verify the current external identity. * [ ] Admin API and staff tokens continue to work independently of browser SSO. * [ ] Existing non-strict SSO behavior remains available. ## Scope This epic covers session validation and external-identity reconciliation. Coordinated logout between Ghost and the external identity provider is handled separately.

frank added this to the Forward Auth mode milestone

2026-07-24 22:46:25 +00:00

frank added the

type/feature

label

2026-07-24 22:46:25 +00:00

frank added a new dependency

2026-07-24 22:50:09 +00:00

#50 Reconcile external identity on Admin API requests

frank added a new dependency

2026-07-24 22:50:15 +00:00

#49 Add configurable strict SSO session handling