update oidc passport module
Updated to official passport-openidconnect module, removed custom module.
mstrhakr committed
Aug 31, 2022 at 23:51 UTC
03e15c6be1696e4f5a011d4039de9d7bc6870b1c
2 files changed
+19
-14
meshcentral.js
+1
-1
@@ -3885,7 +3885,7 @@ function mainStart() {
3885
if ((typeof config.domains[i].authstrategies.github == 'object') && (typeof config.domains[i].authstrategies.github.clientid == 'string') && (typeof config.domains[i].authstrategies.github.clientsecret == 'string') && (passport.indexOf('passport-github2') == -1)) { passport.push('passport-github2'); }
3886
if ((typeof config.domains[i].authstrategies.reddit == 'object') && (typeof config.domains[i].authstrategies.reddit.clientid == 'string') && (typeof config.domains[i].authstrategies.reddit.clientsecret == 'string') && (passport.indexOf('passport-reddit') == -1)) { passport.push('passport-reddit'); }
3887
if ((typeof config.domains[i].authstrategies.azure == 'object') && (typeof config.domains[i].authstrategies.azure.clientid == 'string') && (typeof config.domains[i].authstrategies.azure.clientsecret == 'string') && (typeof config.domains[i].authstrategies.azure.tenantid == 'string') && (passport.indexOf('passport-azure-oauth2') == -1)) { passport.push('passport-azure-oauth2'); passport.push('jwt-simple'); }
3888
- if ((typeof config.domains[i].authstrategies.oidc == 'object') && (typeof config.domains[i].authstrategies.oidc.clientid == 'string') && (typeof config.domains[i].authstrategies.oidc.clientsecret == 'string') && (passport.indexOf('@mstrhakr/passport-generic-oidc') == -1)) { passport.push('@mstrhakr/passport-generic-oidc'); }
3888
+ if ((typeof config.domains[i].authstrategies.oidc == 'object') && (typeof config.domains[i].authstrategies.oidc.clientid == 'string') && (typeof config.domains[i].authstrategies.oidc.clientsecret == 'string') && (passport.indexOf('passport-openidconnect') == -1)) { passport.push('passport-openidconnect'); }
3889
if ((typeof config.domains[i].authstrategies.saml == 'object') || (typeof config.domains[i].authstrategies.jumpcloud == 'object')) { passport.push('passport-saml'); }
3890
}
3891
if (config.domains[i].sessionrecording != null) { sessionRecording = true; }
webserver.js
+18
-13
@@ -6421,8 +6421,16 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6421
6422
// Generic OpenID
6423
if ((domain.authstrategies.authStrategyFlags & domainAuthStrategyConsts.openid) != 0) {
6424
- obj.app.get(url + 'auth-oidc', domain.passport.authenticate('openidconnect'));
6425
- obj.app.get(url + 'oidc-callback', domain.passport.authenticate('openidconnect', { failureRedirect: '/login?failed-auth-attempt', failureFlash: true }), handleStrategyLogin);
6424
+ obj.app.get(url + 'auth-oidc', function (req, res, next) {
6425
+ var domain = getDomain(req);
6426
+ if (domain.passport == null) { next(); return; }
6427
+ domain.passport.authenticate('oidc-' + domain.id, { failureRedirect: '/', failureFlash: true })(req, res, next);
6428
+ });
6429
+ obj.app.get(url + 'oidc-callback', function (req, res, next) {
6430
+ var domain = getDomain(req);
6431
+ if (domain.passport == null) { next(); return; }
6432
+ domain.passport.authenticate('oidc-' + domain.id, { failureRedirect: '/', failureFlash: true })(req, res, next);
6433
+ }, handleStrategyLogin);
6434
}
6435
6436
// Generic SAML
@@ -6886,25 +6894,22 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6894
// Generic OpenID Connect
6895
if ((typeof domain.authstrategies.oidc == 'object') && (typeof domain.authstrategies.oidc.clientid == 'string') && (typeof domain.authstrategies.oidc.clientsecret == 'string') && (typeof domain.authstrategies.oidc.issuer == 'string')) {
6896
var options = {
6889
- authorizationURL: domain.authstrategies.oidc.authorizationurl,
6890
- callbackURL: domain.authstrategies.oidc.callbackurl,
6891
- clientID: domain.authstrategies.oidc.clientid,
6892
- clientSecret: domain.authstrategies.oidc.clientsecret,
6897
issuer: domain.authstrategies.oidc.issuer,
6898
+ authorizationURL: domain.authstrategies.oidc.authorizationurl,
6899
tokenURL: domain.authstrategies.oidc.tokenurl,
6900
userInfoURL: domain.authstrategies.oidc.userinfourl,
6896
- scope: ['openid profile email'],
6897
- responseMode: 'form_post',
6898
- state: true
6901
+ clientID: domain.authstrategies.oidc.clientid,
6902
+ clientSecret: domain.authstrategies.oidc.clientsecret,
6903
+ scope: ['openid profile email groups'],
6904
};
6900
- const OIDCStrategy = require('@mstrhakr/passport-generic-oidc');
6905
+ var OIDCStrategy = require('passport-openidconnect');
6906
if (typeof domain.authstrategies.oidc.callbackurl == 'string') { options.callbackURL = domain.authstrategies.oidc.callbackurl; } else { options.callbackURL = url + 'oidc-callback'; }
6907
parent.debug('web', 'Adding Generic OIDC SSO with options: ' + JSON.stringify(options));
6903
- passport.use('openidconnect', new OIDCStrategy.Strategy(options,
6904
- function verify(iss, sub, profile, cb) {
6908
+ passport.use('oidc-' + domain.id, new OIDCStrategy.Strategy(options,
6909
+ function verify(issuer, profile, verified) {
6910
var user = { sid: '~oidc:' + profile.id, name: profile.displayName, email: profile.email, strategy: 'oidc' };
6911
parent.debug('AUTH', 'OIDC: Configured user: ' + JSON.stringify(user));
6907
- return cb(null, user);
6912
+ return verified(null, user);
6913
}
6914
));
6915
authStrategyFlags |= domainAuthStrategyConsts.openid;