working generic oidc section
tested with authelia, works for me :)
mstrhakr committed
Apr 8, 2022 at 00:14 UTC
126c1474cc25c158b4201a0719c3578daf8e0a66
1 file changed
+9
-56
webserver.js
+9
-56
@@ -6241,20 +6241,6 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6241
}, handleStrategyLogin);
6242
}
6243
6244
-
6245
- // passport-openidconnect example code
6246
-/* var OpenIDConnectStrategy = require('passport-openidconnect');
6247
-
6248
- passport.use(new OpenIDConnectStrategy({
6249
- issuer: 'https://server.example.com',
6250
- authorizationURL: 'https://server.example.com/authorize',
6251
- tokenURL: 'https://server.example.com/token',
6252
- userInfoURL: 'https://server.example.com/userinfo',
6253
- clientID: process.env['CLIENT_ID'],
6254
- clientSecret: process.env['CLIENT_SECRET'],
6255
- callbackURL: 'https://client.example.org/cb'
6256
-
6257
- )); */
6244
// Generic OpenID Connect
6245
if ((typeof domain.authstrategies.oidc == 'object') && (typeof domain.authstrategies.oidc.clientid == 'string') && (typeof domain.authstrategies.oidc.clientsecret == 'string') && (typeof domain.authstrategies.oidc.issuer == 'string')) {
6246
var options = {
@@ -6265,55 +6251,22 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6251
issuer: domain.authstrategies.oidc.issuer,
6252
tokenURL: domain.authstrategies.oidc.tokenurl,
6253
userInfoURL: domain.authstrategies.oidc.userinfourl,
6268
- scope: [ 'openid email profile' ],
6254
+ scope: [ 'openid profile email' ],
6255
+ responseMode: 'form_post' ,
6256
state: true
6257
};
6258
const OIDCStrategy = require('passport-openidconnect');
6259
if (typeof domain.authstrategies.oidc.callbackurl == 'string') { options.callbackURL = domain.authstrategies.oidc.callbackurl; } else { options.callbackURL = url + 'oidc-callback'; }
6260
parent.debug('web', 'Adding Generic OIDC SSO with options: ' + JSON.stringify(options));
6274
- passport.use('oidc-' + domain.id, new OIDCStrategy(options,
6275
- function (accessToken, refreshtoken, params, profile, done) {
6276
- var userex = null;
6277
- try { userex = require('jwt-simple').decode(params.id_token, "", true); } catch (ex) { }
6278
- parent.debug('web', 'OpenID Connect profile: ' + JSON.stringify(userex));
6279
- var user = null;
6280
- if (userex != null) {
6281
- var user = { sid: '~oidc:' + userex.unique_name, name: userex.name, strategy: 'oidc' };
6282
- if (typeof userex.email == 'string') { user.email = userex.email; }
6283
- }
6284
- return done(null, user);
6285
- }
6286
- ));
6287
-/* passport.use('oidc-' + domain.id, new OIDCStrategy.Strategy(options,
6288
- function (authorization_code, refresh_token, profile, cb) {
6289
- parent.debug('web', 'OIDC profile: ' + JSON.stringify(profile));
6290
- var user = { sid: '~oidc:' + profile.id, name: profile.displayName, strategy: 'oidc' };
6291
- if ((typeof profile.emails == 'object') && (profile.emails[0] != null) && (typeof profile.emails[0].value == 'string')) { user.email = profile.emails[0].value; }
6261
+ passport.use('openidconnect', new OIDCStrategy.Strategy(options,
6262
+ function verify( iss, sub, profile, cb ) {
6263
+ var user = { sid: '~oidc:' + profile.id, name: profile.displayName, email: profile.email, strategy: 'oidc' };
6264
+ parent.debug('AUTH', 'OIDC: Configured user: ' + JSON.stringify(user));
6265
return cb(null, user);
6266
}
6294
- )); */
6295
- obj.app.get(url + 'auth-oidc', function (req, res, next) {
6296
- var domain = getDomain(req);
6297
- if (domain.passport == null) { next(); return; }
6298
- domain.passport.authenticate('oidc-' + domain.id, { scope: 'openid email profile', state: obj.parent.encodeCookie({ 'p': 'azure' }, obj.parent.loginCookieEncryptionKey) })(req, res, next);
6299
- });
6300
- obj.app.get(url + 'oidc-callback', function (req, res, next) {
6301
- var domain = getDomain(req);
6302
- if (domain.passport == null) { next(); return; }
6303
- if ((Object.keys(req.session).length == 0) && (req.query.nmr == null)) {
6304
- // This is an empty session likely due to the 302 redirection, redirect again (this is a bit of a hack).
6305
- var url = req.url;
6306
- if (url.indexOf('?') >= 0) { url += '&nmr=1'; } else { url += '?nmr=1'; } // Add this to the URL to prevent redirect loop.
6307
- res.set('Content-Type', 'text/html');
6308
- res.end('<html><head><meta http-equiv="refresh" content=0;url="' + url + '"></head><body></body></html>');
6309
- } else {
6310
- if (req.query.state != null) {
6311
- var c = obj.parent.decodeCookie(req.query.state, obj.parent.loginCookieEncryptionKey, 10); // 10 minute timeout
6312
- if ((c != null) && (c.p == 'oidc')) { domain.passport.authenticate('oidc-' + domain.id, { failureRedirect: '/' })(req, res, next); return; }
6313
- }
6314
- next();
6315
- }
6316
- }, handleStrategyLogin);
6267
+ ));
6268
+ obj.app.get(url + 'auth-oidc', domain.passport.authenticate('openidconnect'));
6269
+ obj.app.get(url + 'oidc-callback', domain.passport.authenticate('openidconnect', { failureRedirect: '/login?failed-auth-attempt', failureFlash: true }), handleStrategyLogin);
6270
}
6271
6272