actually working discovery
mstrhakr committed
Sep 4, 2022 at 19:41 UTC
60ee315b79c38271c948219e2a55c0f0933f0967
1 file changed
+16
-17
webserver.js
+16
-17
@@ -6790,7 +6790,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6790
}
6791
6792
// Setup auth strategies for a domain
6793
- async function setupDomainAuthStrategy(domain) {
6793
+ function setupDomainAuthStrategy(domain) {
6794
// Return the auth strategies that have been setup
6795
var authStrategyFlags = 0;
6796
@@ -6902,27 +6902,26 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6902
clientSecret: domain.authstrategies.oidc.clientsecret,
6903
scope: ['profile email'],
6904
};
6905
- if ((typeof domain.authstrategies.oidc.authorizationurl != 'string') || (typeof domain.authstrategies.oidc.tokenurl != 'string') || (typeof domain.authstrategies.oidc.userinfourl != 'string')) {
6906
- const Issuer = require('openid-client').Issuer;
6907
- parent.debug('web', 'Attempting to discover well known endpoints for ' + options.issuer);
6908
- var issuer = await Issuer.discover(options.issuer);
6909
- parent.debug('web', `Discovered from ${issuer.metadata.issuer}:
6910
- authorization_endpoint - ${issuer.metadata.authorization_endpoint}
6911
- token_endpoint - ${issuer.metadata.token_endpoint}
6912
- userinfo_endpoint - ${issuer.metadata.userinfo_endpoint}`);
6913
- }
6914
- if (typeof domain.authstrategies.oidc.authorizationurl == 'string') { options.authorizationURL = domain.authstrategies.oidc.authorizationurl; } else { options.authorizationURL = issuer.metadata.authorization_endpoint; }
6915
- if (typeof domain.authstrategies.oidc.tokenurl == 'string') { options.tokenURL = domain.authstrategies.oidc.tokenurl; } else { options.tokenURL = issuer.metadata.token_endpoint; }
6916
- if (typeof domain.authstrategies.oidc.userinfourl == 'string') { options.userInfoURL = domain.authstrategies.oidc.userinfourl; } else { options.userInfoURL = issuer.metadata.userinfo_endpoint; }
6917
- if (typeof domain.authstrategies.oidc.callbackurl == 'string') { options.callbackURL = domain.authstrategies.oidc.callbackurl; } else { options.callbackURL = url + 'oidc-callback'; }
6918
- parent.debug('web', 'Adding Generic OIDC SSO with options: ' + JSON.stringify(options));
6919
- passport.use('oidc-' + domain.id, new OIDCStrategy.Strategy(options,
6905
+ async function discoverOptions(options){
6906
+ if ((typeof domain.authstrategies.oidc.authorizationurl != 'string') || (typeof domain.authstrategies.oidc.tokenurl != 'string') || (typeof domain.authstrategies.oidc.userinfourl != 'string')) {
6907
+ const Issuer = require('openid-client').Issuer;
6908
+ parent.debug('web', 'Attempting to discover well known endpoints for ' + options.issuer);
6909
+ var issuer = await Issuer.discover(options.issuer)
6910
+ if (typeof domain.authstrategies.oidc.authorizationurl == 'string') { options.authorizationURL = domain.authstrategies.oidc.authorizationurl; } else { options.authorizationURL = issuer.metadata.authorization_endpoint; }
6911
+ if (typeof domain.authstrategies.oidc.tokenurl == 'string') { options.tokenURL = domain.authstrategies.oidc.tokenurl; } else { options.tokenURL = issuer.metadata.token_endpoint; }
6912
+ if (typeof domain.authstrategies.oidc.userinfourl == 'string') { options.userInfoURL = domain.authstrategies.oidc.userinfourl; } else { options.userInfoURL = issuer.metadata.userinfo_endpoint; }
6913
+ if (typeof domain.authstrategies.oidc.callbackurl == 'string') { options.callbackURL = domain.authstrategies.oidc.callbackurl; } else { options.callbackURL = url + 'oidc-callback'; }
6914
+ }
6915
+ parent.debug('web', 'Discovered ' + JSON.stringify(options));
6916
+ return options
6917
+ }
6918
+ discoverOptions(options).then((options)=>{passport.use('oidc-' + domain.id, new OIDCStrategy.Strategy(options,
6919
function verify(issuer, profile, verified) {
6920
var user = { sid: '~oidc:' + profile.id, name: profile.displayName, email: profile.email, strategy: 'oidc' };
6921
parent.debug('AUTH', `OIDC: Configured user: ${JSON.stringify(user)} using ${issuer}`);
6922
return verified(null, user);
6923
}
6925
- ));
6924
+ ))});
6925
authStrategyFlags |= domainAuthStrategyConsts.oidc;
6926
}
6927