implemented passport-openidconnect
used passport-openidconnect to get login 90% working, i get as far as the oidc host sending me back to mesh central with a good auth but i dont get logged in, still testing
mstrhakr committed
Apr 6, 2022 at 12:40 UTC
640933fc6ef1f33e298c53cb89401353a84e626b
1 file changed
+78
webserver.js
+78
@@ -783,6 +783,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
783
if (u.startsWith('~github:') && (domain.authstrategies.github != null) && (typeof domain.authstrategies.github.logouturl == 'string')) { res.redirect(domain.authstrategies.github.logouturl); return; }
784
if (u.startsWith('~reddit:') && (domain.authstrategies.reddit != null) && (typeof domain.authstrategies.reddit.logouturl == 'string')) { res.redirect(domain.authstrategies.reddit.logouturl); return; }
785
if (u.startsWith('~azure:') && (domain.authstrategies.azure != null) && (typeof domain.authstrategies.azure.logouturl == 'string')) { res.redirect(domain.authstrategies.azure.logouturl); return; }
786
+ if (u.startsWith('~oidc:') && (domain.authstrategies.oidc != null) && (typeof domain.authstrategies.oidc.logouturl == 'string')) { res.redirect(domain.authstrategies.oidc.logouturl); return; }
787
if (u.startsWith('~jumpcloud:') && (domain.authstrategies.jumpcloud != null) && (typeof domain.authstrategies.jumpcloud.logouturl == 'string')) { res.redirect(domain.authstrategies.jumpcloud.logouturl); return; }
788
if (u.startsWith('~saml:') && (domain.authstrategies.saml != null) && (typeof domain.authstrategies.saml.logouturl == 'string')) { res.redirect(domain.authstrategies.saml.logouturl); return; }
789
if (u.startsWith('~intel:') && (domain.authstrategies.intel != null) && (typeof domain.authstrategies.intel.logouturl == 'string')) { res.redirect(domain.authstrategies.intel.logouturl); return; }
@@ -3008,6 +3009,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
3009
if (typeof domain.authstrategies.github == 'object') { authStrategies.push('github'); }
3010
if (typeof domain.authstrategies.reddit == 'object') { authStrategies.push('reddit'); }
3011
if (typeof domain.authstrategies.azure == 'object') { authStrategies.push('azure'); }
3012
+ if (typeof domain.authstrategies.oidc == 'object') { authStrategies.push('oidc'); }
3013
if (typeof domain.authstrategies.intel == 'object') { authStrategies.push('intel'); }
3014
if (typeof domain.authstrategies.jumpcloud == 'object') { authStrategies.push('jumpcloud'); }
3015
if (typeof domain.authstrategies.saml == 'object') { authStrategies.push('saml'); }
@@ -6239,6 +6241,82 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6241
}, handleStrategyLogin);
6242
}
6243
6244
+
6245
+ // passport-openidconnect example code
6246
+/* var OpenIDConnectStrategy = require('passport-openidconnect');
6247
+
6248
+ passport.use(new OpenIDConnectStrategy({
6249
+ issuer: 'https://server.example.com',
6250
+ authorizationURL: 'https://server.example.com/authorize',
6251
+ tokenURL: 'https://server.example.com/token',
6252
+ userInfoURL: 'https://server.example.com/userinfo',
6253
+ clientID: process.env['CLIENT_ID'],
6254
+ clientSecret: process.env['CLIENT_SECRET'],
6255
+ callbackURL: 'https://client.example.org/cb'
6256
+
6257
+ )); */
6258
+ // Generic OpenID Connect
6259
+ if ((typeof domain.authstrategies.oidc == 'object') && (typeof domain.authstrategies.oidc.clientid == 'string') && (typeof domain.authstrategies.oidc.clientsecret == 'string') && (typeof domain.authstrategies.oidc.issuer == 'string')) {
6260
+ var options = {
6261
+ authorizationURL: domain.authstrategies.oidc.authorizationurl,
6262
+ callbackURL: domain.authstrategies.oidc.callbackurl,
6263
+ clientID: domain.authstrategies.oidc.clientid,
6264
+ clientSecret: domain.authstrategies.oidc.clientsecret,
6265
+ issuer: domain.authstrategies.oidc.issuer,
6266
+ tokenURL: domain.authstrategies.oidc.tokenurl,
6267
+ userInfoURL: domain.authstrategies.oidc.userinfourl,
6268
+ scope: [ 'openid email profile' ],
6269
+ state: true
6270
+ };
6271
+ const OIDCStrategy = require('passport-openidconnect');
6272
+ if (typeof domain.authstrategies.oidc.callbackurl == 'string') { options.callbackURL = domain.authstrategies.oidc.callbackurl; } else { options.callbackURL = url + 'oidc-callback'; }
6273
+ parent.debug('web', 'Adding Generic OIDC SSO with options: ' + JSON.stringify(options));
6274
+ passport.use('oidc-' + domain.id, new OIDCStrategy(options,
6275
+ function (accessToken, refreshtoken, params, profile, done) {
6276
+ var userex = null;
6277
+ try { userex = require('jwt-simple').decode(params.id_token, "", true); } catch (ex) { }
6278
+ parent.debug('web', 'OpenID Connect profile: ' + JSON.stringify(userex));
6279
+ var user = null;
6280
+ if (userex != null) {
6281
+ var user = { sid: '~oidc:' + userex.unique_name, name: userex.name, strategy: 'oidc' };
6282
+ if (typeof userex.email == 'string') { user.email = userex.email; }
6283
+ }
6284
+ return done(null, user);
6285
+ }
6286
+ ));
6287
+/* passport.use('oidc-' + domain.id, new OIDCStrategy.Strategy(options,
6288
+ function (authorization_code, refresh_token, profile, cb) {
6289
+ parent.debug('web', 'OIDC profile: ' + JSON.stringify(profile));
6290
+ var user = { sid: '~oidc:' + profile.id, name: profile.displayName, strategy: 'oidc' };
6291
+ if ((typeof profile.emails == 'object') && (profile.emails[0] != null) && (typeof profile.emails[0].value == 'string')) { user.email = profile.emails[0].value; }
6292
+ return cb(null, user);
6293
+ }
6294
+ )); */
6295
+ obj.app.get(url + 'auth-oidc', function (req, res, next) {
6296
+ var domain = getDomain(req);
6297
+ if (domain.passport == null) { next(); return; }
6298
+ domain.passport.authenticate('oidc-' + domain.id, { scope: 'openid email profile', state: obj.parent.encodeCookie({ 'p': 'azure' }, obj.parent.loginCookieEncryptionKey) })(req, res, next);
6299
+ });
6300
+ obj.app.get(url + 'oidc-callback', function (req, res, next) {
6301
+ var domain = getDomain(req);
6302
+ if (domain.passport == null) { next(); return; }
6303
+ if ((Object.keys(req.session).length == 0) && (req.query.nmr == null)) {
6304
+ // This is an empty session likely due to the 302 redirection, redirect again (this is a bit of a hack).
6305
+ var url = req.url;
6306
+ if (url.indexOf('?') >= 0) { url += '&nmr=1'; } else { url += '?nmr=1'; } // Add this to the URL to prevent redirect loop.
6307
+ res.set('Content-Type', 'text/html');
6308
+ res.end('<html><head><meta http-equiv="refresh" content=0;url="' + url + '"></head><body></body></html>');
6309
+ } else {
6310
+ if (req.query.state != null) {
6311
+ var c = obj.parent.decodeCookie(req.query.state, obj.parent.loginCookieEncryptionKey, 10); // 10 minute timeout
6312
+ if ((c != null) && (c.p == 'oidc')) { domain.passport.authenticate('oidc-' + domain.id, { failureRedirect: '/' })(req, res, next); return; }
6313
+ }
6314
+ next();
6315
+ }
6316
+ }, handleStrategyLogin);
6317
+ }
6318
+
6319
+
6320
// Generic SAML
6321
if (typeof domain.authstrategies.saml == 'object') {
6322
if ((typeof domain.authstrategies.saml.cert != 'string') || (typeof domain.authstrategies.saml.idpurl != 'string')) {