Improved SSO.
Ylian Saint-Hilaire committed
May 27, 2020 at 00:18 UTC
a6958ff53ca55ad552d580edb60c4ac2c7bfa318
1 file changed
+19
-31
webserver.js
+19
-31
@@ -4208,11 +4208,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4208
// Twitter
4209
if ((typeof domain.authstrategies.twitter == 'object') && (typeof domain.authstrategies.twitter.clientid == 'string') && (typeof domain.authstrategies.twitter.clientsecret == 'string')) {
4210
const TwitterStrategy = require('passport-twitter');
4211
- var options = {
4212
- consumerKey: domain.authstrategies.twitter.clientid,
4213
- consumerSecret: domain.authstrategies.twitter.clientsecret,
4214
- callbackURL: (typeof domain.authstrategies.twitter.callbackurl == 'string') ? domain.authstrategies.twitter.callbackurl : (url + 'auth-twitter-callback')
4215
- };
4211
+ var options = { consumerKey: domain.authstrategies.twitter.clientid, consumerSecret: domain.authstrategies.twitter.clientsecret };
4212
+ if (typeof domain.authstrategies.twitter.callbackurl == 'string') { options.callbackURL = domain.authstrategies.twitter.callbackurl; } else { options.path = url + 'auth-twitter-callback'; }
4213
parent.debug('web', 'Adding Twitter SSO with options: ' + JSON.stringify(options));
4214
passport.use(new TwitterStrategy(options,
4215
function (token, tokenSecret, profile, cb) {
@@ -4245,11 +4242,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4242
// Google
4243
if ((typeof domain.authstrategies.google == 'object') && (typeof domain.authstrategies.google.clientid == 'string') && (typeof domain.authstrategies.google.clientsecret == 'string')) {
4244
const GoogleStrategy = require('passport-google-oauth20');
4248
- var options = {
4249
- clientID: domain.authstrategies.google.clientid,
4250
- clientSecret: domain.authstrategies.google.clientsecret,
4251
- callbackURL: (typeof domain.authstrategies.google.callbackurl == 'string') ? domain.authstrategies.google.callbackurl : (url + 'auth-google-callback')
4252
- };
4245
+ var options = { clientID: domain.authstrategies.google.clientid, clientSecret: domain.authstrategies.google.clientsecret };
4246
+ if (typeof domain.authstrategies.google.callbackurl == 'string') { options.callbackURL = domain.authstrategies.google.callbackurl; } else { options.path = url + 'auth-google-callback'; }
4247
parent.debug('web', 'Adding Google SSO with options: ' + JSON.stringify(options));
4248
passport.use(new GoogleStrategy(options,
4249
function (token, tokenSecret, profile, cb) {
@@ -4274,11 +4268,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4268
// Github
4269
if ((typeof domain.authstrategies.github == 'object') && (typeof domain.authstrategies.github.clientid == 'string') && (typeof domain.authstrategies.github.clientsecret == 'string')) {
4270
const GitHubStrategy = require('passport-github2');
4277
- var options = {
4278
- clientID: domain.authstrategies.github.clientid,
4279
- clientSecret: domain.authstrategies.github.clientsecret,
4280
- callbackURL: (typeof domain.authstrategies.github.callbackurl == 'string') ? domain.authstrategies.github.callbackurl : (url + 'auth-github-callback')
4281
- };
4271
+ var options = { clientID: domain.authstrategies.github.clientid, clientSecret: domain.authstrategies.github.clientsecret };
4272
+ if (typeof domain.authstrategies.github.callbackurl == 'string') { options.callbackURL = domain.authstrategies.github.callbackurl; } else { options.path = url + 'auth-github-callback'; }
4273
parent.debug('web', 'Adding Github SSO with options: ' + JSON.stringify(options));
4274
passport.use(new GitHubStrategy(options,
4275
function (token, tokenSecret, profile, cb) {
@@ -4305,9 +4296,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4296
const RedditStrategy = require('passport-reddit');
4297
var options = {
4298
clientID: domain.authstrategies.reddit.clientid,
4308
- clientSecret: domain.authstrategies.reddit.clientsecret,
4309
- callbackURL: (typeof domain.authstrategies.reddit.callbackurl == 'string') ? domain.authstrategies.reddit.callbackurl : (url + 'auth-reddit-callback')
4299
+ clientSecret: domain.authstrategies.reddit.clientsecret
4300
};
4301
+ if (typeof domain.authstrategies.reddit.callbackurl == 'string') { options.callbackURL = domain.authstrategies.reddit.callbackurl; } else { options.path = url + 'auth-reddit-callback'; }
4302
parent.debug('web', 'Adding Reddit SSO with options: ' + JSON.stringify(options));
4303
passport.use(new RedditStrategy.Strategy(options,
4304
function (token, tokenSecret, profile, cb) {
@@ -4350,9 +4341,10 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4341
var options = {
4342
clientID: domain.authstrategies.azure.clientid,
4343
clientSecret: domain.authstrategies.azure.clientsecret,
4353
- tenant: domain.authstrategies.azure.tenantid,
4354
- callbackURL: (typeof domain.authstrategies.azure.callbackurl == 'string') ? domain.authstrategies.azure.callbackurl : (url + 'auth-azure-callback')
4344
+ tenant: domain.authstrategies.azure.tenantid
4345
};
4346
+ if (typeof domain.authstrategies.azure.callbackurl == 'string') { options.callbackURL = domain.authstrategies.azure.callbackurl; } else { options.path = url + 'auth-azure-callback'; }
4347
+ if (typeof domain.authstrategies.azure.forceauthn != 'undefined') { options.forceAuthn = domain.authstrategies.azure.forceauthn; }
4348
parent.debug('web', 'Adding Azure SSO with options: ' + JSON.stringify(options));
4349
passport.use('azure', new AzureOAuth2Strategy(options,
4350
function (accessToken, refreshtoken, params, profile, done) {
@@ -4403,10 +4395,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4395
if (cert == null) {
4396
console.log('ERROR: Unable to read SAML IdP certificate: ' + domain.authstrategies.saml.cert);
4397
} else {
4406
- var options = {
4407
- path: (typeof domain.authstrategies.saml.callbackurl == 'string') ? domain.authstrategies.saml.callbackurl : (url + 'auth-saml-callback'),
4408
- entryPoint: domain.authstrategies.saml.idpurl, issuer: 'meshcentral'
4409
- };
4398
+ var options = { entryPoint: domain.authstrategies.saml.idpurl, issuer: 'meshcentral' };
4399
+ if (typeof domain.authstrategies.saml.callbackurl == 'string') { options.callbackURL = domain.authstrategies.saml.callbackurl; } else { options.path = url + 'auth-saml-callback'; }
4400
+ if (typeof domain.authstrategies.saml.forceauthn != 'undefined') { options.forceAuthn = domain.authstrategies.saml.forceauthn; }
4401
parent.debug('web', 'Adding SAML SSO with options: ' + JSON.stringify(options));
4402
if (typeof domain.authstrategies.saml.entityid == 'string') { options.issuer = domain.authstrategies.saml.entityid; }
4403
options.cert = cert.toString().split('-----BEGIN CERTIFICATE-----').join('').split('-----END CERTIFICATE-----').join('');
@@ -4444,10 +4435,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4435
if (cert == null) {
4436
console.log('ERROR: Unable to read Intel SAML IdP certificate: ' + domain.authstrategies.intel.cert);
4437
} else {
4447
- var options = {
4448
- path: (typeof domain.authstrategies.intel.callbackurl == 'string') ? domain.authstrategies.intel.callbackurl : (url + 'auth-intel-callback'),
4449
- entryPoint: domain.authstrategies.intel.idpurl, issuer: 'meshcentral'
4450
- };
4438
+ var options = { entryPoint: domain.authstrategies.intel.idpurl, issuer: 'meshcentral' };
4439
+ if (typeof domain.authstrategies.intel.callbackurl == 'string') { options.callbackURL = domain.authstrategies.intel.callbackurl; } else { options.path = url + 'auth-intel-callback'; }
4440
+ if (typeof domain.authstrategies.intel.forceauthn != 'undefined') { options.forceAuthn = domain.authstrategies.intel.forceauthn; }
4441
parent.debug('web', 'Adding Intel SSO with options: ' + JSON.stringify(options));
4442
if (typeof domain.authstrategies.intel.entityid == 'string') { options.issuer = domain.authstrategies.intel.entityid; }
4443
options.cert = cert.toString().split('-----BEGIN CERTIFICATE-----').join('').split('-----END CERTIFICATE-----').join('');
@@ -4487,10 +4477,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4477
if (cert == null) {
4478
console.log('ERROR: Unable to read JumpCloud IdP certificate: ' + domain.authstrategies.jumpcloud.cert);
4479
} else {
4490
- var options = {
4491
- path: (typeof domain.authstrategies.jumpcloud.callbackurl == 'string') ? domain.authstrategies.jumpcloud.callbackurl : (url + 'auth-jumpcloud-callback'),
4492
- entryPoint: domain.authstrategies.jumpcloud.idpurl, issuer: 'meshcentral'
4493
- };
4480
+ var options = { entryPoint: domain.authstrategies.jumpcloud.idpurl, issuer: 'meshcentral' };
4481
+ if (typeof domain.authstrategies.jumpcloud.callbackurl == 'string') { options.callbackURL = domain.authstrategies.jumpcloud.callbackurl; } else { options.path = url + 'auth-jumpcloud-callback'; }
4482
parent.debug('web', 'Adding JumpCloud SSO with options: ' + JSON.stringify(options));
4483
if (typeof domain.authstrategies.jumpcloud.entityid == 'string') { options.issuer = domain.authstrategies.jumpcloud.entityid; }
4484
options.cert = cert.toString().split('-----BEGIN CERTIFICATE-----').join('').split('-----END CERTIFICATE-----').join('');