Added auth strategy logout url.
Ylian Saint-Hilaire committed
Oct 16, 2021 at 23:55 UTC
a99790c7ec97126003b75944e65fe04eca579a8b
2 files changed
+30
-8
meshcentral-config-schema.json
+14
-7
@@ -740,7 +740,8 @@
740
"newAccounts": { "type": "boolean", "default": false },
741
"newAccountsUserGroups": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
742
"clientid": { "type": "string" },
743
- "clientsecret": { "type": "string" }
743
+ "clientsecret": { "type": "string" },
744
+ "logouturl": {"type": "string", "format": "uri", "description": "Then set, the user will be redirected to this URL when hitting the logout link."}
745
},
746
"required": [ "clientid", "clientsecret" ]
747
},
@@ -751,7 +752,8 @@
752
"newAccounts": { "type": "boolean", "default": false },
753
"newAccountsUserGroups": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
754
"clientid": { "type": "string" },
754
- "clientsecret": { "type": "string" }
755
+ "clientsecret": { "type": "string" },
756
+ "logouturl": {"type": "string", "format": "uri", "description": "Then set, the user will be redirected to this URL when hitting the logout link."}
757
},
758
"required": [ "clientid", "clientsecret" ]
759
},
@@ -762,7 +764,8 @@
764
"newAccounts": { "type": "boolean", "default": false },
765
"newAccountsUserGroups": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
766
"clientid": { "type": "string" },
765
- "clientsecret": { "type": "string" }
767
+ "clientsecret": { "type": "string" },
768
+ "logouturl": {"type": "string", "format": "uri", "description": "Then set, the user will be redirected to this URL when hitting the logout link."}
769
},
770
"required": [ "clientid", "clientsecret" ]
771
},
@@ -773,7 +776,8 @@
776
"newAccounts": { "type": "boolean", "default": false },
777
"newAccountsUserGroups": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
778
"clientid": { "type": "string" },
776
- "clientsecret": { "type": "string" }
779
+ "clientsecret": { "type": "string" },
780
+ "logouturl": {"type": "string", "format": "uri", "description": "Then set, the user will be redirected to this URL when hitting the logout link."}
781
},
782
"required": [ "clientid", "clientsecret" ]
783
},
@@ -785,7 +789,8 @@
789
"newAccountsUserGroups": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
790
"clientid": { "type": "string" },
791
"clientsecret": { "type": "string" },
788
- "tenantid": { "type": "string" }
792
+ "tenantid": { "type": "string" },
793
+ "logouturl": {"type": "string", "format": "uri", "description": "Then set, the user will be redirected to this URL when hitting the logout link."}
794
},
795
"required": [ "clientid", "clientsecret", "tenantid" ]
796
},
@@ -797,7 +802,8 @@
802
"newAccountsUserGroups": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
803
"entityid": { "type": "string" },
804
"idpurl": { "type": "string", "format": "uri" },
800
- "cert": { "type": "string" }
805
+ "cert": { "type": "string" },
806
+ "logouturl": {"type": "string", "format": "uri", "description": "Then set, the user will be redirected to this URL when hitting the logout link."}
807
},
808
"required": [ "entityid", "idpurl", "cert" ]
809
},
@@ -811,7 +817,8 @@
817
"newAccountsRights": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
818
"entityid": { "type": "string" },
819
"idpurl": { "type": "string", "format": "uri" },
814
- "cert": { "type": "string" }
820
+ "cert": { "type": "string" },
821
+ "logouturl": {"type": "string", "format": "uri", "description": "Then set, the user will be redirected to this URL when hitting the logout link."}
822
},
823
"required": [ "entityid", "idpurl", "cert" ]
824
}
webserver.js
+16
-1
@@ -764,13 +764,28 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
764
765
res.set({ 'Cache-Control': 'no-store' });
766
// Destroy the user's session to log them out will be re-created next request
767
+ var userid = req.session.userid;
768
if (req.session.userid) {
769
var user = obj.users[req.session.userid];
770
if (user != null) { obj.parent.DispatchEvent(['*'], obj, { etype: 'user', userid: user._id, username: user.name, action: 'logout', msgid: 2, msg: 'Account logout', domain: domain.id }); }
771
}
772
req.session = null;
772
- if (req.query.key != null) { res.redirect(domain.url + '?key=' + req.query.key); } else { res.redirect(domain.url); }
773
parent.debug('web', 'handleLogoutRequest: success.');
774
+
775
+ // If this user was logged in using an authentication strategy and there is a logout URL, use it.
776
+ if ((userid != null) && (domain.authstrategies != null)) {
777
+ const u = userid.split('/')[2];
778
+ if (u.startsWith('~twitter:') && (domain.authstrategies.twitter != null) && (typeof domain.authstrategies.twitter.logouturl == 'string')) { res.redirect(domain.authstrategies.twitter.logouturl); return; }
779
+ if (u.startsWith('~google:') && (domain.authstrategies.google != null) && (typeof domain.authstrategies.google.logouturl == 'string')) { res.redirect(domain.authstrategies.google.logouturl); return; }
780
+ if (u.startsWith('~github:') && (domain.authstrategies.github != null) && (typeof domain.authstrategies.github.logouturl == 'string')) { res.redirect(domain.authstrategies.github.logouturl); return; }
781
+ if (u.startsWith('~reddit:') && (domain.authstrategies.reddit != null) && (typeof domain.authstrategies.reddit.logouturl == 'string')) { res.redirect(domain.authstrategies.reddit.logouturl); return; }
782
+ if (u.startsWith('~azure:') && (domain.authstrategies.azure != null) && (typeof domain.authstrategies.azure.logouturl == 'string')) { res.redirect(domain.authstrategies.azure.logouturl); return; }
783
+ if (u.startsWith('~jumpcloud:') && (domain.authstrategies.jumpcloud != null) && (typeof domain.authstrategies.jumpcloud.logouturl == 'string')) { res.redirect(domain.authstrategies.jumpcloud.logouturl); return; }
784
+ if (u.startsWith('~saml:') && (domain.authstrategies.saml != null) && (typeof domain.authstrategies.saml.logouturl == 'string')) { res.redirect(domain.authstrategies.saml.logouturl); return; }
785
+ }
786
+
787
+ // This is the default logout redirect to the login page
788
+ if (req.query.key != null) { res.redirect(domain.url + '?key=' + req.query.key); } else { res.redirect(domain.url); }
789
}
790
791
// Return true if this user has 2-step auth active