Login/logout bugfix for OIDC strategy. (#5920)
* add extra logging * fix how strategy is saved
mstrhakr committed
Mar 10, 2024 at 03:44 UTC
dfc08b05a97df0220410619e283f5e1cbb397520
1 file changed
+8
-8
webserver.js
+8
-8
@@ -6655,6 +6655,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6655
6656
// Setup auth strategies using passport if needed
6657
if (typeof domain.authstrategies == 'object') {
6658
+ parent.authLog('setupHTTPHandlers', `Setting up authentication strategies login and callback URLs for ${domain.id == '' ? 'root' : '"' + domain.id + '"'} domain.`);
6659
// Twitter
6660
if ((domain.authstrategies.authStrategyFlags & domainAuthStrategyConsts.twitter) != 0) {
6661
obj.app.get(url + 'auth-twitter', function (req, res, next) {
@@ -6733,8 +6734,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6734
6735
// Setup OpenID Connect URLs
6736
if ((domain.authstrategies.authStrategyFlags & domainAuthStrategyConsts.oidc) != 0) {
6736
-
6737
- obj.app.get(url + 'auth-oidc', function (req, res, next) {
6737
+ let authURL = url + 'auth-oidc'
6738
+ parent.authLog('setupHTTPHandlers', `OIDC: Authorization URL: ${authURL}`);
6739
+ obj.app.get(authURL, function (req, res, next) {
6740
var domain = getDomain(req);
6741
if (domain.passport == null) { next(); return; }
6742
domain.passport.authenticate(`oidc-${domain.id}`, { failureRedirect: '/', failureFlash: true })(req, res, next);
@@ -6747,6 +6749,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6749
} else {
6750
redirectPath = url + 'auth-oidc-callback'
6751
}
6752
+ parent.authLog('setupHTTPHandlers', `OIDC: Callback URL: ${redirectPath}`);
6753
obj.app.get(redirectPath, obj.bodyParser.urlencoded({ extended: false }), function (req, res, next) {
6754
var domain = getDomain(req);
6755
if (domain.passport == null) { next(); return; }
@@ -7303,7 +7306,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
7306
7307
// Setup OpenID Connect Authentication Strategy
7308
if (obj.common.validateObject(domain.authstrategies.oidc)) {
7306
- parent.authLog('setupDomainAuthStrategy', `OIDC: Setting up strategy for domain: ${domain.id}`);
7309
+ parent.authLog('setupDomainAuthStrategy', `OIDC: Setting up strategy for domain: ${domain.id == null ? 'default' : domain.id}`);
7310
// Ensure required objects exist
7311
let initStrategy = domain.authstrategies.oidc
7312
if (typeof initStrategy.issuer == 'string') { initStrategy.issuer = { 'issuer': initStrategy.issuer } }
@@ -7384,11 +7387,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
7387
7388
// Setup strategy and save configs for later
7389
passport.use('oidc-' + domain.id, new strategy.obj.openidClient.Strategy(strategy.options, oidcCallback));
7387
- if (domain.dns == null) {
7388
- parent.config.domains[''].authstrategies.oidc = strategy;
7389
- } else if (typeof parent.config.domains[domain.id].authstrategies.oidc == 'object') {
7390
- parent.config.domains[domain.id].authstrategies.oidc = strategy;
7391
- }
7390
+ parent.config.domains[domain.id].authstrategies.oidc = strategy;
7391
parent.debug('verbose', 'OIDC: Saved Configuration: ' + JSON.stringify(strategy));
7392
if (preset) { parent.authLog('setupDomainAuthStrategy', 'OIDC: ' + preset.toUpperCase() + ': Setup Complete'); }
7393
else { parent.authLog('setupDomainAuthStrategy', 'OIDC: Setup Complete'); }
@@ -7465,6 +7464,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
7464
try {
7465
if (!strategy.issuer.end_session_endpoint) {
7466
strategy.issuer.end_session_endpoint = strategy.obj.client.endSessionUrl({ 'id_token_hint': tokenset })
7467
+ parent.authLog('oidcCallback', `OIDC: Discovered end_session_endpoint: ${strategy.issuer.end_session_endpoint}`);
7468
}
7469
} catch (err) {
7470
let error = new Error('OIDC: Discovering end_session_endpoint failed. Using Default.', { cause: err });