|
6 | 6 | "errors" |
7 | 7 | "fmt" |
8 | 8 | "net/http" |
| 9 | + "strings" |
9 | 10 |
|
| 11 | + "github.com/coreos/go-oidc/v3/oidc" |
10 | 12 | "github.com/google/go-github/v43/github" |
11 | 13 | "github.com/google/uuid" |
12 | 14 | "golang.org/x/oauth2" |
@@ -40,10 +42,18 @@ func (api *API) userAuthMethods(rw http.ResponseWriter, _ *http.Request) { |
40 | 42 | httpapi.Write(rw, http.StatusOK, codersdk.AuthMethods{ |
41 | 43 | Password: true, |
42 | 44 | Github: api.GithubOAuth2Config != nil, |
| 45 | + OIDC: api.OIDCConfig != nil, |
43 | 46 | }) |
44 | 47 | } |
45 | 48 |
|
46 | 49 | func (api *API) userOAuth2Github(rw http.ResponseWriter, r *http.Request) { |
| 50 | + if api.GithubOAuth2Config == nil { |
| 51 | + httpapi.Write(rw, http.StatusPreconditionRequired, codersdk.Response{ |
| 52 | + Message: "GitHub authentication is not enabled!", |
| 53 | + }) |
| 54 | + return |
| 55 | + } |
| 56 | + |
47 | 57 | state := httpmw.OAuth2(r) |
48 | 58 |
|
49 | 59 | oauthClient := oauth2.NewClient(r.Context(), oauth2.StaticTokenSource(state.Token)) |
@@ -205,3 +215,126 @@ func (api *API) userOAuth2Github(rw http.ResponseWriter, r *http.Request) { |
205 | 215 | } |
206 | 216 | http.Redirect(rw, r, redirect, http.StatusTemporaryRedirect) |
207 | 217 | } |
| 218 | + |
| 219 | +type OIDCConfig struct { |
| 220 | + httpmw.OAuth2Config |
| 221 | + |
| 222 | + Provider *oidc.Provider |
| 223 | + Verifier *oidc.IDTokenVerifier |
| 224 | + // EmailDomain is an optional domain to require when authenticating. |
| 225 | + EmailDomain string |
| 226 | + AllowSignups bool |
| 227 | +} |
| 228 | + |
| 229 | +func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) { |
| 230 | + if api.OIDCConfig == nil { |
| 231 | + httpapi.Write(rw, http.StatusPreconditionRequired, codersdk.Response{ |
| 232 | + Message: "OpenID Connect authentication is not enabled!", |
| 233 | + }) |
| 234 | + return |
| 235 | + } |
| 236 | + |
| 237 | + state := httpmw.OAuth2(r) |
| 238 | + |
| 239 | + // See the example here: https://github.com/coreos/go-oidc |
| 240 | + rawIDToken, ok := state.Token.Extra("id_token").(string) |
| 241 | + if !ok { |
| 242 | + httpapi.Write(rw, http.StatusBadRequest, codersdk.Response{ |
| 243 | + Message: "id_token not found in response payload. Ensure your OIDC callback is configured correctly!", |
| 244 | + }) |
| 245 | + return |
| 246 | + } |
| 247 | + |
| 248 | + idToken, err := api.OIDCConfig.Verifier.Verify(r.Context(), rawIDToken) |
| 249 | + if err != nil { |
| 250 | + httpapi.Write(rw, http.StatusBadRequest, codersdk.Response{ |
| 251 | + Message: "Failed to verify OIDC token.", |
| 252 | + Detail: err.Error(), |
| 253 | + }) |
| 254 | + return |
| 255 | + } |
| 256 | + |
| 257 | + var claims struct { |
| 258 | + Email string `json:"email"` |
| 259 | + Verified bool `json:"email_verified"` |
| 260 | + Username string `json:"preferred_username"` |
| 261 | + } |
| 262 | + err = idToken.Claims(&claims) |
| 263 | + if err != nil { |
| 264 | + httpapi.Write(rw, http.StatusInternalServerError, codersdk.Response{ |
| 265 | + Message: "Failed to extract OIDC claims.", |
| 266 | + Detail: err.Error(), |
| 267 | + }) |
| 268 | + return |
| 269 | + } |
| 270 | + if !claims.Verified { |
| 271 | + httpapi.Write(rw, http.StatusForbidden, codersdk.Response{ |
| 272 | + Message: fmt.Sprintf("Verify the %q email address on your OIDC provider to authenticate!", claims.Email), |
| 273 | + }) |
| 274 | + return |
| 275 | + } |
| 276 | + if api.OIDCConfig.EmailDomain != "" { |
| 277 | + if !strings.HasSuffix(claims.Email, api.OIDCConfig.EmailDomain) { |
| 278 | + httpapi.Write(rw, http.StatusForbidden, codersdk.Response{ |
| 279 | + Message: fmt.Sprintf("Your email %q is not a part of the %q domain!", claims.Email, api.OIDCConfig.EmailDomain), |
| 280 | + }) |
| 281 | + return |
| 282 | + } |
| 283 | + } |
| 284 | + |
| 285 | + var user database.User |
| 286 | + user, err = api.Database.GetUserByEmailOrUsername(r.Context(), database.GetUserByEmailOrUsernameParams{ |
| 287 | + Email: claims.Email, |
| 288 | + }) |
| 289 | + if errors.Is(err, sql.ErrNoRows) { |
| 290 | + if !api.OIDCConfig.AllowSignups { |
| 291 | + httpapi.Write(rw, http.StatusForbidden, codersdk.Response{ |
| 292 | + Message: "Signups are disabled for OIDC authentication!", |
| 293 | + }) |
| 294 | + return |
| 295 | + } |
| 296 | + var organizationID uuid.UUID |
| 297 | + organizations, _ := api.Database.GetOrganizations(r.Context()) |
| 298 | + if len(organizations) > 0 { |
| 299 | + // Add the user to the first organization. Once multi-organization |
| 300 | + // support is added, we should enable a configuration map of user |
| 301 | + // email to organization. |
| 302 | + organizationID = organizations[0].ID |
| 303 | + } |
| 304 | + user, _, err = api.createUser(r.Context(), codersdk.CreateUserRequest{ |
| 305 | + Email: claims.Email, |
| 306 | + Username: claims.Username, |
| 307 | + OrganizationID: organizationID, |
| 308 | + }) |
| 309 | + if err != nil { |
| 310 | + httpapi.Write(rw, http.StatusInternalServerError, codersdk.Response{ |
| 311 | + Message: "Internal error creating user.", |
| 312 | + Detail: err.Error(), |
| 313 | + }) |
| 314 | + return |
| 315 | + } |
| 316 | + } |
| 317 | + if err != nil { |
| 318 | + httpapi.Write(rw, http.StatusInternalServerError, codersdk.Response{ |
| 319 | + Message: "Failed to get user by email.", |
| 320 | + Detail: err.Error(), |
| 321 | + }) |
| 322 | + } |
| 323 | + |
| 324 | + _, created := api.createAPIKey(rw, r, database.InsertAPIKeyParams{ |
| 325 | + UserID: user.ID, |
| 326 | + LoginType: database.LoginTypeOIDC, |
| 327 | + OAuthAccessToken: state.Token.AccessToken, |
| 328 | + OAuthRefreshToken: state.Token.RefreshToken, |
| 329 | + OAuthExpiry: state.Token.Expiry, |
| 330 | + }) |
| 331 | + if !created { |
| 332 | + return |
| 333 | + } |
| 334 | + |
| 335 | + redirect := state.Redirect |
| 336 | + if redirect == "" { |
| 337 | + redirect = "/" |
| 338 | + } |
| 339 | + http.Redirect(rw, r, redirect, http.StatusTemporaryRedirect) |
| 340 | +} |
0 commit comments