Skip to content

Commit 061635c

Browse files
dcarrion87mafredri
dcarrion87
and
mafredri
authored
feat: Allow multiple OIDC domains (coder#5210)
Co-authored-by: Mathias Fredriksson <mafredri@gmail.com>
1 parent 02bb052 commit 061635c

File tree

8 files changed

+30
-19
lines changed

8 files changed

+30
-19
lines changed

‎cli/deployment/config.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -216,9 +216,9 @@ func newConfig() *codersdk.DeploymentConfig {
216216
Flag: "oidc-client-secret",
217217
Secret: true,
218218
},
219-
EmailDomain: &codersdk.DeploymentConfigField[string]{
219+
EmailDomain: &codersdk.DeploymentConfigField[[]string]{
220220
Name: "OIDC Email Domain",
221-
Usage: "Email domain that clients logging in with OIDC must match.",
221+
Usage: "Email domains that clients logging in with OIDC must match.",
222222
Flag: "oidc-email-domain",
223223
},
224224
IssuerURL: &codersdk.DeploymentConfigField[string]{

‎cli/deployment/config_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ func TestConfig(t *testing.T) {
154154
},
155155
Valid: func(config *codersdk.DeploymentConfig) {
156156
require.Equal(t, config.OIDC.IssuerURL.Value, "https://accounts.google.com")
157-
require.Equal(t, config.OIDC.EmailDomain.Value, "coder.com")
157+
require.Equal(t, config.OIDC.EmailDomain.Value, []string{"coder.com"})
158158
require.Equal(t, config.OIDC.ClientID.Value, "client")
159159
require.Equal(t, config.OIDC.ClientSecret.Value, "secret")
160160
require.False(t, config.OIDC.AllowSignups.Value)

‎cli/testdata/coder_server_--help.golden

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -95,8 +95,8 @@ Flags:
9595
Consumes $CODER_OIDC_CLIENT_ID
9696
--oidc-client-secret string Client secret to use for Login with OIDC.
9797
Consumes $CODER_OIDC_CLIENT_SECRET
98-
--oidc-email-domain string Email domain that clients logging in with
99-
OIDC must match.
98+
--oidc-email-domain strings Email domains that clients logging in
99+
with OIDC must match.
100100
Consumes $CODER_OIDC_EMAIL_DOMAIN
101101
--oidc-ignore-email-verified Ignore the email_verified claim from the
102102
upstream provider.

‎coderd/userauth.go

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -192,8 +192,8 @@ type OIDCConfig struct {
192192
httpmw.OAuth2Config
193193

194194
Verifier *oidc.IDTokenVerifier
195-
// EmailDomain is the domain to enforce when a user authenticates.
196-
EmailDomain string
195+
// EmailDomains are the domains to enforce when a user authenticates.
196+
EmailDomain []string
197197
AllowSignups bool
198198
// IgnoreEmailVerified allows ignoring the email_verified claim
199199
// from an upstream OIDC provider. See #5065 for context.
@@ -289,10 +289,17 @@ func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
289289
}
290290
username = httpapi.UsernameFrom(username)
291291
}
292-
if api.OIDCConfig.EmailDomain != "" {
293-
if !strings.HasSuffix(strings.ToLower(email), strings.ToLower(api.OIDCConfig.EmailDomain)) {
292+
if len(api.OIDCConfig.EmailDomain) > 0 {
293+
ok = false
294+
for _, domain := range api.OIDCConfig.EmailDomain {
295+
if strings.HasSuffix(strings.ToLower(email), strings.ToLower(domain)) {
296+
ok = true
297+
break
298+
}
299+
}
300+
if !ok {
294301
httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
295-
Message: fmt.Sprintf("Your email %q is not a part of the %q domain!", email, api.OIDCConfig.EmailDomain),
302+
Message: fmt.Sprintf("Your email %q is not in domains %q !", email, api.OIDCConfig.EmailDomain),
296303
})
297304
return
298305
}

‎coderd/userauth_test.go

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -482,7 +482,7 @@ func TestUserOIDC(t *testing.T) {
482482
Name string
483483
Claims jwt.MapClaims
484484
AllowSignups bool
485-
EmailDomain string
485+
EmailDomain []string
486486
Username string
487487
AvatarURL string
488488
StatusCode int
@@ -528,17 +528,21 @@ func TestUserOIDC(t *testing.T) {
528528
"email_verified": true,
529529
},
530530
AllowSignups: true,
531-
EmailDomain: "coder.com",
532-
StatusCode: http.StatusForbidden,
531+
EmailDomain: []string{
532+
"coder.com",
533+
},
534+
StatusCode: http.StatusForbidden,
533535
}, {
534536
Name: "EmailDomainCaseInsensitive",
535537
Claims: jwt.MapClaims{
536538
"email": "kyle@KWC.io",
537539
"email_verified": true,
538540
},
539541
AllowSignups: true,
540-
EmailDomain: "kwc.io",
541-
StatusCode: http.StatusTemporaryRedirect,
542+
EmailDomain: []string{
543+
"kwc.io",
544+
},
545+
StatusCode: http.StatusTemporaryRedirect,
542546
}, {
543547
Name: "EmptyClaims",
544548
Claims: jwt.MapClaims{},

‎codersdk/deploymentconfig.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ type OIDCConfig struct {
9191
AllowSignups *DeploymentConfigField[bool] `json:"allow_signups" typescript:",notnull"`
9292
ClientID *DeploymentConfigField[string] `json:"client_id" typescript:",notnull"`
9393
ClientSecret *DeploymentConfigField[string] `json:"client_secret" typescript:",notnull"`
94-
EmailDomain *DeploymentConfigField[string] `json:"email_domain" typescript:",notnull"`
94+
EmailDomain *DeploymentConfigField[[]string] `json:"email_domain" typescript:",notnull"`
9595
IssuerURL *DeploymentConfigField[string] `json:"issuer_url" typescript:",notnull"`
9696
Scopes *DeploymentConfigField[[]string] `json:"scopes" typescript:",notnull"`
9797
IgnoreEmailVerified *DeploymentConfigField[bool] `json:"ignore_email_verified" typescript:",notnull"`

‎docs/admin/auth.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ Navigate to your Coder host and run the following command to start up the Coder
6363
server:
6464

6565
```console
66-
coder server --oidc-issuer-url="https://accounts.google.com" --oidc-email-domain="your-domain" --oidc-client-id="533...ent.com" --oidc-client-secret="G0CSP...7qSM"
66+
coder server --oidc-issuer-url="https://accounts.google.com" --oidc-email-domain="your-domain-1,your-domain-2" --oidc-client-id="533...ent.com" --oidc-client-secret="G0CSP...7qSM"
6767
```
6868

6969
Alternatively, if you are running Coder as a system service, you can achieve the
@@ -72,7 +72,7 @@ to the `/etc/coder.d/coder.env` file:
7272

7373
```console
7474
CODER_OIDC_ISSUER_URL="https://accounts.google.com"
75-
CODER_OIDC_EMAIL_DOMAIN="your-domain"
75+
CODER_OIDC_EMAIL_DOMAIN="your-domain-1,your-domain-2"
7676
CODER_OIDC_CLIENT_ID="533...ent.com"
7777
CODER_OIDC_CLIENT_SECRET="G0CSP...7qSM"
7878
```

‎site/src/api/typesGenerated.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -442,7 +442,7 @@ export interface OIDCConfig {
442442
readonly allow_signups: DeploymentConfigField<boolean>
443443
readonly client_id: DeploymentConfigField<string>
444444
readonly client_secret: DeploymentConfigField<string>
445-
readonly email_domain: DeploymentConfigField<string>
445+
readonly email_domain: DeploymentConfigField<string[]>
446446
readonly issuer_url: DeploymentConfigField<string>
447447
readonly scopes: DeploymentConfigField<string[]>
448448
readonly ignore_email_verified: DeploymentConfigField<boolean>

0 commit comments

Comments
 (0)