Skip to content

OIDC serverside login #129

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
veggiesaurus merged 21 commits into from
Apr 17, 2023
Merged

OIDC serverside login #129

Show file tree
Hide file tree
Changes from 20 commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
b91e27b
Add jose for JWKS
daikema Jul 15, 2022
443057d
Add axios
daikema Jul 25, 2022
2a7563b
Still need to add better error-handling + do more tests but mostly there
daikema Aug 23, 2022
ede2c42
Refactoring + tweaks for Google compatibility
daikema Aug 23, 2022
004d27b
Encrypt state stored with client + improve error reporting
daikema Sep 19, 2022
5edf9bb
Merge remote-tracking branch 'origin/dev' into oidc-serverside
daikema Sep 19, 2022
4e9cdd6
De-var-ify
daikema Sep 19, 2022
fd352a9
Update JOSE to address https://github.com/advisories/GHSA-jv3g-j58f-9mq9
daikema Sep 26, 2022
bc5e37e
Update config schema docs as per confluence's suggestions
daikema Oct 20, 2022
c36a4f6
Export mongo client for use in OIDC refresh tokens
daikema Feb 24, 2023
8718507
Merge remote-tracking branch 'origin/dev' into oidc-serverside
daikema Feb 24, 2023
0956797
Merge remote-tracking branch 'origin/dev' into oidc-serverside
daikema Feb 27, 2023
8c07979
Initial lock manager draft. Still WIP
daikema Mar 2, 2023
3a01b88
Initial ... needs more testing
daikema Mar 10, 2023
b58cfda
Fixed key length
daikema Mar 15, 2023
b949651
Oops... wrong table
daikema Mar 15, 2023
af55f94
Now actually using the stored refresh tokens
daikema Mar 16, 2023
6eed650
Final tweaks
daikema Mar 17, 2023
c0c1132
Doc updates re: OIDC
daikema Mar 17, 2023
73a7dac
Verify lock was acquired
daikema Mar 17, 2023
9a71c64
Tweak docs as per suggestion from Adrianna
daikema Apr 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
141 changes: 141 additions & 0 deletions config/config_schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -341,6 +341,143 @@
]
}
}
},
"oidcAuthProvider": {
"title": "OpenID Connect AuthProvider",
"description": "OpenID Connect authentication configuration",
"type": "object",
"additionalProperties": false,
"required": [
"idpUrl",
"uniqueField",
"clientId",
"scope",
"localPublicKeyLocation",
"localPrivateKeyLocation",
"keyAlgorithm",
"issuer",
"symmetricKeyLocation"
],
"properties": {
"idpUrl": {
"description": "Base URL for identity provider endpoint",
"type": "string",
"format": "uri",
"pattern": "^https?://",
"examples": [
"https://domain.xyz/auth/realms/example"
]
},
"uniqueField": {
"description": "Name of unique field to use as user ID. Note that as per the OpenID Connect specification only sub/issuer combination is guaranteed to be stable and unique for an arbitrary issuer, though other values such as preferred_username may be usable when the team running the CARTA installation and the issuer are the same.",
"type": "string",
"examples": [
"sub",
"preferred_username"
],
"default": "sub"
},
"clientId": {
"description": "Client ID as registered with identity provider",
"type": "string",
"minLength": 1,
"examples": [
"carta"
]
},
"clientSecret": {
"description": "Client secret as registered with identity provider",
"type": "string",
"minLength": 1
},
"scope": {
"description": "Scopes to request from the OpenID Connect server",
"type": "string",
"default": "openid",
"examples": [
"openid",
"openid groups"
]
},
"userLookupTable": {
"description": "Path of user lookup table as text file in format <unique user ID> <system user>. If no user lookup is needed, this should be omitted. Example table given in `usertable.txt.stub`",
"type": "string",
"examples": [
"/etc/carta/userlookup.txt"
]
},
"groupsField": {
"description": "Name of field containing list of user roles/groups",
"type": "string",
"examples": [
"groups",
"roles"
]
},
"requiredGroup": {
"description": "Role to ensure is included among the values in groupsField",
"type": "string",
"examples": [
"carta-users",
"carta-testers"
]
},
"localPublicKeyLocation": {
"description": "Path to public key (in PEM format) used for verifying JWTs",
"type": "string",
"examples": [
"/etc/carta/carta_public.pem"
]
},
"localPrivateKeyLocation": {
"description": "Path to private key (in PEM format) used for signing JWTs",
"type": "string",
"examples": [
"/etc/carta/carta_private.pem"
]
},
"keyAlgorithm": {
"$ref": "#/definitions/keyAlgorithm",
"default": "RS256"
},
"issuer": {
"description": "Issuer field for JWT",
"type": "string",
"examples": [
"my-carta-server"
]
},
"cacheAccessTokenMinValidity": {
"description": "If an access token was previously issued from the upstream server with at least this many seconds of lifetime remaining, a new upstream query will not be performed and a local token with the previous token's remaining lifetime will be issued instead",
"type": "integer",
"default": 100
},
"symmetricKeyLocation": {
"description": "Path to symmetric key (base64-encoded) used for refresh tokens. At present this uses the A256GCM algorithm which requires 32 bytes of random data which can be generated using `openssl rand -base64 32`",
"type": "string",
"examples": [
"/etc/carta/carta_symmetric.pem"
]
},
"symmetricKeyType": {
"description": "Selected from the 'JSON Web Signature and Encryption Algorithms' section of https://www.iana.org/assignments/jose/jose.xhtml",
"type": "string",
"default": "A256GCM"
},
"additionalAuthParams": {
"description": "Additional parameters to include in authentication requests to deal with identity providers. The example contains the additional arguments required to ensure that Google provide a refresh token when using it with OIDC.",
"type": "array",
"default": [],
"examples": [
[[["access_type", "offline"], ["prompt", "consent"]]]
],
"items": {
"type": "array",
"minItems": 2,
"maxItems": 2
}
}
}
}
},
"additionalProperties": false,
Expand Down Expand Up @@ -369,6 +506,10 @@
"external": {
"description": "External AuthProvider",
"$ref": "#/definitions/externalAuthProvider"
},
"oidc": {
"description": "OpenID Connect AuthProvider",
"$ref": "#/definitions/oidcAuthProvider"
}
},
"default": {
Expand Down
9 changes: 8 additions & 1 deletion docs/src/configuration.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,14 +35,21 @@ To provide the ``carta`` user with these privileges, you must make modifications
Authentication
~~~~~~~~~~~~~~

When configured to use PAM or LDAP authentication, the controller signs and validates refresh and access tokens with SSL keys. You can generate a private/public key pair in PEM format using ``openssl``:
The controller signs and validates tokens with SSL keys. You can generate a private/public key pair in PEM format using ``openssl``:

.. code-block:: shell

cd /etc/carta
openssl genrsa -out carta_private.pem 4096
openssl rsa -in carta_private.pem -outform PEM -pubout -out carta_public.pem

The access tokens use a public/private keypair whether using LDAP, PAM, or OIDC authentication. However, when using OIDC authentication an additional symmetric encryption key is required for the refresh tokens. (When using LDAP or PAM authentication the same public/private keypair as used with the access tokens is also used for the refresh tokens). If using the default encryption algorithm, you can again use ``openssl`` to generate the needed key:
Comment thread
daikema marked this conversation as resolved.
Outdated

.. code-block:: shell

openssl rand -base64 32 > /etc/carta/symm.key


PAM may be configured to use the host's local UNIX user authentication, or to communicate with a local or remote LDAP server. If the UNIX module is used for authentication, the ``carta`` user must be given read-only access to ``/etc/shadow``. This is not required if you use PAM's LDAP module or the direct LDAP authentication method.

.. _config-nginx:
Expand Down
110 changes: 110 additions & 0 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading