Skip to content

OIDC serverside login #129

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
veggiesaurus merged 21 commits into from
Apr 17, 2023
Merged

OIDC serverside login #129

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
b91e27b
Add jose for JWKS
daikema Jul 15, 2022
443057d
Add axios
daikema Jul 25, 2022
2a7563b
Still need to add better error-handling + do more tests but mostly there
daikema Aug 23, 2022
ede2c42
Refactoring + tweaks for Google compatibility
daikema Aug 23, 2022
004d27b
Encrypt state stored with client + improve error reporting
daikema Sep 19, 2022
5edf9bb
Merge remote-tracking branch 'origin/dev' into oidc-serverside
daikema Sep 19, 2022
4e9cdd6
De-var-ify
daikema Sep 19, 2022
fd352a9
Update JOSE to address https://github.com/advisories/GHSA-jv3g-j58f-9mq9
daikema Sep 26, 2022
bc5e37e
Update config schema docs as per confluence's suggestions
daikema Oct 20, 2022
c36a4f6
Export mongo client for use in OIDC refresh tokens
daikema Feb 24, 2023
8718507
Merge remote-tracking branch 'origin/dev' into oidc-serverside
daikema Feb 24, 2023
0956797
Merge remote-tracking branch 'origin/dev' into oidc-serverside
daikema Feb 27, 2023
8c07979
Initial lock manager draft. Still WIP
daikema Mar 2, 2023
3a01b88
Initial ... needs more testing
daikema Mar 10, 2023
b58cfda
Fixed key length
daikema Mar 15, 2023
b949651
Oops... wrong table
daikema Mar 15, 2023
af55f94
Now actually using the stored refresh tokens
daikema Mar 16, 2023
6eed650
Final tweaks
daikema Mar 17, 2023
c0c1132
Doc updates re: OIDC
daikema Mar 17, 2023
73a7dac
Verify lock was acquired
daikema Mar 17, 2023
9a71c64
Tweak docs as per suggestion from Adrianna
daikema Apr 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
141 changes: 141 additions & 0 deletions config/config_schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -341,6 +341,143 @@
]
}
}
},
"oidcAuthProvider": {
"title": "OpenID Connect AuthProvider",
"description": "OpenID Connect authentication configuration",
"type": "object",
"additionalProperties": false,
"required": [
"idpUrl",
"uniqueField",
"clientId",
"scope",
"localPublicKeyLocation",
"localPrivateKeyLocation",
"keyAlgorithm",
"issuer",
"symmetricKeyLocation"
],
"properties": {
"idpUrl": {
"description": "Base URL for identity provider endpoint",
"type": "string",
"format": "uri",
"pattern": "^https?://",
"examples": [
"https://domain.xyz/auth/realms/example"
]
},
"uniqueField": {
"description": "Name of unique field to use as user ID. Note that as per the OpenID Connect specification only sub/issuer combination is guaranteed to be stable and unique for an arbitrary issuer, though other values such as preferred_username may be usable when the team running the CARTA installation and the issuer are the same.",
"type": "string",
"examples": [
"sub",
"preferred_username"
],
"default": "sub"
},
"clientId": {
"description": "Client ID as registered with identity provider",
"type": "string",
"minLength": 1,
"examples": [
"carta"
]
},
"clientSecret": {
"description": "Client secret as registered with identity provider",
"type": "string",
"minLength": 1
},
"scope": {
"description": "Scopes to request from the OpenID Connect server",
"type": "string",
"default": "openid",
"examples": [
"openid",
"openid groups"
]
},
"userLookupTable": {
"description": "Path of user lookup table as text file in format <unique user ID> <system user>. If no user lookup is needed, this should be omitted. Example table given in `usertable.txt.stub`",
"type": "string",
"examples": [
"/etc/carta/userlookup.txt"
]
},
"groupsField": {
"description": "Name of field containing list of user roles/groups",
"type": "string",
"examples": [
"groups",
"roles"
]
},
"requiredGroup": {
"description": "Role to ensure is included among the values in groupsField",
"type": "string",
"examples": [
"carta-users",
"carta-testers"
]
},
"localPublicKeyLocation": {
"description": "Path to public key (in PEM format) used for verifying JWTs",
"type": "string",
"examples": [
"/etc/carta/carta_public.pem"
]
},
"localPrivateKeyLocation": {
"description": "Path to private key (in PEM format) used for signing JWTs",
"type": "string",
"examples": [
"/etc/carta/carta_private.pem"
]
},
"keyAlgorithm": {
"$ref": "#/definitions/keyAlgorithm",
"default": "RS256"
},
"issuer": {
"description": "Issuer field for JWT",
"type": "string",
"examples": [
"my-carta-server"
]
},
"cacheAccessTokenMinValidity": {
"description": "If previously issued an access token from upstream server with at least this many seconds of lifetime remaining, a local token with the previous token's remaining lifetime will be issued instead of performing an upstream query",
Comment thread
veggiesaurus marked this conversation as resolved.
Outdated
"type": "integer",
"default": 100
},
"symmetricKeyLocation": {
"description": "Path to symmetric key (base64-encoded) used for refresh tokens. At present this uses the A256GCM algorithm which requires 32 bytes of random data which can be generated using `openssl rand -base64 32`",
"type": "string",
"examples": [
"/etc/carta/carta_symmetric.pem"
]
},
"symmetricKeyType": {
"description": "As per options at https://www.iana.org/assignments/jose/jose.xhtml when using direct use of shared key",

@confluence confluence Oct 12, 2022

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"when using direct use of shared key" sounds odd. Should this be "when a shared key is used directly"?

The description also doesn't describe the option. Should this be "Type of symmetric key as per (...)"

Is the "shared key" the same thing as the "symmetric key"? Is the "shared key" qualification also needed for the location option above?

"type": "string",
"default": "A256GCM"
},
"additionalAuthParams": {
"description": "additional parameters to include in authentication requests to deal with identity providers ",
"type": "array",
"default": [],
"examples": [
[[["access_type", "offline"], ["prompt", "consent"]]]
],
"items": {
"type": "array",
"minItems": 2,
"maxItems": 2
}
}
}
}
},
"additionalProperties": false,
Expand Down Expand Up @@ -369,6 +506,10 @@
"external": {
"description": "External AuthProvider",
"$ref": "#/definitions/externalAuthProvider"
},
"oidc": {
"description": "OpenID Connect AuthProvider",
"$ref": "#/definitions/oidcAuthProvider"
}
},
"default": {
Expand Down
122 changes: 116 additions & 6 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading