Feature/openid connect #3093

Original file line number	Diff line number	Diff line change
Expand Up		@@ -86,6 +86,7 @@
		"cookie-parser": "^1.4.5",
		"env-paths": "^2.2.0",
		"express": "^5.0.0-alpha.8",
	"express-openid-connect": "^2.3.1",
		"http-proxy": "^1.18.0",
		"httpolyglot": "^0.1.2",
		"js-yaml": "^4.0.0",
Expand Down

16 changes: 15 additions & 1 deletion src/node/app.ts

Show comments View file Open in desktop

Original file line number	Diff line number	Diff line change
		@@ -1,11 +1,12 @@
		import { logger } from "@coder/logger"
		import compression from "compression"
		import express, { Express } from "express"
	import { auth } from "express-openid-connect"
		import { promises as fs } from "fs"
		import http from "http"
		import * as httpolyglot from "httpolyglot"
		import * as util from "../common/util"
	import { DefaultedArgs } from "./cli"
	import { AuthType, DefaultedArgs } from "./cli"
		import { handleUpgrade } from "./wsRouter"

		/**
Expand Down Expand Up		@@ -59,6 +60,19 @@ export const createApp = async (args: DefaultedArgs): Promise<[Express, Express,
		const wsApp = express()
		handleUpgrade(wsApp, server)

	if (args.auth == AuthType.Openid) {
	const openidConfig = {
	authRequired: true,
	auth0Logout: true,
	issuerBaseURL: args["openid-issuer-base-url"],
	clientID: args["openid-client-id"],
	baseURL: args["openid-base-url"],
	secret: args["openid-secret"]
	};
	app.use(auth(openidConfig));
	wsApp.use(auth(openidConfig));
	}

		return [app, wsApp, server]
		}

Expand Down

31 changes: 31 additions & 0 deletions src/node/cli.ts

Show comments View file Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -9,6 +9,7 @@ import { canConnect, generateCertificate, generatePassword, humanPath, paths } f
		export enum AuthType {
		Password = "password",
		None = "none",
	Openid = "openid"
		}

		export class Optional<T> {
Expand All		@@ -29,6 +30,12 @@ export interface Args extends VsArgs {
		config?: string
		auth?: AuthType
		password?: string
	"openid-issuer-base-url"?: string
	"openid-client-id"?: string
	"openid-base-url"?: string
	"openid-secret"?: string
	"openid-group-claim"?:string
	"openid-user-group"?:string
		"hashed-password"?: string
		cert?: OptionalString
		"cert-host"?: string
Expand Down Expand Up		@@ -105,6 +112,30 @@ const options: Options<Required<Args>> = {
		type: "string",
		description: "The password for password authentication (can only be passed in via $PASSWORD or the config file).",
		},
	"openid-issuer-base-url": {
	type: "string",
	description: "The base url for providers .well-known endpoint",
	},
	"openid-client-id": {
	type: "string",
	description: "The client ID of this OpenID application",
	},
	"openid-base-url": {
	type: "string",
	description: "The base URL for code-server",
	},
	"openid-secret": {
	type: "string",
	description: "A long secret used to encrypt the session cookie",
	},
	"openid-group-claim": {
	type: "string",
	description: "A claim that contains the authenticated users group assignments",
	},
	"openid-user-group": {
	type: "string",
	description: "The group that a user will need to be a member of to access this instance",
	},
		"hashed-password": {
		type: "string",
		description:
Expand Down

25 changes: 25 additions & 0 deletions src/node/http.ts

Show comments View file Open in desktop

Original file line number	Diff line number	Diff line change
		@@ -1,6 +1,7 @@
		import { field, logger } from "@coder/logger"
		import * as express from "express"
		import * as expressCore from "express-serve-static-core"
	import { RequestContext } from "express-openid-connect"
		import qs from "qs"
		import safeCompare from "safe-compare"
		import { HttpCode, HttpError } from "../common/http"
Expand All		@@ -16,6 +17,7 @@ declare global {
		export interface Request {
		args: DefaultedArgs
		heart: Heart
	oidc: RequestContext
		}
		}
		}
Expand Down Expand Up		@@ -69,6 +71,29 @@ export const authenticated = (req: express.Request): boolean => {
		? safeCompare(req.cookies.key, req.args["hashed-password"])
		: req.args.password && safeCompare(req.cookies.key, hash(req.args.password)))
		)
	case AuthType.Openid:
	console.log(req.oidc.user)
Copy link @jawnsy jawnsy Apr 10, 2021 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. It looks like we might want to use `console.debug` and add some other text here? It's definitely helpful to have debug output as figuring out OIDC integration problems can be... a challenge 😅 but we'd some other text that we can search for, so we know where the logs are coming from. maybe something like: console.debug("authenticated using OpenID Connect as", req.oidc.user) other debug info like the returned OIDC claims seems useful too? they're secret credentials, but since code-server is meant for a single user, maybe logging those is OK? Copy link Author @dylanturn dylanturn Apr 10, 2021 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Yes, very sorry, I'll include this change along with the updates to yarn lockfile. Copy link @jawnsy jawnsy Apr 10, 2021 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. No apologies needed! Thanks so much for your contribution! ❤️
	console.log(req.oidc.isAuthenticated())

	const groupClaim = req.args["openid-group-claim"]
	const userGroup = req.args["openid-user-group"]

	if (req.oidc.isAuthenticated()){
	for (const key in req.oidc.idTokenClaims) {
	var claims = <string[]>req.oidc.idTokenClaims[key]
	if (key == groupClaim) {
	for (const value in claims) {
	if(userGroup == claims[value]) {
	return true
	}
	}
	}
	}
	throw new HttpError("Unauthorized", HttpCode.Unauthorized)
	}

	return false

		default:
		throw new Error(`Unsupported auth type ${req.args.auth}`)
		}
Expand Down

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Feature/openid connect #3093

Uh oh!

Feature/openid connect #3093

Filter by extension

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

@jawnsy jawnsy Apr 10, 2021

Choose a reason for hiding this comment

Uh oh!

@dylanturn dylanturn Apr 10, 2021

Choose a reason for hiding this comment

Uh oh!

@jawnsy jawnsy Apr 10, 2021

Choose a reason for hiding this comment

Uh oh!

Uh oh!