summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorJoachim Mathes2020-11-21 20:26:12 +0100
committerJoachim Mathes2020-11-25 19:23:55 +0100
commit729b387536d2bcf43a20b2ddead4bffdfd342d2a (patch)
treea8b78acc279dc805d419ffb1f791dcd0493515ce /lib
parentc59d4c7c5c5c5ea07734c9a3f8676cb95d68aba4 (diff)
Add oauth2 authorization
Signed-off-by: Joachim Mathes <joachim_mathes@web.de>
Diffstat (limited to '')
-rw-r--r--lib/config/environment.js5
-rw-r--r--lib/web/auth/oauth2/index.js23
2 files changed, 26 insertions, 2 deletions
diff --git a/lib/config/environment.js b/lib/config/environment.js
index cf9fb5a1..494e669f 100644
--- a/lib/config/environment.js
+++ b/lib/config/environment.js
@@ -87,6 +87,7 @@ module.exports = {
providerName: process.env.CMD_OAUTH2_PROVIDERNAME,
baseURL: process.env.CMD_OAUTH2_BASEURL,
userProfileURL: process.env.CMD_OAUTH2_USER_PROFILE_URL,
+ userProfileIdAttr: process.env.CMD_OAUTH2_USER_PROFILE_ID_ATTR,
userProfileUsernameAttr: process.env.CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR,
userProfileDisplayNameAttr: process.env.CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR,
userProfileEmailAttr: process.env.CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR,
@@ -94,7 +95,9 @@ module.exports = {
authorizationURL: process.env.CMD_OAUTH2_AUTHORIZATION_URL,
clientID: process.env.CMD_OAUTH2_CLIENT_ID,
clientSecret: process.env.CMD_OAUTH2_CLIENT_SECRET,
- scope: process.env.CMD_OAUTH2_SCOPE
+ scope: process.env.CMD_OAUTH2_SCOPE,
+ rolesClaim: process.env.CMD_OAUTH2_ROLES_CLAIM,
+ accessRole: process.env.CMD_OAUTH2_ACCESS_ROLE
},
dropbox: {
clientID: process.env.CMD_DROPBOX_CLIENTID,
diff --git a/lib/web/auth/oauth2/index.js b/lib/web/auth/oauth2/index.js
index 6e3e8373..b8e62dda 100644
--- a/lib/web/auth/oauth2/index.js
+++ b/lib/web/auth/oauth2/index.js
@@ -4,6 +4,7 @@ const Router = require('express').Router
const passport = require('passport')
const { Strategy, InternalOAuthError } = require('passport-oauth2')
const config = require('../../../config')
+const logger = require('../../../logger')
const { passportGeneralCallback } = require('../utils')
let oauth2Auth = module.exports = Router()
@@ -31,6 +32,7 @@ class OAuth2CustomStrategy extends Strategy {
return done(new Error('Failed to parse user profile'))
}
+ checkAuthorization(json, done)
let profile = parseProfile(json)
profile.provider = 'oauth2'
@@ -50,18 +52,36 @@ function extractProfileAttribute (data, path) {
}
function parseProfile (data) {
+ const id = extractProfileAttribute(data, config.oauth2.userProfileIdAttr)
const username = extractProfileAttribute(data, config.oauth2.userProfileUsernameAttr)
const displayName = extractProfileAttribute(data, config.oauth2.userProfileDisplayNameAttr)
const email = extractProfileAttribute(data, config.oauth2.userProfileEmailAttr)
return {
- id: username,
+ id: id || username,
username: username,
displayName: displayName,
email: email
}
}
+function checkAuthorization (data, done) {
+ const roles = extractProfileAttribute(data, config.oauth2.rolesClaim)
+ const username = extractProfileAttribute(data, config.oauth2.userProfileUsernameAttr)
+
+ if (config.oauth2.accessRole) {
+ if (!roles) {
+ logger.error('oauth2: "accessRole" configured, but user profile doesn\'t contain roles attribute. Permission denied')
+ return done('Permission denied', null)
+ }
+
+ if (!roles.includes(config.oauth2.accessRole)) {
+ logger.debug(`oauth2: user "${username}" doesn't have the required role. Permission denied`)
+ return done('Permission denied', null)
+ }
+ }
+}
+
OAuth2CustomStrategy.prototype.userProfile = function (accessToken, done) {
this._oauth2.get(this._userProfileURL, accessToken, function (err, body, res) {
var json
@@ -76,6 +96,7 @@ OAuth2CustomStrategy.prototype.userProfile = function (accessToken, done) {
return done(new Error('Failed to parse user profile'))
}
+ checkAuthorization(json, done)
let profile = parseProfile(json)
profile.provider = 'oauth2'