2 files changed, 26 insertions, 2 deletions
diff --git a/lib/config/environment.js b/lib/config/environment.js
index cf9fb5a1..494e669f 100644
--- a/lib/config/environment.js
+++ b/lib/config/environment.js
@@ -87,6 +87,7 @@ module.exports = {
     providerName: process.env.CMD_OAUTH2_PROVIDERNAME,
     baseURL: process.env.CMD_OAUTH2_BASEURL,
     userProfileURL: process.env.CMD_OAUTH2_USER_PROFILE_URL,
+    userProfileIdAttr: process.env.CMD_OAUTH2_USER_PROFILE_ID_ATTR,
     userProfileUsernameAttr: process.env.CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR,
     userProfileDisplayNameAttr: process.env.CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR,
     userProfileEmailAttr: process.env.CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR,
@@ -94,7 +95,9 @@ module.exports = {
     authorizationURL: process.env.CMD_OAUTH2_AUTHORIZATION_URL,
     clientID: process.env.CMD_OAUTH2_CLIENT_ID,
     clientSecret: process.env.CMD_OAUTH2_CLIENT_SECRET,
-    scope: process.env.CMD_OAUTH2_SCOPE
+    scope: process.env.CMD_OAUTH2_SCOPE,
+    rolesClaim: process.env.CMD_OAUTH2_ROLES_CLAIM,
+    accessRole: process.env.CMD_OAUTH2_ACCESS_ROLE
   },
   dropbox: {
     clientID: process.env.CMD_DROPBOX_CLIENTID,
diff --git a/lib/web/auth/oauth2/index.js b/lib/web/auth/oauth2/index.js
index 6e3e8373..b8e62dda 100644
--- a/lib/web/auth/oauth2/index.js
+++ b/lib/web/auth/oauth2/index.js
@@ -4,6 +4,7 @@ const Router = require('express').Router
 const passport = require('passport')
 const { Strategy, InternalOAuthError } = require('passport-oauth2')
 const config = require('../../../config')
+const logger = require('../../../logger')
 const { passportGeneralCallback } = require('../utils')
 
 let oauth2Auth = module.exports = Router()
@@ -31,6 +32,7 @@ class OAuth2CustomStrategy extends Strategy {
         return done(new Error('Failed to parse user profile'))
       }
 
+      checkAuthorization(json, done)
       let profile = parseProfile(json)
       profile.provider = 'oauth2'
 
@@ -50,18 +52,36 @@ function extractProfileAttribute (data, path) {
 }
 
 function parseProfile (data) {
+  const id = extractProfileAttribute(data, config.oauth2.userProfileIdAttr)
   const username = extractProfileAttribute(data, config.oauth2.userProfileUsernameAttr)
   const displayName = extractProfileAttribute(data, config.oauth2.userProfileDisplayNameAttr)
   const email = extractProfileAttribute(data, config.oauth2.userProfileEmailAttr)
 
   return {
-    id: username,
+    id: id || username,
     username: username,
     displayName: displayName,
     email: email
   }
 }
 
+function checkAuthorization (data, done) {
+  const roles = extractProfileAttribute(data, config.oauth2.rolesClaim)
+  const username = extractProfileAttribute(data, config.oauth2.userProfileUsernameAttr)
+
+  if (config.oauth2.accessRole) {
+    if (!roles) {
+      logger.error('oauth2: "accessRole" configured, but user profile doesn\'t contain roles attribute. Permission denied')
+      return done('Permission denied', null)
+    }
+
+    if (!roles.includes(config.oauth2.accessRole)) {
+      logger.debug(`oauth2: user "${username}" doesn't have the required role. Permission denied`)
+      return done('Permission denied', null)
+    }
+  }
+}
+
 OAuth2CustomStrategy.prototype.userProfile = function (accessToken, done) {
   this._oauth2.get(this._userProfileURL, accessToken, function (err, body, res) {
     var json
@@ -76,6 +96,7 @@ OAuth2CustomStrategy.prototype.userProfile = function (accessToken, done) {
       return done(new Error('Failed to parse user profile'))
     }
 
+    checkAuthorization(json, done)
     let profile = parseProfile(json)
     profile.provider = 'oauth2'