From 40b385570291278f44806446f702ee61e1382805 Mon Sep 17 00:00:00 2001 From: Pedro Ferreira Date: Tue, 27 Jun 2017 19:08:05 +0200 Subject: Add support for generic OAuth2 providers Signed-off-by: Pedro Ferreira --- lib/config/default.js | 6 ++ lib/config/environment.js | 11 ++++ lib/config/index.js | 1 + lib/response.js | 4 ++ lib/web/auth/index.js | 1 + lib/web/auth/oauth2/index.js | 106 +++++++++++++++++++++++++++++++++++ public/views/index/body.ejs | 4 +- public/views/shared/signin-modal.ejs | 9 ++- 8 files changed, 138 insertions(+), 4 deletions(-) create mode 100644 lib/web/auth/oauth2/index.js diff --git a/lib/config/default.js b/lib/config/default.js index 19ddccf6..48916c89 100644 --- a/lib/config/default.js +++ b/lib/config/default.js @@ -72,6 +72,12 @@ module.exports = { }, s3bucket: undefined, // authentication + oauth2: { + authorizationURL: undefined, + tokenURL: undefined, + clientID: undefined, + clientSecret: undefined + }, facebook: { clientID: undefined, clientSecret: undefined diff --git a/lib/config/environment.js b/lib/config/environment.js index cab3bc3e..66fa5284 100644 --- a/lib/config/environment.js +++ b/lib/config/environment.js @@ -66,6 +66,17 @@ module.exports = { clientID: process.env.HMD_MATTERMOST_CLIENTID, clientSecret: process.env.HMD_MATTERMOST_CLIENTSECRET }, + oauth2: { + baseURL: process.env.HMD_OAUTH2_BASEURL, + userProfileURL: process.env.HMD_OAUTH2_USER_PROFILE_URL, + userProfileUsernameAttr: process.env.HMD_OAUTH2_USER_PROFILE_USERNAME_ATTR, + userProfileDisplayNameAttr: process.env.HMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR, + userProfileEmailAttr: process.env.HMD_OAUTH2_USER_PROFILE_EMAIL_ATTR, + tokenURL: process.env.HMD_OAUTH2_TOKEN_URL, + authorizationURL: process.env.HMD_OAUTH2_AUTHORIZATION_URL, + clientID: process.env.HMD_OAUTH2_CLIENT_ID, + clientSecret: process.env.HMD_OAUTH2_CLIENT_SECRET + }, dropbox: { clientID: process.env.HMD_DROPBOX_CLIENTID, clientSecret: process.env.HMD_DROPBOX_CLIENTSECRET, diff --git a/lib/config/index.js b/lib/config/index.js index fae51e52..63c23f0c 100644 --- a/lib/config/index.js +++ b/lib/config/index.js @@ -98,6 +98,7 @@ config.isGitLabEnable = config.gitlab.clientID && config.gitlab.clientSecret config.isMattermostEnable = config.mattermost.clientID && config.mattermost.clientSecret config.isLDAPEnable = config.ldap.url config.isSAMLEnable = config.saml.idpSsoUrl +config.isOAuth2Enable = config.oauth2.clientID && config.oauth2.clientSecret config.isPDFExportEnable = config.allowPDFExport // merge legacy values diff --git a/lib/response.js b/lib/response.js index b18fd7a3..8dc1ed35 100644 --- a/lib/response.js +++ b/lib/response.js @@ -70,6 +70,8 @@ function showIndex (req, res, next) { ldap: config.isLDAPEnable, ldapProviderName: config.ldap.providerName, saml: config.isSAMLEnable, + oauth2: config.isOAuth2Enable, + oauth2ProviderName: config.oauth2.providerName, email: config.isEmailEnable, allowEmailRegister: config.allowEmailRegister, allowPDFExport: config.allowPDFExport, @@ -104,7 +106,9 @@ function responseHackMD (res, note) { google: config.isGoogleEnable, ldap: config.isLDAPEnable, ldapProviderName: config.ldap.providerName, + oauth2ProviderName: config.oauth2.providerName, saml: config.isSAMLEnable, + oauth2: config.isOAuth2Enable, email: config.isEmailEnable, allowEmailRegister: config.allowEmailRegister, allowPDFExport: config.allowPDFExport diff --git a/lib/web/auth/index.js b/lib/web/auth/index.js index eb42fb36..61e7c3f9 100644 --- a/lib/web/auth/index.js +++ b/lib/web/auth/index.js @@ -43,6 +43,7 @@ if (config.isDropboxEnable) authRouter.use(require('./dropbox')) if (config.isGoogleEnable) authRouter.use(require('./google')) if (config.isLDAPEnable) authRouter.use(require('./ldap')) if (config.isSAMLEnable) authRouter.use(require('./saml')) +if (config.isOAuth2Enable) authRouter.use(require('./oauth2')) if (config.isEmailEnable) authRouter.use(require('./email')) // logout diff --git a/lib/web/auth/oauth2/index.js b/lib/web/auth/oauth2/index.js new file mode 100644 index 00000000..f2a3132d --- /dev/null +++ b/lib/web/auth/oauth2/index.js @@ -0,0 +1,106 @@ +'use strict' + +const Router = require('express').Router +const passport = require('passport') +const OAuth2Strategy = require('passport-oauth2').Strategy +const config = require('../../../config') +const {setReturnToFromReferer, passportGeneralCallback} = require('../utils') + +let oauth2Auth = module.exports = Router() + +class OAuth2CustomStrategy extends OAuth2Strategy { + constructor (options, verify) { + options.customHeaders = options.customHeaders || {} + super(options, verify) + this.name = 'oauth2' + this._userProfileURL = options.userProfileURL + this._oauth2.useAuthorizationHeaderforGET(true) + } + + userProfile (accessToken, done) { + this._oauth2.get(this._userProfileURL, accessToken, function (err, body, res) { + var json + + if (err) { + return done(new passport.InternalOAuthError('Failed to fetch user profile', err)) + } + + try { + json = JSON.parse(body) + } catch (ex) { + return done(new Error('Failed to parse user profile')) + } + + let profile = parseProfile(json) + profile.provider = 'oauth2' + + done(null, profile) + }) + } +} + +function extractProfileAttribute (data, path) { + // can handle stuff like `attrs[0].name` + path = path.split('.') + for (const segment of path) { + const m = segment.match(/([\d\w]+)\[(.*)\]/) + data = m ? data[m[1]][m[2]] : data[segment] + } + return data +} + +function parseProfile (data) { + const username = extractProfileAttribute(data, config.oauth2.userProfileUsernameAttr) + const displayName = extractProfileAttribute(data, config.oauth2.userProfileDisplayNameAttr) + const email = extractProfileAttribute(data, config.oauth2.userProfileEmailAttr) + + return { + id: username, + username: username, + displayName: displayName, + email: email + } +} + +OAuth2CustomStrategy.prototype.userProfile = function (accessToken, done) { + this._oauth2.get(this._userProfileURL, accessToken, function (err, body, res) { + var json + + if (err) { + return done(new passport.InternalOAuthError('Failed to fetch user profile', err)) + } + + try { + json = JSON.parse(body) + } catch (ex) { + return done(new Error('Failed to parse user profile')) + } + + let profile = parseProfile(json) + profile.provider = 'oauth2' + + done(null, profile) + }) +} + +passport.use(new OAuth2CustomStrategy({ + authorizationURL: config.oauth2.authorizationURL, + tokenURL: config.oauth2.tokenURL, + clientID: config.oauth2.clientID, + clientSecret: config.oauth2.clientSecret, + callbackURL: config.serverURL + '/auth/oauth2/callback', + userProfileURL: config.oauth2.userProfileURL +}, passportGeneralCallback)) + +oauth2Auth.get('/auth/oauth2', function (req, res, next) { + setReturnToFromReferer(req) + passport.authenticate('oauth2')(req, res, next) +}) + +// github auth callback +oauth2Auth.get('/auth/oauth2/callback', + passport.authenticate('oauth2', { + successReturnToOrRedirect: config.serverurl + '/', + failureRedirect: config.serverurl + '/' + }) +) diff --git a/public/views/index/body.ejs b/public/views/index/body.ejs index d8766fec..bf7988b7 100644 --- a/public/views/index/body.ejs +++ b/public/views/index/body.ejs @@ -15,7 +15,7 @@ <% if(allowAnonymous) { %> <%= __('New guest note') %> <% } %> - <% if(facebook || twitter || github || gitlab || mattermost || dropbox || google || ldap || saml || email) { %> + <% if(facebook || twitter || github || gitlab || mattermost || dropbox || google || ldap || saml || oauth2 || email) { %> <% } %> @@ -49,7 +49,7 @@ <% if (errorMessage && errorMessage.length > 0) { %>
<%= errorMessage %>
<% } %> - <% if(facebook || twitter || github || gitlab || mattermost || dropbox || google || ldap || saml || email) { %> + <% if(facebook || twitter || github || gitlab || mattermost || dropbox || google || ldap || saml || oauth2 || email) { %>
diff --git a/public/views/shared/signin-modal.ejs b/public/views/shared/signin-modal.ejs index 82b5cf1f..f0cffad9 100644 --- a/public/views/shared/signin-modal.ejs +++ b/public/views/shared/signin-modal.ejs @@ -48,7 +48,12 @@ <%= __('Sign in via %s', 'SAML') %> <% } %> - <% if((facebook || twitter || github || gitlab || mattermost || dropbox || google || saml) && ldap) { %> + <% if(oauth2) { %> + + <%= __('Sign in via %s', oauth2ProviderName || 'OAuth2') %> + + <% } %> + <% if((facebook || twitter || github || gitlab || mattermost || dropbox || google || saml || oauth2) && ldap) { %>
<% }%> <% if(ldap) { %> @@ -73,7 +78,7 @@ <% } %> - <% if((facebook || twitter || github || gitlab || mattermost || dropbox || google || ldap) && email) { %> + <% if((facebook || twitter || github || gitlab || mattermost || dropbox || google || ldap || oauth2) && email) { %>
<% }%> <% if(email) { %> -- cgit v1.2.3 From 34df7ccce83bebec1db3b6995eb25cb6fe4fdbd4 Mon Sep 17 00:00:00 2001 From: Pedro Ferreira Date: Mon, 10 Jul 2017 20:09:59 +0200 Subject: Use TEXT instead of STRING for tokens Signed-off-by: Pedro Ferreira --- .../20180326103000-use-text-in-tokens.js | 23 ++++++++++++++++++++++ lib/models/user.js | 4 ++-- 2 files changed, 25 insertions(+), 2 deletions(-) create mode 100644 lib/migrations/20180326103000-use-text-in-tokens.js diff --git a/lib/migrations/20180326103000-use-text-in-tokens.js b/lib/migrations/20180326103000-use-text-in-tokens.js new file mode 100644 index 00000000..f9507747 --- /dev/null +++ b/lib/migrations/20180326103000-use-text-in-tokens.js @@ -0,0 +1,23 @@ +'use strict' + +module.exports = { + up: function (queryInterface, Sequelize) { + return queryInterface.changeColumn('Users', 'accessToken', { + type: Sequelize.TEXT + }).then(function () { + return queryInterface.changeColumn('Users', 'refreshToken', { + type: Sequelize.TEXT + }) + }) + }, + + down: function (queryInterface, Sequelize) { + return queryInterface.changeColumn('Users', 'accessToken', { + type: Sequelize.STRING + }).then(function () { + return queryInterface.changeColumn('Users', 'refreshToken', { + type: Sequelize.STRING + }) + }) + } +} diff --git a/lib/models/user.js b/lib/models/user.js index f421fe43..ea249726 100644 --- a/lib/models/user.js +++ b/lib/models/user.js @@ -26,10 +26,10 @@ module.exports = function (sequelize, DataTypes) { type: DataTypes.TEXT }, accessToken: { - type: DataTypes.STRING + type: DataTypes.TEXT }, refreshToken: { - type: DataTypes.STRING + type: DataTypes.TEXT }, email: { type: Sequelize.TEXT, -- cgit v1.2.3