feat: add OIDC single sign-on

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.20.6-alpine3.18 as builder
+FROM golang:1.25.0-alpine3.22 as builder
 
 WORKDIR $GOPATH/src/github.com/feiyu563/PrometheusAlert
 
@@ -14,7 +14,7 @@ COPY . $GOPATH/src/github.com/feiyu563/PrometheusAlert
 RUN go build
 
 # -----------------------------------------------------------------------------
-FROM alpine:3.18
+FROM alpine:3.22
 
 LABEL maintainer="jikun.zhang"
 

conf/app-example.conf

@@ -62,6 +62,29 @@ maxIdleConns=100
 # 热更新配置文件
 open-hotreload=0
 
+#---------------------↓OIDC SSO配置-----------------------
+#是否开启OIDC单点登录，0为关闭，1为开启，开启后仍保留本地账号密码作为应急登录方式
+sso_enabled=0
+#OIDC Provider的Issuer地址，例如：https://id.example.com/realms/ops
+sso_issuer_url=
+#OIDC Client配置，客户端须启用Authorization Code Flow，并注册下方回调地址
+sso_client_id=
+sso_client_secret=
+sso_redirect_url=https://prometheusalert.example.com/sso/callback
+#OIDC授权Claim路径，默认groups，其他Provider可配置为roles、realm_access.roles等实际返回的Claim
+sso_authorization_claim=groups
+#允许访问的Claim值，多个值使用英文逗号分隔，使用Group Membership Mapper且关闭Full group path时填组名即可
+sso_authorization_values=prometheusalert-admin
+#SSO Cookie加密密钥，建议配置32位以上随机字符串
+sso_cookie_secret=
+#生产环境HTTPS时设为1，本地HTTP调试时设为0
+sso_cookie_secure=1
+#SSO会话有效期，单位秒，权限变更在下次登录或会话到期后生效
+sso_session_ttl_seconds=28800
+#OIDC Provider的登出地址及回跳地址，Provider支持RP-Initiated Logout时配置
+sso_logout_url=
+sso_post_logout_redirect_url=https://prometheusalert.example.com/login
+
 #---------------------↓webhook-----------------------
 #是否开启钉钉告警通道,可同时开始多个通道0为关闭,1为开启
 open-dingding=1

controllers/WebLogin.go

@@ -18,6 +18,7 @@ func (c *LoginController) Prepare() {
 		title = "PrometheusAlert"
 	}
 	c.Data["AppTitle"] = title
+	c.Data["SSOEnabled"] = IsSSOEnabled()
 }
 
 func (c *LoginController) Get() {
@@ -26,6 +27,11 @@ func (c *LoginController) Get() {
 		c.Ctx.SetCookie("username", "", -1, "/")
 		c.Ctx.SetCookie("logintoken", "", -1, "/")
 		c.Ctx.SetCookie("password", "", -1, "/") // 清除旧版本可能残留的明文密码 cookie
+		clearSSOCookies(c.Ctx.ResponseWriter)
+		if logoutRedirect := SSOLogoutRedirect(); logoutRedirect != "" {
+			c.Redirect(logoutRedirect, 302)
+			return
+		}
 		c.Redirect("/", 302)
 		return
 	}
@@ -65,18 +71,40 @@ func (c *LoginController) Post() {
 	//return
 }
 
+func (c *LoginController) Session() {
+	username := CurrentAccountName(c.Ctx)
+	if username == "" {
+		c.Ctx.Output.SetStatus(401)
+		c.Data["json"] = map[string]interface{}{"authenticated": false}
+		c.ServeJSON()
+		return
+	}
+	c.Data["json"] = map[string]interface{}{
+		"authenticated": true,
+		"username":      username,
+	}
+	c.ServeJSON()
+}
+
 // 检查cookie是否为登录状态
 func CheckAccount(mycookie *context.Context) bool {
+	return CurrentAccountName(mycookie) != ""
+}
+
+func CurrentAccountName(mycookie *context.Context) string {
 	ckUser, err := mycookie.Request.Cookie("username")
 	if err != nil {
-		return false
+		return SSOAccountName(mycookie)
 	}
 	ckToken, err := mycookie.Request.Cookie("logintoken")
 	if err != nil {
-		return false
+		return SSOAccountName(mycookie)
 	}
 	cfgUser := beego.AppConfig.String("login_user")
 	cfgPwd := beego.AppConfig.String("login_password")
 	expectedToken := fmt.Sprintf("%x", sha256.Sum256([]byte(cfgUser+cfgPwd+"PrometheusAlert")))
-	return ckUser.Value == cfgUser && ckToken.Value == expectedToken
+	if ckUser.Value == cfgUser && ckToken.Value == expectedToken {
+		return ckUser.Value
+	}
+	return SSOAccountName(mycookie)
 }